Application Security Standards
LightNews LightNews
banner
appsecuritystandards.org
Application Security Standards
@appsecuritystandards.org
40 followers 47 following 36 posts
Independent intelligence for application security and software supply chain.
Glossary, vendor directory and webinars at appsecuritystandards.org
Posts Replies Media Videos
Pinned
appsecuritystandards.org
Application Security Standards @appsecuritystandards.org · 20d
Application Security Standards: Independent intelligence for application security and software supply chain.

Here we share terms from our glossary, plus our vendor directory and webinars.

appsecuritystandards.org

#AppSec #infosec
appsecuritystandards.org
63,000 Attacks in a Day: Teardown of the WordPress Core RCE

#AppSec #infosec
63,000 Attacks in a Day: Teardown of the WordPress Core RCE
A high-severity WordPress Core RCE vulnerability triggered nearly 63,000 attacks in a single day, revealing risks in patch timing and upgrade design.
appsecuritystandards.org
November 2, 2026 at 8:03 PM
appsecuritystandards.org
Term of the day: Container Escape

A container escape occurs when an application or process running inside a container gains unauthorized access to resources outside of it, such as the host operating system or...

Full definition: appsecuritystandards.org/glossary/container-escape

#AppSec #infosec
Container Escape. A container escape occurs when an application or process running inside a container gains unauthorized access to resources outside of it, such as the host operating system or other containers. This breaks the isolation boundary that containers rely on to keep workloads separate and secure. Attackers who achieve a container escape may be able to access sensitive host-level data, escalate privileges, or move laterally within an environment.
November 2, 2026 at 4:04 PM
appsecuritystandards.org
AI Coding Assistants Are Running Browsers You Can't Secure

#AppSec #infosec
AI Coding Assistants Are Running Browsers You Can't Secure
Embedded browsers in AI coding assistants like VS Code and GitHub Copilot can expose sensitive credentials due to flawed trust models, posing serious security risks.
appsecuritystandards.org
November 1, 2026 at 8:03 PM
appsecuritystandards.org
Term of the day: Configuration Drift

Configuration drift is when a system's actual settings gradually move away from the intended or approved setup over time. This can happen because of manual changes...

Full definition: appsecuritystandards.org/glossary/configuration-drift

#AppSec #infosec
Configuration Drift. Configuration drift is when a system's actual settings gradually move away from the intended or approved setup over time. This can happen because of manual changes, software updates, or other incremental modifications that are not tracked or controlled. It matters for security because these untracked deviations can introduce vulnerabilities and cause systems to fall out of compliance with security policies.
November 1, 2026 at 4:04 PM
appsecuritystandards.org
850 GitHub Accounts Compromised Through CI/CD Workflows

#AppSec #infosec
850 GitHub Accounts Compromised Through CI/CD Workflows
Over 850 GitHub accounts were compromised through malicious CI/CD workflows that bypass secret masking and exfiltrate credentials via GitHub's API.
appsecuritystandards.org
October 31, 2026 at 7:03 PM
appsecuritystandards.org
Term of the day: Compliance as Code

Compliance as Code is the practice of expressing regulatory and policy requirements as machine-readable code so that compliance checks can be automated rather than...

Full definition: appsecuritystandards.org/glossary/compliance-as-code

#AppSec #infosec
Compliance as Code. Compliance as Code is the practice of expressing regulatory and policy requirements as machine-readable code so that compliance checks can be automated rather than performed manually. This approach allows organizations to continuously and consistently verify that their systems, infrastructure, and software meet required standards. By embedding compliance rules directly into development and deployment workflows, teams can detect violations earlier and reduce the effort needed for audits.
October 31, 2026 at 3:04 PM
appsecuritystandards.org
93.6% Still Exposed: 5 Patching Mistakes That Explain PHP2Shell

#AppSec #infosec
93.6% Still Exposed: 5 Patching Mistakes That Explain PHP2Shell
Five days after PHP2Shell disclosure, 93.6% of PHP systems remained vulnerable due to common patching mistakes that hinder swift remediation.
appsecuritystandards.org
October 30, 2026 at 7:03 PM
appsecuritystandards.org
Term of the day: Compensating Controls

Compensating controls are alternative security measures put in place when a primary or recommended security control cannot be implemented, typically due to...

