Mistake #1: Checking who you are, but not what you're allowed to touch. I see this over and over again. If I can change from orders/1001 to orders/1002 and see someone's order, that's BOLA, which has topped OWASP top ten for years now.
October 16, 2026 at 3:53 PM
Mistake #1: Checking who you are, but not what you're allowed to touch. I see this over and over again. If I can change from orders/1001 to orders/1002 and see someone's order, that's BOLA, which has topped OWASP top ten for years now.
AI attacks are now autonomous, adaptive, and multi-step. Static prompts can't keep up.
TrojAI Detect's agent-led red teaming runs multi-turn attacks, adapts to responses, and maps findings to OWASP, MITRE & NIST. https://bit.ly/4sadZF5
TrojAI Detect's agent-led red teaming runs multi-turn attacks, adapts to responses, and maps findings to OWASP, MITRE & NIST. https://bit.ly/4sadZF5
October 16, 2026 at 1:02 PM
AI attacks are now autonomous, adaptive, and multi-step. Static prompts can't keep up.
TrojAI Detect's agent-led red teaming runs multi-turn attacks, adapts to responses, and maps findings to OWASP, MITRE & NIST. https://bit.ly/4sadZF5
TrojAI Detect's agent-led red teaming runs multi-turn attacks, adapts to responses, and maps findings to OWASP, MITRE & NIST. https://bit.ly/4sadZF5
The security risk of over-permissioned agents is a major concern. If you need to validate agent outputs against security standards like OWASP, this connector can help: https://vinkius.com/en/ai-agent-connect/security-audit-prover
Connect Security Audit Prover to ChatGPT, Claude and Gemini
Force your AI agent to audit code against OWASP Top 10. Connect this MCP to Claude, Cursor, or Windsurf to catch leaks and injections before they ship.
vinkius.com
October 16, 2026 at 9:31 AM
The security risk of over-permissioned agents is a major concern. If you need to validate agent outputs against security standards like OWASP, this connector can help: https://vinkius.com/en/ai-agent-connect/security-audit-prover
PVS-Studio 8.01 is here.
Java analyzer checked against OWASP Benchmark, we supported JDK 25 & Go 1.27, implemented 3 new OWASP rules, enhanced CWE/SAST filtering in Plog Converter, richer reports and more! More details > pvs-studio.com/en/blog/post...
#DevTools #Java #Golang #OWASP #Release
Java analyzer checked against OWASP Benchmark, we supported JDK 25 & Go 1.27, implemented 3 new OWASP rules, enhanced CWE/SAST filtering in Plog Converter, richer reports and more! More details > pvs-studio.com/en/blog/post...
#DevTools #Java #Golang #OWASP #Release
PVS-Studio 8.01: OWASP Benchmark, JDK 25 and Go 1.27 support, and much more
pvs-studio.com
October 16, 2026 at 8:54 AM
That's a critical scenario. To prevent agents from treating security boundaries as puzzles, we have the Security Audit Prover to force systematic validation of input, secrets, and auth before any code or action is finalized: https://vinkius.com/en/ai-agent-connect/security-audit-prover
Connect Security Audit Prover to ChatGPT, Claude and Gemini
Force your AI agent to audit code against OWASP Top 10. Connect this MCP to Claude, Cursor, or Windsurf to catch leaks and injections before they ship.
vinkius.com
October 16, 2026 at 7:07 AM
That's a critical scenario. To prevent agents from treating security boundaries as puzzles, we have the Security Audit Prover to force systematic validation of input, secrets, and auth before any code or action is finalized: https://vinkius.com/en/ai-agent-connect/security-audit-prover
SecretSifter — OWASP Incubator project: detects credentials exposed in browser-delivered content (JavaScript, config responses, live traffic). https://ktp.sh/LV2ZRscHmM
October 16, 2026 at 5:54 AM
SecretSifter — OWASP Incubator project: detects credentials exposed in browser-delivered content (JavaScript, config responses, live traffic). https://ktp.sh/LV2ZRscHmM
October 16, 2026 at 5:04 AM
October 16, 2026 at 4:59 AM
Automate OWASP ZAP scans from Python via its REST API. Spider, then active scan, no GUI. 124 lines, advanced, for security folks.
