Application Security Feed
@appsecfeed.bsky.social
⚠️ Bot Account ⚠️
Follow for my hand-curated application security feed. Contains multiple newsletters, blogs, HackerNews feeds, and more.
💬 Run by @alp1n3.dev. Reach out with any suggestions for improvement!
Follow for my hand-curated application security feed. Contains multiple newsletters, blogs, HackerNews feeds, and more.
💬 Run by @alp1n3.dev. Reach out with any suggestions for improvement!
🗞️ cURL stopped HackerOne bug bounty program due to excessive slop reports
🔗 https://github.com/curl/curl/pull/20312
🔗 https://github.com/curl/curl/pull/20312
January 20, 2026 at 12:32 PM
🗞️ cURL stopped HackerOne bug bounty program due to excessive slop reports
🔗 https://github.com/curl/curl/pull/20312
🔗 https://github.com/curl/curl/pull/20312
🗞️ How we mitigated a vulnerability in Cloudflare’s ACME validation logic
🔗 https://blog.cloudflare.com/acme-path-vulnerability/
🔗 https://blog.cloudflare.com/acme-path-vulnerability/
January 20, 2026 at 12:31 PM
🗞️ How we mitigated a vulnerability in Cloudflare’s ACME validation logic
🔗 https://blog.cloudflare.com/acme-path-vulnerability/
🔗 https://blog.cloudflare.com/acme-path-vulnerability/
🗞️ OWASP PTK add-on for ZAP is now released
🔗 https://www.zaproxy.org/blog/2026-01-19-owasp-ptk-add-on/
🔗 https://www.zaproxy.org/blog/2026-01-19-owasp-ptk-add-on/
January 20, 2026 at 12:30 PM
🗞️ OWASP PTK add-on for ZAP is now released
🔗 https://www.zaproxy.org/blog/2026-01-19-owasp-ptk-add-on/
🔗 https://www.zaproxy.org/blog/2026-01-19-owasp-ptk-add-on/
🗞️ Research Worth Reading Week 03/2026
🔗 https://pentesterlab.com/blog/research-worth-reading-week03-2026
🔗 https://pentesterlab.com/blog/research-worth-reading-week03-2026
January 19, 2026 at 12:32 PM
🗞️ Research Worth Reading Week 03/2026
🔗 https://pentesterlab.com/blog/research-worth-reading-week03-2026
🔗 https://pentesterlab.com/blog/research-worth-reading-week03-2026
🗞️ Scaling developer content production at Snyk
🔗 https://developerrelations.com/case-studies/snyk-content-scaling/
🔗 https://developerrelations.com/case-studies/snyk-content-scaling/
January 19, 2026 at 12:31 PM
🗞️ Scaling developer content production at Snyk
🔗 https://developerrelations.com/case-studies/snyk-content-scaling/
🔗 https://developerrelations.com/case-studies/snyk-content-scaling/
🗞️ CVEFinder – Fast CVE lookup with product-level mapping
🔗 https://news.ycombinator.com/item?id=46676994
🔗 https://news.ycombinator.com/item?id=46676994
January 19, 2026 at 12:30 PM
🗞️ CVEFinder – Fast CVE lookup with product-level mapping
🔗 https://news.ycombinator.com/item?id=46676994
🔗 https://news.ycombinator.com/item?id=46676994
🗞️ CVE-2026-0915: GNU C Library Fixes a Security Issue Present Since 1996
🔗 https://www.phoronix.com/news/Glibc-Security-Fix-For-1996-Bug
🔗 https://www.phoronix.com/news/Glibc-Security-Fix-For-1996-Bug
January 18, 2026 at 12:31 PM
🗞️ CVE-2026-0915: GNU C Library Fixes a Security Issue Present Since 1996
🔗 https://www.phoronix.com/news/Glibc-Security-Fix-For-1996-Bug
🔗 https://www.phoronix.com/news/Glibc-Security-Fix-For-1996-Bug
🗞️ Crypto holder loses $283 million to scammer impersonating wallet support
🔗 https://web3isgoinggreat.com/single/trezor-support-scam
🔗 https://web3isgoinggreat.com/single/trezor-support-scam
January 18, 2026 at 12:30 PM