Full definition: appsecuritystandards.org/glossary/compensating-controls

#AppSec #infosec
Compensating Controls. Compensating controls are alternative security measures put in place when a primary or recommended security control cannot be implemented, typically due to technical limitations, legacy systems, or business constraints. They are designed to provide a comparable level of protection to the original requirement, even though they fulfill it through a different mechanism. For example, if a system cannot be updated to meet a specific security standard directly, a compensating control offers an alternative way to address the underlying risk.
October 30, 2026 at 3:05 PM
appsecuritystandards.org
Thousands of Repos Compromised via GitHub Tokens

#AppSec #infosec
Thousands of Repos Compromised via GitHub Tokens
Thousands of developer repositories are compromised by attackers exploiting exposed GitHub tokens, leading to widespread data exfiltration and security risks.
appsecuritystandards.org
October 29, 2026 at 7:03 PM
appsecuritystandards.org
Term of the day: Common Vulnerability Scoring System

CVSS is a standardized, open framework for rating the severity of security vulnerabilities in computing systems. It assigns each...

Full definition: appsecuritystandards.org/glossary/common-vulnerability-scoring-system

#AppSec #infosec
Common Vulnerability Scoring System. CVSS is a standardized, open framework for rating the severity of security vulnerabilities in computing systems. It assigns each vulnerability a numerical score that represents how severe the flaw is, helping organizations understand and prioritize their response. The score is intended to measure severity, not overall risk.
October 29, 2026 at 3:06 PM
appsecuritystandards.org
PHP2Shell Breach: How a European Agency Lost Control

#AppSec #infosec
PHP2Shell Breach: How a European Agency Lost Control
The PHP2Shell breach exposed vulnerabilities in 37 million internet-facing PHP systems, highlighting risks to critical infrastructure from AI-driven attacks.
appsecuritystandards.org
October 28, 2026 at 7:03 PM
appsecuritystandards.org
Term of the day: Common Vulnerabilities and Exposures

Common Vulnerabilities and Exposures (CVE) is a publicly available catalog that identifies and lists known computer security flaws in...

Full definition: appsecuritystandards.org/glossary/common-vulnerabilities-and-exposures

#AppSec #infosec
Common Vulnerabilities and Exposures. Common Vulnerabilities and Exposures (CVE) is a publicly available catalog that identifies and lists known computer security flaws in software and hardware. Each vulnerability in the list receives a unique identifier (such as CVE-2024-12345), which makes it easier for security teams, vendors, and tools to refer to the same issue consistently. The CVE system helps organizations coordinate their responses to security threats by providing a shared reference point.
October 28, 2026 at 3:04 PM
appsecuritystandards.org
Brotli Decoder Flaw: When One CVE Becomes 50 Patches

#AppSec #infosec
Brotli Decoder Flaw: When One CVE Becomes 50 Patches
A critical memory-corruption flaw in Google's Brotli decoder led to over 50 patches across platforms, exposing challenges in managing bundled open-source dependencies.
appsecuritystandards.org
October 27, 2026 at 7:03 PM
appsecuritystandards.org
Term of the day: Command Injection

Command injection is an attack where an attacker supplies malicious input to a vulnerable application in order to execute unauthorized operating system commands on the host...

Full definition: appsecuritystandards.org/glossary/command-injection

#AppSec #infosec
Command Injection. Command injection is an attack where an attacker supplies malicious input to a vulnerable application in order to execute unauthorized operating system commands on the host server. This typically occurs when an application passes unsanitized user-controlled data to a system shell or command interpreter. Successful exploitation can allow an attacker to run arbitrary commands with the privileges of the application process.
October 27, 2026 at 3:04 PM
appsecuritystandards.org
PHP's RCE Advisory: A Configuration Failure

#AppSec #infosec
PHP's RCE Advisory: A Configuration Failure
PHP's CVE-2026-115560 RCE vulnerability requires specific config failures. Without patches, organizations must enforce secure PHP baselines and rapid mitigation.
appsecuritystandards.org
October 26, 2026 at 7:03 PM
appsecuritystandards.org
Term of the day: Code Signing

Code signing is the process of applying a digital signature to software, scripts, or executable files to confirm who created them and to verify that the code has not been tampered...

Full definition: appsecuritystandards.org/glossary/code-signing

#AppSec #infosec
Code Signing. Code signing is the process of applying a digital signature to software, scripts, or executable files to confirm who created them and to verify that the code has not been tampered with since it was signed. It helps users and operating systems trust that downloaded software is authentic and unmodified. Without code signing, systems may display security warnings or block the software from running.
October 26, 2026 at 3:04 PM
appsecuritystandards.org
Two PHP RCE Flaws: What Failed and What to Do

#AppSec #infosec
Two PHP RCE Flaws: What Failed and What to Do
Two critical PHP RCE vulnerabilities allow unauthenticated remote code execution, exposing failures in asset inventory, change management, and patching speed.
appsecuritystandards.org
October 25, 2026 at 7:03 PM
appsecuritystandards.org
Term of the day: Cloud-Native Security

Cloud-native security is a set of strategies, practices, and technologies designed to protect applications and infrastructure that are built for and deployed in...