https://www.valtersit.com/python/owasp-zap-automation-via-rest-api/
#security #python #appsec
https://www.valtersit.com/python/owasp-zap-automation-via-rest-api/
#security #python #appsec
OWASP ZAP Automation via REST API
www.valtersit.com
October 16, 2026 at 4:40 AM
Automate OWASP ZAP scans from Python via its REST API. Spider, then active scan, no GUI. 124 lines, advanced, for security folks.
https://www.valtersit.com/python/owasp-zap-automation-via-rest-api/
#security #python #appsec
https://www.valtersit.com/python/owasp-zap-automation-via-rest-api/
#security #python #appsec
The latest update for #Kovrr includes "Governing #AI Coding Agents on Developer Laptops" and "Mapping AI Interaction #Monitoring to the #OWASP Top 10 for LLMs".
#Cybersecurity #RiskManagement #CyberRisks https://opsmtrs.com/3IovI6t
#Cybersecurity #RiskManagement #CyberRisks https://opsmtrs.com/3IovI6t
Kovrr
Kovrr financially quantifies cyber risk on demand. Our technology enables decision makers to seamlessly drive actionable cyber risk management decisions.
opsmtrs.com
October 16, 2026 at 3:20 AM
The latest update for #Kovrr includes "Governing #AI Coding Agents on Developer Laptops" and "Mapping AI Interaction #Monitoring to the #OWASP Top 10 for LLMs".
#Cybersecurity #RiskManagement #CyberRisks https://opsmtrs.com/3IovI6t
#Cybersecurity #RiskManagement #CyberRisks https://opsmtrs.com/3IovI6t
The risk of over-permissioned agents is real. If you're looking for ways to validate agent outputs against security standards like OWASP before they go live, this might help: https://vinkius.com/en/ai-agent-connect/security-audit-prover
Connect Security Audit Prover to ChatGPT, Claude and Gemini
Force your AI agent to audit code against OWASP Top 10. Connect this MCP to Claude, Cursor, or Windsurf to catch leaks and injections before they ship.
vinkius.com
October 16, 2026 at 2:35 AM
The risk of over-permissioned agents is real. If you're looking for ways to validate agent outputs against security standards like OWASP before they go live, this might help: https://vinkius.com/en/ai-agent-connect/security-audit-prover
If you are concerned about agents performing unauthorized actions, the Security Audit Prover can help enforce authentication and authorization checks during the development of agentic workflows: https://vinkius.com/en/ai-agent-connect/security-audit-prover
Connect Security Audit Prover to ChatGPT, Claude and Gemini
Force your AI agent to audit code against OWASP Top 10. Connect this MCP to Claude, Cursor, or Windsurf to catch leaks and injections before they ship.
vinkius.com
October 16, 2026 at 2:19 AM
If you are concerned about agents performing unauthorized actions, the Security Audit Prover can help enforce authentication and authorization checks during the development of agentic workflows: https://vinkius.com/en/ai-agent-connect/security-audit-prover
Many thanks to Glyn Wintle for presenting his talk "SAML - Yep, it's Broken" at our September 28th event.
The video recording of the talk is now available on our 📺️ YouTube channel [PLEASE SUBSCRIBE!]:
👇
youtu.be/HK38-E0JzaU
The video recording of the talk is now available on our 📺️ YouTube channel [PLEASE SUBSCRIBE!]:
👇
youtu.be/HK38-E0JzaU
SAML - Yep, it's Broken - Glyn Wintle
YouTube video by OWASP London
youtu.be
October 16, 2026 at 1:00 AM
Many thanks to Glyn Wintle for presenting his talk "SAML - Yep, it's Broken" at our September 28th event.