🗞️ Crypto holder loses $283 million to scammer impersonating wallet support
🔗 https://web3isgoinggreat.com/single/trezor-support-scam
🔗 https://web3isgoinggreat.com/single/trezor-support-scam
January 17, 2026 at 12:30 PM
🗞️ New Vulnerability in n8n – CVE-2026-21858
🔗 https://www.schneier.com/blog/archives/2026/01/new-vulnerability-in-n8n.html
🔗 https://www.schneier.com/blog/archives/2026/01/new-vulnerability-in-n8n.html
January 16, 2026 at 12:35 PM
🗞️ New Vulnerability in n8n – CVE-2026-21858
🔗 https://www.schneier.com/blog/archives/2026/01/new-vulnerability-in-n8n.html
🔗 https://www.schneier.com/blog/archives/2026/01/new-vulnerability-in-n8n.html
🗞️ Analysis of ServiceNow's AI Vulnerability (85% of Fortune 500 Affected)
🔗 https://opena2a.org/blogs/servicenow-ai-vulnerability
🔗 https://opena2a.org/blogs/servicenow-ai-vulnerability
January 16, 2026 at 12:34 PM
🗞️ Analysis of ServiceNow's AI Vulnerability (85% of Fortune 500 Affected)
🔗 https://opena2a.org/blogs/servicenow-ai-vulnerability
🔗 https://opena2a.org/blogs/servicenow-ai-vulnerability
🗞️ WinBoat: Drive by Client RCE and Sandbox Escape
🔗 https://hack.do/posts/winboat-guest-service-host-rce/
🔗 https://hack.do/posts/winboat-guest-service-host-rce/
January 16, 2026 at 12:33 PM
🗞️ WinBoat: Drive by Client RCE and Sandbox Escape
🔗 https://hack.do/posts/winboat-guest-service-host-rce/
🔗 https://hack.do/posts/winboat-guest-service-host-rce/
January 16, 2026 at 12:32 PM
🗞️ Last Week in AppSec for 15. January 2026
🔗 https://checkmarx.com/zero-post/last-week-in-appsec-for-15-january-2026/
🔗 https://checkmarx.com/zero-post/last-week-in-appsec-for-15-january-2026/
January 16, 2026 at 12:31 PM
🗞️ Last Week in AppSec for 15. January 2026
🔗 https://checkmarx.com/zero-post/last-week-in-appsec-for-15-january-2026/
🔗 https://checkmarx.com/zero-post/last-week-in-appsec-for-15-january-2026/
🗞️ [tl;dr sec] #311 - Slack's Security Agents, Cloud-Native Detection Engineering, Trail of Bits' Claude Skills
🔗 https://tldrsec.com/p/tldr-sec-311
🔗 https://tldrsec.com/p/tldr-sec-311
January 16, 2026 at 12:30 PM
🗞️ [tl;dr sec] #311 - Slack's Security Agents, Cloud-Native Detection Engineering, Trail of Bits' Claude Skills
🔗 https://tldrsec.com/p/tldr-sec-311
🔗 https://tldrsec.com/p/tldr-sec-311
🗞️ Building the Talent Engine Behind TRM's Mission to Protect Billions | TRM Blog
🔗 https://www.trmlabs.com/resources/blog/building-the-talent-engine-behind-trms-mission-to-protect-billions
🔗 https://www.trmlabs.com/resources/blog/building-the-talent-engine-behind-trms-mission-to-protect-billions
January 15, 2026 at 2:17 PM
🗞️ Building the Talent Engine Behind TRM's Mission to Protect Billions | TRM Blog
🔗 https://www.trmlabs.com/resources/blog/building-the-talent-engine-behind-trms-mission-to-protect-billions
🔗 https://www.trmlabs.com/resources/blog/building-the-talent-engine-behind-trms-mission-to-protect-billions
🗞️ Community-powered security with AI: an open source framework for security research
🔗 https://github.blog/security/community-powered-security-with-ai-an-open-source-framework-for-security-research/
🔗 https://github.blog/security/community-powered-security-with-ai-an-open-source-framework-for-security-research/
January 15, 2026 at 2:16 PM
🗞️ Community-powered security with AI: an open source framework for security research