Full definition: appsecuritystandards.org/glossary/cloud-native-security

#AppSec #infosec
Cloud-Native Security. Cloud-native security is a set of strategies, practices, and technologies designed to protect applications and infrastructure that are built for and deployed in cloud environments. It focuses on securing dynamic, distributed systems such as containers, microservices, and serverless functions throughout their entire lifecycle. Because cloud-native environments change rapidly and scale automatically, traditional security approaches typically do not address their unique challenges effectively.
October 25, 2026 at 3:04 PM
appsecuritystandards.org
PHP's 2026 Patch Fumble: What Happens When AI Finds Bugs Faster Than You Can Fix Them

#AppSec #infosec
PHP's 2026 Patch Fumble: What Happens When AI Finds Bugs Faster Than You Can Fix Them
In 2026, AI tools uncovered critical PHP vulnerabilities faster than maintainers could patch, exposing systemic risks and challenging traditional open-source security models.
appsecuritystandards.org
October 24, 2026 at 7:03 PM
appsecuritystandards.org
Term of the day: Cloud-Native Application Protection Platform

A Cloud-Native Application Protection Platform (CNAPP) is an all-in-one security solution designed to protect...

Full definition: appsecuritystandards.org/glossary/cloud-native-application-protection-platform

#AppSec #infosec
Cloud-Native Application Protection Platform. A Cloud-Native Application Protection Platform (CNAPP) is an all-in-one security solution designed to protect applications that run in cloud environments. It brings together multiple cloud security capabilities into a single platform, making it easier for organizations to monitor, detect, and address potential security issues across their cloud infrastructure and applications.
October 24, 2026 at 3:05 PM
appsecuritystandards.org
Two Zero-Days in PHP: Why Your Patch Window Just Closed

#AppSec #infosec
Two Zero-Days in PHP: Why Your Patch Window Just Closed
Two critical PHP zero-day RCE vulnerabilities emerged in 2025, impacting all versions before 8.2. AI accelerated exploit discovery, shrinking patch windows dangerously.
appsecuritystandards.org
October 23, 2026 at 7:03 PM
appsecuritystandards.org
Filings fell 18% from August, to 148 from 180.

#AppSec #infosec
September 2026 website accessibility lawsuit report
148 federal website accessibility lawsuits were filed in September 2026 across 8 states. What the complaints alleged, who was sued, where, and by whom.
www.accessibility.com
October 23, 2026 at 5:10 PM
appsecuritystandards.org
Term of the day: Cloud Workload Protection Platform

A Cloud Workload Protection Platform (CWPP) is a security solution designed to protect applications and services running in cloud...

Full definition: appsecuritystandards.org/glossary/cloud-workload-protection-platform

#AppSec #infosec
Cloud Workload Protection Platform. A Cloud Workload Protection Platform (CWPP) is a security solution designed to protect applications and services running in cloud environments from various threats. It provides monitoring and security controls for workloads across different types of cloud setups, including those that span multiple cloud providers or combine cloud and on-premises infrastructure. CWPPs help organizations maintain visibility into and defend their cloud-based applications, virtual machines, containers, and other compute resources.
October 23, 2026 at 3:04 PM
appsecuritystandards.org
OVHcloud's 94-Minute Release Hijack

#AppSec #infosec
OVHcloud's 94-Minute Release Hijack
Discover how OVHcloud's 94-minute release hijack highlights the critical need for release immutability and hash verification to prevent supply chain attacks.
appsecuritystandards.org
October 22, 2026 at 7:05 PM
appsecuritystandards.org
Term of the day: Cloud Security Posture Management

Cloud Security Posture Management is a category of security technology that continuously monitors cloud infrastructure for...

Full definition: appsecuritystandards.org/glossary/cloud-security-posture-management

#AppSec #infosec
Cloud Security Posture Management. Cloud Security Posture Management is a category of security technology that continuously monitors cloud infrastructure for misconfigurations, compliance violations, and security risks. It provides organizations with visibility into their cloud security status and automates the identification and remediation of common issues. CSPM tools are designed to work across public cloud and hybrid cloud environments.
October 22, 2026 at 3:05 PM