The video recording of the talk is now available on our 📺️ YouTube channel [PLEASE SUBSCRIBE!]:
👇
youtu.be/HK38-E0JzaU
The video recording of the talk is now available on our 📺️ YouTube channel [PLEASE SUBSCRIBE!]:
👇
youtu.be/HK38-E0JzaU
Time for more tutorials!
Main Ballroom: Break It, Then Fix It: An OWASP Top 10 Workshop for PHP Developers, Eric Mann
Hill Country D: Refactoring Towards Clean Architecture (full-day), Damian Dziaduch
Elm: Creating new PHP extensions in Rust, Daniel Scherzer
buff.ly/qnOI7x5
Main Ballroom: Break It, Then Fix It: An OWASP Top 10 Workshop for PHP Developers, Eric Mann
Hill Country D: Refactoring Towards Clean Architecture (full-day), Damian Dziaduch
Elm: Creating new PHP extensions in Rust, Daniel Scherzer
buff.ly/qnOI7x5
Longhorn PHP
Longhorn PHP is a 2-day conference in Austin, TX to help PHP and other web developers level up their craft and connect with the larger PHP community.
buff.ly
October 15, 2026 at 5:55 PM
Time for more tutorials!
Main Ballroom: Break It, Then Fix It: An OWASP Top 10 Workshop for PHP Developers, Eric Mann
Hill Country D: Refactoring Towards Clean Architecture (full-day), Damian Dziaduch
Elm: Creating new PHP extensions in Rust, Daniel Scherzer
buff.ly/qnOI7x5
Main Ballroom: Break It, Then Fix It: An OWASP Top 10 Workshop for PHP Developers, Eric Mann
Hill Country D: Refactoring Towards Clean Architecture (full-day), Damian Dziaduch
Elm: Creating new PHP extensions in Rust, Daniel Scherzer
buff.ly/qnOI7x5
Hey if you're in #Ottawa or the surrounding area, and looking for something to do this weekend... Alex is doing a talk at OWASP Ottawa on Saturday the 17th "Canadian Digital Sovereignty in a Zero-Trust World". Details of it are in the OWASP quoted post Alex used, so just click it.
Come hear me talk next Saturday in at OWASP Day about digital sovereignty is and how changing risks impact our control of technology and puts Canada's sovereignty at risk.
#OWASP #Ottawa is pleased to announce that Alexander Rudolph, PhD presenting @ OWASP Ottawa Day 2026 on:
"Canadian Digital Sovereignty in a Zero-Trust World"
📅 October 17, 2026
ℹ️ Information: github.com/OWASP-Ottawa...
#DigitalSovereignty #CyberSecurity #Canada #OWASPOttawa2026 #AppSec
"Canadian Digital Sovereignty in a Zero-Trust World"
📅 October 17, 2026
ℹ️ Information: github.com/OWASP-Ottawa...
#DigitalSovereignty #CyberSecurity #Canada #OWASPOttawa2026 #AppSec
October 15, 2026 at 5:40 PM
Hey if you're in #Ottawa or the surrounding area, and looking for something to do this weekend... Alex is doing a talk at OWASP Ottawa on Saturday the 17th "Canadian Digital Sovereignty in a Zero-Trust World". Details of it are in the OWASP quoted post Alex used, so just click it.
The risk of over-permissioned APIs and injection is real. For auditing agent code against OWASP standards before shipping, the Security Audit Prover can help: https://vinkius.com/en/ai-agent-connect/security-audit-prover
Connect Security Audit Prover to ChatGPT, Claude and Gemini
Force your AI agent to audit code against OWASP Top 10. Connect this MCP to Claude, Cursor, or Windsurf to catch leaks and injections before they ship.
vinkius.com
October 15, 2026 at 5:16 PM
The risk of over-permissioned APIs and injection is real. For auditing agent code against OWASP standards before shipping, the Security Audit Prover can help: https://vinkius.com/en/ai-agent-connect/security-audit-prover
🗳️ OWASP Board Election voting is OPEN!
