hAPI_hacker retweeted
🏆 Some exciting news to share!
OWASP OASIS is a finalist in the 2026 SANS Difference Makers Awards in the Innovation of the Year (Open Source Product or Tool) category!
Now we need your help to bring home the win! 🗳️
The community vote helps decide the winner, and voting f you have a minute, please show your support and cast your vote here:
👉 go.sans.org/MBGfxJ
Important: Make sure you click through to the very end of the form for your vote to count!
A huge congratulations to Michael, Chris, and everyone in the OWASP OASIS community who have helped make this possible, from validating fixes and leading sessions to getting their teams involved. This recognition belongs to you all! 👏
#OWASP #SANSDifferenceMakers #OpenSource
OWASP OASIS is a finalist in the 2026 SANS Difference Makers Awards in the Innovation of the Year (Open Source Product or Tool) category!
Now we need your help to bring home the win! 🗳️
The community vote helps decide the winner, and voting f you have a minute, please show your support and cast your vote here:
👉 go.sans.org/MBGfxJ
Important: Make sure you click through to the very end of the form for your vote to count!
A huge congratulations to Michael, Chris, and everyone in the OWASP OASIS community who have helped make this possible, from validating fixes and leading sessions to getting their teams involved. This recognition belongs to you all! 👏
#OWASP #SANSDifferenceMakers #OpenSource
0
6
36
3,518
hAPI_hacker retweeted
📚 Bookworms, assemble! 🤓🐝
The OWASP bookstore at Global AppSec USA is bursting with brilliant reads! From hacking and AppSec to secure coding, AI, and everything in between, there's something for every curious mind.
Fancy adding to your bookshelf or picking up some new browse in the Expo Hall. Your next favorite read might be waiting! 📖🔥
#OWASPSanFran26 #GlobalAppSec26 #OWASP #AppSec
The OWASP bookstore at Global AppSec USA is bursting with brilliant reads! From hacking and AppSec to secure coding, AI, and everything in between, there's something for every curious mind.
Fancy adding to your bookshelf or picking up some new browse in the Expo Hall. Your next favorite read might be waiting! 📖🔥
#OWASPSanFran26 #GlobalAppSec26 #OWASP #AppSec
2
14
108
6,999
hAPI_hacker retweeted
@Sannhq is now open source and officially in beta!
Sannr is an API platform built for coding agents. As your agents use the Sannr API client, it captures the API context and stores it in your repo, right next to the code, so all future coding agents have access to the context.
the @twilio API a couple weeks ago, and coming back to it last night, only to see that my coding agent didn't have to relearn that one of the endpoints needed form encoding. This knowledge ins't something that is part of the OpenAPI spec, or in the docs. It comes from coding agents using the endpoint, learning it, and then writing it down in the sannr.json as a note.
Sannr is designed to be used by coding agents, but I understand that human operators want to see into the black box of coding agent decisions, so I built the Sannr Workbench and Map.
* The Workbench is a place to view all the provenance (the who, what, where, when, and why) around an API. You can filter, add notes of your own, view traces, and re-verify the context.
* The Map gives you a view of the connections between APIs and what files they're connected to.
Links to the repo, our youtube channel, and more are in the first comment.
Sannr is an API platform built for coding agents. As your agents use the Sannr API client, it captures the API context and stores it in your repo, right next to the code, so all future coding agents have access to the context.
the @twilio API a couple weeks ago, and coming back to it last night, only to see that my coding agent didn't have to relearn that one of the endpoints needed form encoding. This knowledge ins't something that is part of the OpenAPI spec, or in the docs. It comes from coding agents using the endpoint, learning it, and then writing it down in the sannr.json as a note.
Sannr is designed to be used by coding agents, but I understand that human operators want to see into the black box of coding agent decisions, so I built the Sannr Workbench and Map.
* The Workbench is a place to view all the provenance (the who, what, where, when, and why) around an API. You can filter, add notes of your own, view traces, and re-verify the context.
* The Map gives you a view of the connections between APIs and what files they're connected to.
Links to the repo, our youtube channel, and more are in the first comment.
4
2
3
257
hAPI_hacker retweeted
I've been nominated for the SANS Difference Makers Awards, in the Red Teamer category! I'd love your vote: feedback.sans.org/733559
If I win*, I'll share something that genuinely surprised me involving a website, a vulnerability, and GLM 5.3 #SANSDMA #DifferenceMakers
*I'll also share it if I lose
If I win*, I'll share something that genuinely surprised me involving a website, a vulnerability, and GLM 5.3 #SANSDMA #DifferenceMakers
*I'll also share it if I lose
20
35
328
22,208
hAPI_hacker retweeted
Even though I’m currently unemployed & still looking for work I’m trying to stay busy! I’m happy to say my latest project is completed!
JaysonEStreet.com
has been turned into Street_OS! 😊
I think the transformation from my old one to this is amazing!!! 🤩
JaysonEStreet.com
has been turned into Street_OS! 😊
I think the transformation from my old one to this is amazing!!! 🤩
1
12
43
2,350
hAPI_hacker retweeted
In a single year, AI has rewritten the security priority list for CISOs.
Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses.
There's also mployees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems.
