#WebAppSec
LightNews LightNews
cybercod.bsky.social
Hey app dev pros! Did you know the OWASP Top 10 isn't just a checklist, it's a living, breathing risk landscape? Go beyond automated scans. True web vulnerability testing requires understanding each threat deeply. Manual analysis uncovers the subtle flaws.

#OWASP #WebAppSec #Cyb
September 21, 2026 at 2:23 PM
beansb.bsky.social
Present now in a browser you may already be using, Device Bound Session Credentials provide a new way to securely authenticate with a cryptographic key while reducing the chances of account hijacking due to cookie theft. Wins all around (assuming it get used).
#browsers #web #cookies #dbsc
webappsec-dbsc/README.md at main · w3c/webappsec-dbsc
Device Bound Session Credentials: A Protocol for Protecting From Cookie Theft - w3c/webappsec-dbsc
github.com
April 23, 2025 at 9:24 PM
peergos.org
All we want for Christmas is webrtc CSP.

w3c.github.io/webappsec-cs...
Content Security Policy Level 3
w3c.github.io
December 12, 2025 at 12:16 PM
araya.dev
Web Application Security WGの次のTPACでのトピック
https://github.com/w3c/webappsec/issues/627

unload のdeprecationの文脈でPermissionPolicyまわりの話も入ってるな
June 26, 2023 at 3:34 AM
halans.com
Secure Contexts https://w3c.github.io/webappsec-secure-contexts/
Secure Contexts
w3c.github.io
November 8, 2024 at 1:57 AM
toxsec.bsky.social
some days it’s dry. some days it’s gold. you only get the gold if you show up. #webappsec
December 20, 2025 at 4:34 AM
andrewlock.bsky.social
Ah, intriguing! It looks like if you have a redirect from a form submission, you need to have the final location in the CSP too 🤔

github.com/w3c/webappse...

Or put another way, form-action is basically broken in a bunch of scenarios, including PRG pattern🙄
CSP: form-action and redirects · Issue #8 · w3c/webappsec-csp
From @ptoomey3 on September 23, 2015 0:12 I just wanted to open an issue to get your thoughts on form-action with respect to redirects. We have been working on deploying form-action and have run in...
github.com
October 6, 2025 at 11:49 AM
bizbln.bsky.social
Protect your code! Supply chain attacks on open source are rising. Secure your software now! #OpenSource #Security #SupplyChain #Cybersecurity #DevSecOps #InfoSec #WebAppSec #CodeSecurity
Video
Is the software powering your life secretly vulnerable? Learn about the surge in supply chain attacks targeting open-source code by state-backed groups. Stay informed to protect our digital future! #OpenSource #Cybersecurity #SupplyChainAttack 2025-08-03T003013.871+0200 Tools used for generation Text Gemini Narator Azure TTS Clips Pexel Rendering Remotion
www.youtube.com
August 2, 2025 at 10:41 PM
skywatch.bsky.social
New PR: feat: password reset discovery and sign-in/up autofill (#3888)
feat: password reset discovery and sign-in/up autofill by Johannes-Andersen · Pull Request #3888 · bluesky-social/atproto
Adds .well-known path to auto discover password reset URLs. Used by password managers to link directly to page. Spec: https://w3c.github.io/webappsec-change-password-url/ (also god blog: https://we...
github.com
May 23, 2025 at 5:42 PM
offseq.bsky.social
CRITICAL: LabRedesCefetRJ WeGIA (<3.6.5) auth bypass lets attackers access admin & sensitive data. Upgrade to 3.6.5+ now to stay secure! 🔒 https://radar.offseq.com/threat/cve-2026-28411-cwe-288-authentication-bypass-using-7167a2c8 #OffSeq #WebAppSec #Vulnerability
CVE-2026-28411: CWE-288: Authentication Bypass Using an Alternate Path or Channe
CVE-2026-28411 is a critical security vulnerability identified in the WeGIA web management software developed by LabRedesCefetRJ. The vulnerability stems from the unsafe use of PHP's extract() function on the $_REQUEST superglobal array in
radar.offseq.com
February 28, 2026 at 12:00 AM
tongzhuodeni.bsky.social
偷了也白偷，这招倒是挺损的

谷歌浏览器正式推出 DBSC 机制，将认证会话绑定到设备硬件（如 TPM），Cookie 被窃取后因无法证明私钥而失效。

消息来源：蓝点网
https://w3c.github.io/webappsec-dbsc/
May 31, 2026 at 10:41 AM
wallarm.bsky.social
“API security is about to have its moment.”