3 Board seats are up for election. Make your voice heard and help shape OWASP’s future!
📩 Check your personal and OWASP email for your ballot.
⏰ Closes Oct 30, midnight UTC.
Vote now: owasp.org/board/elec...
#community #opensource #boardelections
3 Board seats are up for election. Make your voice heard and help shape OWASP’s future!
📩 Check your personal and OWASP email for your ballot.
⏰ Closes Oct 30, midnight UTC.
Vote now: owasp.org/board/elec...
#community #opensource #boardelections
October 15, 2026 at 11:08 AM
🗳️ OWASP Board Election voting is OPEN!
3 Board seats are up for election. Make your voice heard and help shape OWASP’s future!
📩 Check your personal and OWASP email for your ballot.
⏰ Closes Oct 30, midnight UTC.
Vote now: owasp.org/board/elec...
#community #opensource #boardelections
3 Board seats are up for election. Make your voice heard and help shape OWASP’s future!
📩 Check your personal and OWASP email for your ballot.
⏰ Closes Oct 30, midnight UTC.
Vote now: owasp.org/board/elec...
#community #opensource #boardelections
What happens when an LLM has too much agency? Excessive permissions can turn prompt injection into real-world actions. The OWASP LLM Top 10 highlights why least privilege and human approval still matter.
Guide to the OWASP LLM Top 10 | Nordic APIs |
Explore the OWASP LLM Top 10, including prompt injection, excessive agency, model theft, and practical mitigation strategies.
nordicapis.com
October 15, 2026 at 10:51 AM
What happens when an LLM has too much agency? Excessive permissions can turn prompt injection into real-world actions. The OWASP LLM Top 10 highlights why least privilege and human approval still matter.
The risk of over-permissioned APIs and prompt injection is exactly why we built the Security Audit Prover. It forces agents to validate against OWASP standards before shipping code. https://vinkius.com/en/ai-agent-connect/security-audit-prover
Connect Security Audit Prover to ChatGPT, Claude and Gemini
Force your AI agent to audit code against OWASP Top 10. Connect this MCP to Claude, Cursor, or Windsurf to catch leaks and injections before they ship.
vinkius.com
October 15, 2026 at 7:42 AM
The risk of over-permissioned APIs and prompt injection is exactly why we built the Security Audit Prover. It forces agents to validate against OWASP standards before shipping code. https://vinkius.com/en/ai-agent-connect/security-audit-prover
#OWASP Saitama MTG #34 は10/19 1900〜、春日部市の活樹ふれあいキューブ マツナガ4F会議室2で開催します！トーク #1 として @alterakey.bsky.social さんから、HTML5アプリにおけるSession Riding攻撃についてお話をいただきます。どうぞ奮ってご参加ください！ハイブリッド開催ですので、オンラインでも参加可能ですよ！お楽しみに。参加登録はこちらから！ #OWASP_Saitama / owaspsaitama.connpass.com/event/404239/
https://owaspsaitama.connpass.com/event/404239/
owaspsaitama.connpass.com
October 15, 2026 at 4:45 AM
#OWASP Saitama MTG #34 は10/19 1900〜、春日部市の活樹ふれあいキューブ マツナガ4F会議室2で開催します！トーク #1 として @alterakey.bsky.social さんから、HTML5アプリにおけるSession Riding攻撃についてお話をいただきます。どうぞ奮ってご参加ください！ハイブリッド開催ですので、オンラインでも参加可能ですよ！お楽しみに。参加登録はこちらから！ #OWASP_Saitama / owaspsaitama.connpass.com/event/404239/
OWASP ASVS の再点検を AI Skill で効率化できるか — 4 回の実験で分かったこと | ゆきひろ #zenn
https://zenn.dev/suna/articles/226b73af3a3dda
https://zenn.dev/suna/articles/226b73af3a3dda
OWASP ASVS の再点検を AI Skill で効率化できるか — 4 回の実験で分かったこと
zenn.dev
October 14, 2026 at 10:41 PM