In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI.
The biggest jumps since 2026:
- Internal AI agent security (+28 pts)
- AI SOC (+26 pts)
- AI offensive security (+24 pts)
- AI code security (+23 pts)
- AI vulnerability remediation (+22 pts)
Last year's staples:
- Exposure & vulnerability management (-21 pts)
- SIEM / security data (-18 pts)
- Privileged access management (-18 pts)
From a16z's @OwenColby and @steph_zhang on The New Security Agenda: a16z.news/p/the-new-secu…
Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses.
There's also mployees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems.
In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI.
The biggest jumps since 2026:
- Internal AI agent security (+28 pts)
- AI SOC (+26 pts)
- AI offensive security (+24 pts)
- AI code security (+23 pts)
- AI vulnerability remediation (+22 pts)
Last year's staples:
- Exposure & vulnerability management (-21 pts)
- SIEM / security data (-18 pts)
- Privileged access management (-18 pts)
From a16z's @OwenColby and @steph_zhang on The New Security Agenda: a16z.news/p/the-new-secu…
77
123
804
146,794
hAPI_hacker retweeted
UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: nsa.gov/Press-Room/Pre…
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
87
933
3,872
330,866
Patch away everyone! PHP patches are out now: lnkd.in/gtHWuu5G
PHP2Shell Resources:
Cloudflare is helping: lnkd.in/geU8VZig
NSA Cyber is saying if you cannot patch it, take it offline until you can patch: lnkd.in/gZGkQCcC
Wiz PHP2Shell RCE Research: lnkd.in/gzv3tSN7
Don't take it from me even the Prime Minister of Japan, Sanae Takaichi, says to patch!
PHP2Shell Resources:
Cloudflare is helping: lnkd.in/geU8VZig
NSA Cyber is saying if you cannot patch it, take it offline until you can patch: lnkd.in/gZGkQCcC
Wiz PHP2Shell RCE Research: lnkd.in/gzv3tSN7
Don't take it from me even the Prime Minister of Japan, Sanae Takaichi, says to patch!
0
1
3
754
hAPI_hacker retweeted
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
4,937
88,921
395,620
101,976,507
hAPI_hacker retweeted
🚨 PHP2Shell detection is now available in Burp Suite Professional & Burp Suite DAST.
Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using:
🟧 ActiveScan++ v2.0.13 (portswigger.net/bappstore/3123…)
🟧 Bambda scan checks (github.com/PortSwigger/ba…)
🟧 BChecks (github.com/PortSwigger/bc…)
Start scanning for the vulnerability now → portswigger.net/bappstore/3123…
Most of the web is powered by PHP, which means most of the web is vulnerable to these critical unauthenticated remote code execution flaws (CVE-2026-109618 / 109619). You can already detect it in Burp Suite using:
🟧 ActiveScan++ v2.0.13 (portswigger.net/bappstore/3123…)
🟧 Bambda scan checks (github.com/PortSwigger/ba…)
🟧 BChecks (github.com/PortSwigger/bc…)
Start scanning for the vulnerability now → portswigger.net/bappstore/3123…
11
261
1,237
77,323
hAPI_hacker retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
1,289
10,806
70,098
12,669,611
hAPI_hacker retweeted
Your next security skill starts with a good book.
Save 30% on hacking and security books with code STAYSHARP through October 9.
Print books include the free ebook. Sale excludes preorders.
nostarch.com/catalog/securi…
Save 30% on hacking and security books with code STAYSHARP through October 9.
Print books include the free ebook. Sale excludes preorders.
nostarch.com/catalog/securi…
2
28
171
6,765
hAPI_hacker retweeted
Huge shoutout to @hAPI_hacker for gifting me an ASCP voucher back in April 🙏
I just passed my ASCP exam! 🎉
Your generosity goes a long way Thank you!
I just passed my ASCP exam! 🎉
Your generosity goes a long way Thank you!
25
8
100
4,788
hAPI_hacker retweeted
It takes a while to build the confidence, but there's no future where you're manually reviewing every line of agent code. Not much acceleration in that. You need adversarial agent reviews, you need automated testing, and maybe you spot check. That's it. From prompt to production!
438
364
6,855
728,957
hAPI_hacker retweeted
Absolutely incredible research by @garethheyes
One email, two readers.
:before and :after inject text into the page. An AI browser reading the message does not see that text.
opacity:0.00000001 does the reverse. The victim cannot read the element, but the AI browser can.
Read CSS:the bomb inside your inbox by Gareth to learn more 👇
portswigger.net/research/css-t…
One email, two readers.
:before and :after inject text into the page. An AI browser reading the message does not see that text.
opacity:0.00000001 does the reverse. The victim cannot read the element, but the AI browser can.
Read CSS:the bomb inside your inbox by Gareth to learn more 👇
portswigger.net/research/css-t…
1
14
57
5,732
hAPI_hacker retweeted
In less than 24 months there will be a clip of a high profile CRO explaining this reality to a (much smaller) room of sales reps.
There's nothing kind about letting good people live in a fantasy world that no longer exists. You have to tell them, even if it hurts. Because the sooner they accept reality, the sooner they can adapt to the future.
45
225
2,952
548,709