#GhostCMS: Critical SQL Injection vulnerability impacts #Ghost 3.24.0 through 6.19.0, and allows unauthenticated attackers to read arbitrary data from the website database, including the admin API keys (CVE-2026-26980): 👇

The spiralling costs of using AI are becoming a real problem: Microsoft stops using Claude Code, Uber burned their entire 2026 AI budget back in April, Salesforce, Meta and even Amazon are limiting the "tokenmaxxing" culture. #AICosts fortune.com/2026/05/22/m...

$148,337 #BugBounty paid by Google to a researcher (@brutecat) who found debug endpoints on Google Cloud allowing to configure privileged workflows leading to full #RCE in Google Cloud production (CVE-2026-2031) #CloudSecurity #BugBountyTips 👇 brutecat.com/articles/goo...

#Laravel-lang: Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer #Malware Attackers injected a credential stealer into 200+ Laravel-lang package versions by pushing tags tied to attacker-controlled forks: #SoftwareSupplyChain 👇

#WhatsApp: Texas Attorney General Sues #Meta Claiming WhatsApp and Meta are continuing to willfully deceive Texans by misrepresenting that their private communications are encrypted when when "in fact Meta employees have access to all WhatsApp messages":

Another mini-#ShaiHulud worm attack last night impacted over 639 versions of packages in #NPM '@ antv' ecosystem. The full Mini Shai-Hulud campaign now impacts 1000+ versions across 500+ unique packages. The campaign spans npm, #PyPI, and #Composer: 👇 socket.dev/blog/antv-pa...

#NPM: Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS #Malware: The malicious packages are: * chalk-tempalte * @deadcode09284814/axios-util * axois-utils * color-style-utils 👇

#NGINX: An 18-year-old RCE vulnerability CVE-2026-42945 in the rewrite module enables server takeover. Update to NGINX 1.31.0 or 1.30.1 immediately! 👇

#OWASP #JuiceShop v20.0.0 released with brand new AI challenges including: * Chatbot Prompt Injection * Greedy Chatbot Manipulation * AI Debugging 👇 owasp.org/blog/2026/...

#Checkmarx is breached again via its Jenkins plugin GitHub repo compromised in a software suply chain hack: #SoftwareSupplyChainSecurity 👇

#npm: TanStack npm packages (84 in total) compromised in a supply chain hack utilising a malicious payload designed to destroy files on developer machines if a stolen GitHub token is revoked ("dead-man's swithch"): #SoftwareSupplyChainSecurity 👇

#SSL: Let's Encrypt Abruptly Stopped TLS Certificate Issuance Due to an Incident: #LetsEncrypt 👇

The video recording of my talk: “Automated Security Testing with OWASP Nettacker” from NDC Security 2026 Conference in Oslo is now available on YouTube: 🎥 #Nettacker 👇

#Nuget: Malicious NuGet packages mimicked trusted .NET libraries to steal credentials, key crypto wallets. Packages: IR.DantUI, IR.OscarUI, IR.Infrastructure.Core, IR.Infrastructure.DataService.Core, IR.iplus32 included an infostealer #malware: 👇

#vm2 NodeJS Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution - patch now! Vm2 is used by 900+ #NPM packages: 👇 thehackernews.com/2026/05/vm2-...

#NextJS and #React Server Components hit with 12 vulnerabilities with 3 high-severity vulns (CVE-2026-44574, CVE-2026-44578, CVE-2026-44581) requiring the most urgent attention and impacting virtually every production NextJS deployment - patch now!

#PyPI 3 Python Packages Deliver ZiChatBot #Malware via Zulip APIs on Windows and Linux: * uuid32-utils * colorinal * termncolor 👇 thehackernews.com/2026/05/pypi...

#PaloAlto PAN-OS Vulnerability CVE-2026-0300 Under Active Exploitation - Enables Remote Code Execution (#RCE) - CVSS 9.3 no patch released yet, but expected soon! 👇 thehackernews.com/2026/05/palo...

#Apache HTTP Server Vulnerability CVE-2026-23918 Exposes Millions of Servers to Remote Code Execution Attacks. Anyone running Apache httpd version 2.4.66 or earlier are strongly urged to upgrade immediately! 👇

#WhatsApp Vulnerability CVE-2026-23866 Lets Attackers Leverage Instagram Reels to Execute Malicious URLs: 👇 cybersecuritynews.com/whatsapp-vul...

#WhatsApp: A US agent claimed WhatsApp encryption is fake and Meta can access messages; the probe was abruptly shut, raising security concerns. The investigation’s closure leaves key questions unanswered, including what evidence was found: securityaffairs.com/191515/socia...

#PyPI: PyTorch Lightning and Intercom-client Packages Hit in Supply Chain Attacks to Steal Credentials. This attack is linked with Mini Shai-Hulud supply chain attack that targeted SAP-related npm packages on Wednesday. #SoftwareSupplyChainSecurity 👇

⚠️ #Linux: Major Linux distributions are impacted by a Privilege Escalation Vulnerability dubbed "CopyFail" (CVE-2026-31431) which sat undetected since 2017. A 732-byte Python script allows any user on Linux to become root: #CopyFail #LPE 👇 www.cyberkendra.com/2026/04/a-73...

#npm: Multiple official SAP npm packages were compromised in what is believed to be a TeamPCP supply-chain attack to steal credentials and authentication tokens: #SoftwareSupplyChainSecurity 👇 www.bleepingcomputer.com/news/securit...