OWASP ASVS の再点検を AI Skill で効率化できるか — 4 回の実験で分かったこと | ゆきひろ #zenn
https://zenn.dev/suna/articles/226b73af3a3dda
https://zenn.dev/suna/articles/226b73af3a3dda
📌 Black Hat Presentation Reveals 0% Detection Rate by SAST Tools in New Security Benchmark https://www.cyberhub.blog/article/27624-black-hat-presentation-reveals-0-detection-rate-by-sast-tools-in-new-security-benchmark
Black Hat Presentation Reveals 0% Detection Rate by SAST Tools in New Security Benchmark
The presentation at Black Hat introduces a safe code detection benchmark developed by researchers, including Irina (a bachelor student at Masaryk University) and Andrew, to evaluate Static Application Security Testing (SAST) tools. Their benchmark, consisting of 33 realistic vulnerability examples across five subcategories (source, authentication, authorization, cardinality, and normalization confusions), revealed a 0% detection rate by existing SAST tools, despite OWASP benchmarks claiming 80-85% true positive rates. The team demonstrated three case studies—coupon reuse, negative tipping, and cross-tenant access—highlighting how modern web development practices (e.g., refactoring, abstraction) obscure vulnerabilities from SAST’s taint analysis. While AI tools like GitHub Copilot and Gemini achieved 100% detection in their tests, the presenters cautioned that SAST remains more scalable and deterministic, though current tools lack interactive, developer-friendly custom rule capabilities. They proposed integrating SAST more closely with IDEs (e.g., as language servers) and using custom rules to enforce security invariants, noting that convoluted code often resists both SAST and AI analysis. The talk concluded that SAST vendors must improve framework coverage and rule-writing flexibility to address complex, multi-layer vulnerabilities. November 2022 marked a shift with AI’s emergence, but the benchmark’s saturation limits its generalizability.
www.cyberhub.blog
October 14, 2026 at 8:07 PM
📌 Black Hat Presentation Reveals 0% Detection Rate by SAST Tools in New Security Benchmark https://www.cyberhub.blog/article/27624-black-hat-presentation-reveals-0-detection-rate-by-sast-tools-in-new-security-benchmark
🔐 Cybersecurity Club Meeting | October 1, 2026 🚀
Our Cybersecurity Club continued exploring the vulnerable OWASP Juice Shop web application and gained hands-on experience with real-world cybersecurity concepts. 💻🛡️
Join us!
📅 When: Wednesdays at 3:30 PM
📍 Where: MMCS 130
#APSUComputerScience
Our Cybersecurity Club continued exploring the vulnerable OWASP Juice Shop web application and gained hands-on experience with real-world cybersecurity concepts. 💻🛡️
Join us!
📅 When: Wednesdays at 3:30 PM
📍 Where: MMCS 130
#APSUComputerScience
October 14, 2026 at 7:11 PM
🔐 Cybersecurity Club Meeting | October 1, 2026 🚀
Our Cybersecurity Club continued exploring the vulnerable OWASP Juice Shop web application and gained hands-on experience with real-world cybersecurity concepts. 💻🛡️
Join us!
📅 When: Wednesdays at 3:30 PM
📍 Where: MMCS 130
#APSUComputerScience
Our Cybersecurity Club continued exploring the vulnerable OWASP Juice Shop web application and gained hands-on experience with real-world cybersecurity concepts. 💻🛡️
Join us!
📅 When: Wednesdays at 3:30 PM
📍 Where: MMCS 130
#APSUComputerScience