In our latest CISO Spotlight, Rick Bohm dives into:
- Humanizing security through storytelling
- Why APIs are the weakest link
- What tomorrow’s CISOs need to succeed

📖 Read: lab.wallarm.com/ciso-spotlig...

#APIsecurity #CyberSecurity #WebAppSec
June 12, 2025 at 8:13 AM
pentest-tools.com
Now it’s even easier to:
✅ Uncover unlinked or forgotten resources
✅ Spot exposed config files, DB dumps, and admin panels
✅ Cut through static and surface real exposure - fast

📎 Try the new experience 👉 pentest-tools.com/website-vuln...

#offensivesecurity #webappsec #vulnerabilityassessment
URL Fuzzer - ML-powered scanner for web recon & fuzz testing
Uncover hidden files and directories with our ML-powered URL Fuzzer. Cut false positives by 50% and get cleaner results from every fuzz scan.
pentest-tools.com
July 29, 2025 at 1:48 PM
louisgrasset.fr
Modulo this PR github.com/w3c/webappse... from @timcappalli.me actually 👀
Adds support for redirects by timcappalli · Pull Request #17 · w3c/webappsec-passkey-endpoints
Closes #2 Adds option to return a redirect, with the Location required to be same-site to the original request.
github.com
April 8, 2026 at 10:45 AM
0xberserkr.bsky.social
Vulnversity - I have just completed this room! Check it out: tryhackme.com/room/vulnver... #tryhackme #recon #privesc #webappsec #video #vulnversity via
@realtryhackme
TryHackMe | Vulnversity
Learn about active recon, web app attacks and privilege escalation.
tryhackme.com
September 25, 2023 at 6:02 PM
moriken.dev
DOM Clobbering use counters start in Chromium 👀
github.com/w3c/webappse...
Disable DOM clobbering. · Issue #349 · w3c/webappsec-permissions-policy
https://research.securitum.com/xss-in-amp4email-dom-clobbering/ is a good example of the kinds of attacks enabled by the somewhat unexpected mapping of elements into the global namespace via the na...
github.com
February 29, 2024 at 3:12 AM
danny2462.bsky.social
1.5 years of work hinging on ONE LINE that instructs whatever the fuck this pile of specs does to do the correct thing instead of reporting a vague error about mixed HTTP/HTTPS content where it SHOULDN'T BE MIXED AT ALL IN THE FIRST PLACE ughhh w3c.github.io/webappsec-up...
serverfault.com/a/1070930
February 2, 2024 at 11:00 AM
spadok.bsky.social
Чи безпечно користуватися Telegram та чи повʼязаний він з ФСБ і ГРУ РФ?

#telegram #cybersecurity #infosecurity #ukraine #boycottrussia #ukrainerussiawar #infosec #infosecurity #nationalsecurity #security #messengers #securemessengers #apss #webappsec

spadok.org.ua/tekhnologiyi...
February 20, 2024 at 12:36 PM
michaelxg.bsky.social
I just completed the Web Security Academy lab:

Authentication bypass via OAuth implicit flow

#AuthenticationBypass #WebAppSec #Cybersecurity

portswigger.net/web-security...
Lab: Authentication bypass via OAuth implicit flow | Web Security Academy
This lab uses an OAuth service to allow users to log in with their social media account. Flawed validation by the client application makes it possible for ...
portswigger.net
August 31, 2025 at 1:06 PM
azu.bsky.social
見てる: "webappsec/meetings/2025/2025-11-TPAC-minutes.md at main · w3c/webappsec" https://github.com/w3c/webappsec/blob/main/meetings/2025/2025-11-TPAC-minutes.md
November 11, 2025 at 10:01 AM
azu.bsky.social
見てる: "Clear a specific cookie · Issue #82 · w3c/webappsec-clear-site-data" https://github.com/w3c/webappsec-clear-site-data/issues/82
February 28, 2025 at 2:48 PM
azu.bsky.social
見てる: "webappsec/meetings/2023/2023-09-15-TPAC-minutes.md at main · w3c/webappsec" https://github.com/w3c/webappsec/blob/main/meetings/2023/2023-09-15-TPAC-minutes.md
November 13, 2023 at 10:57 PM
azu.bsky.social
見てる: "Remove same-origin blanket enforcement by shhnjk · Pull Request #28 · w3c/webappsec-cspee" https://github.com/w3c/webappsec-cspee/pull/28
September 6, 2023 at 4:00 AM
azu.bsky.social

*
"Wildcards in Permissions Policy Origins by arichiv · Pull Request #516 · w3c/webappsec-permissions-policy" https://github.com/w3c/webappsec-permissions-policy/pull/516
July 20, 2023 at 7:42 AM