🔗 https://github.blog/security/community-powered-security-with-ai-an-open-source-framework-for-security-research/
🔗 https://github.blog/security/community-powered-security-with-ai-an-open-source-framework-for-security-research/
🗞️ Curl to end Bug Bounty program due to overwhelming number of AI submissions
🔗 https://github.com/curl/curl-www/pull/538
🔗 https://github.com/curl/curl-www/pull/538
January 15, 2026 at 2:15 PM
🗞️ Curl to end Bug Bounty program due to overwhelming number of AI submissions
🔗 https://github.com/curl/curl-www/pull/538
🔗 https://github.com/curl/curl-www/pull/538
🗞️ Determinate Secure Packages: Nixpkgs with SBOMs, FIPS, and SLA'd CVE Patching
🔗 https://determinate.systems/blog/determinate-secure-packages/
🔗 https://determinate.systems/blog/determinate-secure-packages/
January 15, 2026 at 2:14 PM
🗞️ Determinate Secure Packages: Nixpkgs with SBOMs, FIPS, and SLA'd CVE Patching
🔗 https://determinate.systems/blog/determinate-secure-packages/
🔗 https://determinate.systems/blog/determinate-secure-packages/
🗞️ $250K+ XSS in Meta Conversion API Leading to Zero-Click Account Takeover
🔗 https://ysamm.com/uncategorized/2025/01/13/capig-xss.html
🔗 https://ysamm.com/uncategorized/2025/01/13/capig-xss.html
January 15, 2026 at 2:13 PM
🗞️ $250K+ XSS in Meta Conversion API Leading to Zero-Click Account Takeover
🔗 https://ysamm.com/uncategorized/2025/01/13/capig-xss.html
🔗 https://ysamm.com/uncategorized/2025/01/13/capig-xss.html
🗞️ DoS Vulnerability in Node.js for React, Next.js, and APM Users
🔗 https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks
🔗 https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks
January 15, 2026 at 2:12 PM
🗞️ DoS Vulnerability in Node.js for React, Next.js, and APM Users
🔗 https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks
🔗 https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks
🗞️ Stop trusting torch.load() – I built a tool to scan AI models for RCE
🔗 https://github.com/ArseniiBrazhnyk/Veritensor
🔗 https://github.com/ArseniiBrazhnyk/Veritensor
January 15, 2026 at 2:11 PM
🗞️ Stop trusting torch.load() – I built a tool to scan AI models for RCE
🔗 https://github.com/ArseniiBrazhnyk/Veritensor
🔗 https://github.com/ArseniiBrazhnyk/Veritensor
January 15, 2026 at 2:10 PM
🗞️ Former NYC Mayor Eric Adams accused of rug pull as NYC Token crashes
🔗 https://web3isgoinggreat.com/single/nyc-token-crash
🔗 https://web3isgoinggreat.com/single/nyc-token-crash
January 14, 2026 at 12:34 PM
🗞️ Former NYC Mayor Eric Adams accused of rug pull as NYC Token crashes
🔗 https://web3isgoinggreat.com/single/nyc-token-crash
🔗 https://web3isgoinggreat.com/single/nyc-token-crash
🗞️ Building the Talent Engine Behind TRM's Mission to Protect Billions | TRM Blog
🔗 https://www.trmlabs.com/resources/blog/building-the-talent-engine-behind-trms-mission-to-protect-billions
🔗 https://www.trmlabs.com/resources/blog/building-the-talent-engine-behind-trms-mission-to-protect-billions
January 14, 2026 at 12:33 PM
🗞️ Building the Talent Engine Behind TRM's Mission to Protect Billions | TRM Blog
🔗 https://www.trmlabs.com/resources/blog/building-the-talent-engine-behind-trms-mission-to-protect-billions
🔗 https://www.trmlabs.com/resources/blog/building-the-talent-engine-behind-trms-mission-to-protect-billions