⚠️ #GitHub: Wiz uncovers Remote Code Execution #RCE vulnerability in GitHub(.com) and GitHub Enterprise Server (CVE-2026-3854): 👇 www.wiz.io/blog/github-...

#SMS: Canadian authorities have arrested three men for operating an "SMS blaster" device that pretends to be a cellular tower to send phishing texts directly to nearby phones. SMS should always be treated as an insecure channel: 👇

Everyone’s vibe coding now. But is the produced code actually secure? Jim Manico's excellent talk shows the better path: don’t just ask #ClaudeCode to write code. Engineer with AI. Practical, direct, and highly relevant for anyone building with #AI. Watch it here: 👇

#Passwords: NCSC: Leave passwords in the past - passkeys are the future! UK's National Cyber Security Centre releases guidance - Passwords are no longer resilient enough for the contemporary world. It's time to switch to passkey authenticaton: 👇 www.ncsc.gov.uk/news/ncsc-le...

#Bitwarden CLI was compromised in a supply chain attack! @bitwarden/[email protected] included malicious code: #SoftwareSupplyChainSecurity 👇 thehackernews.com/2026/04/bitw...

#NPM: Self-Propagating Supply Chain Malware Hijacks npm Packages to Steal Developer Tokens. Impacted packages: @automagik/genie @fairwords/loopback-connector-es @fairwords/websocket @openwebconcept/theme-owc pgserve also Python xinference compromised:

⚠️ #Vercel hacked. The popular platform behind tens of thousands of AI apps and the creator of NextJS framework has confirmed a breach. Hackers claiming to be ShinyHunters are selling stolen customer + employee data: #databreach 👇 www.bleepingcomputer.com/news/securit...

Want to present a talk at the #OWASP Global #AppSec Conference 2026 in San Francisco in November? Call For Papers is now open 👇

#Nginx: A critical vulnerability CVE-2026-33032 in Nginx UI with Model Context Protocol (#MCP) support is now being exploited in the wild for full server takeover without authentication. 👇

Our April meetup has started and we have @manicode live on stage right now coding in Claude and talking about Securing Claude Code: Guardrails for AI-Assisted Development Watch the live-stream 📺 here: 👇 www.youtube.com/live/icDqYJ5...

#AWS introduced Agentic Penetration Testing - while everyone is going crazy about Mythos, if you are on AWS you can have an AI Agent relentlessly finding and validating vulnerabilities 24/7: #Pentesting 👇

#Axios - yet another issue with this popular #NPM library: A newly discovered critical vulnerability CVE-2026-40175 in axios has exposed countless web & cloud apps to potential Remote Code Execution (#RCE) and full infrastructure compromise: 👇

#Booking.com warns customers of a #databreach - attackers accessed the database including names, emails, phone numbers, booking details & anything shared with the property. It is unclear if passport details were stolen too, payment info unaffected: 👇 securityaffairs.com/190757/data-...

#PDF Adobe Acrobat Reader Critical Vulnerability CVE-2026-34621 affects * Acrobat DC versions 26.001.21367 and earlier * Acrobat Reader DC versions 26.001.21367 and earlier * Acrobat 2024 versions 24.001.30356 and earlier 👇 thehackernews.com/2026/04/adob...

#OpenAI is impacted by #Axios supply chain breach, its MacOS desktop apps #ChatGPT and #Codex are affected and new updated versions issued: 👇 openai.com/index/axios-...

#Claude Code Can Be Manipulated via CLAUDE.md file to Run SQL Injection Attacks: #AISecurity 👇

#Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access: 👇 thehackernews.com/2026/04/dock...

The next OWASP London Chapter meetup is on April 14th 2026. Talks from Jim Manico, @diniscruz.bsky.social and Claudio Merloni. Register to attend here: 👇 www.eventbrite.co.uk/e/owasp-lond...

I was asked if this is true or BS and a quick check in my browser showed that this is true and in fact there is even more data collected if you start digging into it: 👇

#Claude: Three Command Injection Bugs in Claude Code CLI Allow Credential Exfiltration: 👇

#Rowhammer: New Rowhammer attacks give complete control of machines running Nvidia GPUs: 👇

#Claude Code vulnerable to prompt injection due to subcommand limit #AISecurity 👇 www.scworld.com/brief/claude...

⚠️#Axios #npm package which is very widely used (83M weekly downloads) was compromised, turning installs into #malware 😨 This supply chain attack has a large-scale impact: many JavaScript apps nowadays uses Axios: #SoftwareSupplyChainSecurity 👇 thehackernews.com/2026/03/axio...

#AI: "Copilot Edited an Ad Into My PR!" - in a first report of this kind #GitHub #Copilot injected an ad into a Pull Request text: 👇 notes.zachmanson.com...#AI:

#OpenAI: recent vulnerabilities showed how AI systems can expose sensitive data: * One allowed sensitive conversation data to be exfiltrated * Another enabled GitHub token theft from Codex using the branch name parameter #AISecurity 👇 thehackernews.com/2026/03/open...

#LiteLLM Compromised! LiteLLM - a popular Python Library used by a lot of AI tooling got compromised on PyPI, and the malicious versions are stealing everything they can find on your machine: #SoftwareSupplyChainSecurity 👇