@OWASPLondon Chapter Leader (#OWASP #OWASPLondon). OWASP Board Member. Application Security (#AppSec) Consultant. OWASP #Nettacker Project leader. #CISSP
London, UK
Joined September 2013
- Tweets5.6K
- Following3.7K
- Followers7.4K
- Likes11.4K
#LiteLLM compromised AGAIN! LiteLLM v1.107.0 on #PyPI carries a remote code execution backdoor and a credential stealer which steals Cloud and AI credentials. #Malware runs at Python startup, no import needed.
#SoftwareSupplyChainSecurity
👇
thehackernews.com/2026/10/li…
Cyber criminals steal children's data after company used 'Password1' #password to protect old account:
👇
bbc.co.uk/news/articles/c6r7…
#Node.js issued security updates for its 22.x, 24.x, and 26.x versions, fixing high-severity issues in DNS resolution, TLS certificates, Brotli decoding, HTTP agents, and crypto caches:
👇
nodejs.org/en/blog/vulnerabi…
🚨 #PHP2Shell: Two critical #PHP flaws (CVE-2026-109618 & CVE-2026-109619) allow unauthenticated #RCE!
#WordPress, #Drupal, #Magento and countless web apps may be exposed. PHP powers 69% of websites.
Emergency patches are OUT. Update PHP now!
👇
laravel-news.com/php-critica…
Global #HTTPS trust incident! #eMudhra, an Indian Certificate Authority trusted worldwide, issued 8 CA certificates with trivially weak private keys.
Impact: forged HTTPS certificates, website impersonation & risks beyond browsers.
👇
bleepingcomputer.com/news/se…
#GoogleCloud outage hits UK banks (HSBC, Lloyds, Revolut), UK courts and many other businesses:
#GoogleCloudDown
#GCPdown
👇
bbc.co.uk/news/live/c58jd2kj…
If you are an OWASP member - don't forget to vote in the OWASP Global Board elections!
All eligible members should have received an e-ballot (check the email you used to pay for your OWASP membership):
🗳️☑️
🗳️ OWASP Board Election voting is open!
OWASP members, it’s time to make your voice heard! With three Board seats up for election, your vote helps shape the future of our community.
📩 Keep an eye on your inbox for your unique ballot (check both personal and OWASP emails!).
⏰ Voting closes October 30 at midnight UTC.
Learn more: owasp.org/board/elections/20…
#community #opensource #boardelections #appsec
#NPM - A malicious npm package 'imgdecode' hides a Windows DLL that downloads encrypted shellcode from GitHub and injects it into "dllhost.exe".
One "require()" could compromise a developer’s machine:
#SoftwareSupplyChainSecurity
👇
thehackernews.com/2026/10/ma…
Hijack an #npm package without stealing credentials? #GitHub Tightens npm Publishing After a "SlugFest" Flaw Left 1,500+ Packages Vulnerable to Hijacking:
#SoftwareSupplyChainSecurity
👇
thehackernews.com/2026/10/gi…
#Anthropic launches FREE AI-powered vulnerability scanning service for established #opensource projects that have a critical impact on infrastructure and user security.
🔍 Periodic scans using Claude Mythos
🤖 Fully AI-generated reports
#AppSec
👇
thehackernews.com/2026/10/an…
#GitHub repos hit by a new supply chain attack - GhostAction attackers compromised maintainer accounts and injected malware into 346 repositories, including #Uber's athenadriver stealing cloud&AI credentials, CI/CD secrets:
#SoftwareSupplyChainSecurity
👇
socket.dev/blog/ghostaction-…
Sam Stepanyan retweeted
Our meetup has started and we currently have @HannahFoxwell on stage speaking about Platform as a Product - What Happens When We Treat Security As a User?
Watch the 📺 livestream here:
👇
youtube.com/live/qhzDJwh_VJ0
Using #Atlassian products like #Confluence, #Jira or #Bitbucket on-premise?
Critical vulnerability CVE-2026-21589 (CVSS 9.3) lets unauthenticated attackers read known web-root files across 8 Atlassian products. Patch affected self-hosted instances now!
👇
thehackernews.com/2026/10/cr…
#Microsoft Exchange Vulnerabilty CVE-2026-96940 Lets Authenticated Attackers Read Other Users' Mailboxes:
👇
thehackernews.com/2026/10/mi…
#Citrix: A third #NetScaler #zeroday is being exploited days after admins patched two earlier flaws. CVE-2026-88779 remotely crashes SAML-enabled appliances. Install 14.1-73.41/13.1-64.28+, preserve evidence and investigate unexpected reboots:
👇
socprime.com/blog/cve-2026-8…
#MikroTik CVE-2026-84411 is a 9.8 pre-auth root #RCE #vulnerability: one crafted HTTP request can execute code or crash RouterOS! Patched versions available.
367,000+ hosts expose the MikroTik RouterOS web interface directly to the internet.
👇
cybernews.com/security/mikro…
Sam Stepanyan retweeted
The next #OWASPLondon Chapter meetup will take place on October 7th, 2026.
This event is kindly sponsored by @nuaware_tech , @BlackDuck_SW and @sysdig .
Talks from @HannahFoxwell , Bhavin Bhatt and Emmanuel Gonzalez Carmona.
REGISTER to attend here:
👇
eventbrite.co.uk/e/owasp-lon…
#AI coding agents asked for review screenshots leaked internal images in public #GitHub repos, researchers say.
Researchers counted 13,000+ images at 300+ orgs, including customer billing records!
#AISecurity
👇 thehackernews.com/2026/09/ai…
Two compromised #GitHub Actions 'actions-cool' were re-enabled with malicious tags intact, silently restarting Mini Shai-Hulud worm across downstream workflows. One action has about 15,000 dependent repos!
👇
#SupplyChainSecurity
socket.dev/blog/mini-shai-hu…
