Reads everything. Writes nothing. 🔒

FDE Agent is read-only by design — integration intelligence without the risk.
thefdeagent.com
#AIAgent #ForwardDeployedEngineer #AppSec

🔴 Critical RCE flaw found in popular open-source data processing library with urgent patch.

💭 Unaudited open-source pipeline dependencies represent the true blind risk in production.

nvd.nist.gov

#AppSec #InfoSec

⚠️ CISA adds critical network gateway flaws to its KEV catalog due to active RCE exploitation.

💭 Unpatched edge gateways remain the primary entry point for automated ransomware attacks.

cisa.gov/known-exploite…

#CISAKEV #AppSec

@wheelrobot If a pen-test agent can break prod, the pen test worked. Its first critical finding is whoever handed it the creds. #AppSec

Node2Shell just evolved to HTTP2Shell—vulnerability now spans Python, Ruby, Node.js HTTP libs. Attack vector: malicious Brotli compression triggers RCE. If your stack decompresses untrusted HTTP responses, you're exposed. Patch or isolate. #AppSec #SupplyChain

⚠️ CISA añade fallos críticos en pasarelas perimetrales al catálogo KEV por ejecución remota activa.

💭 El perímetro expuesto sin parchar sigue siendo el vector #1 de entrada para el ransomware.

cisa.gov/known-exploite…

#CISAKEV #AppSec

A Brotli decoder flaw behind a Node.js RCE also affects Bun, Python and other widely used software. Fixes are rolling out across Node.js, Envoy and more. Patch now. #AppSec #Brotli #NodeJS

cyberworldops.eu/en/brotli-deco…

🎥 twp.ai/E5Guxq

**Secure coding is essential. But securing the entire software supply chain is essential too.**

#SoftwareSupplyChainSecurity #AppSec #SecureCoding #PHP
8/8

Your repos. Your selection. Read-only. 🔒
thefdeagent.com
#AIAgent #ForwardDeployedEngineer #AppSec

The PHP Foundation released emergency patches (8.5.12, 8.4.27, 8.3.36, 8.2.35). CISA urges system admins to apply these updates immediately or pull vulnerable internet-facing servers offline. #PatchNow #AppSec #SecOps

Developers: What's your preferred security workflow for AI-assisted coding?

Static analysis? Dependency scanning? Human code review? AI security review? All of the above?

I'm interested in workflows that catch real issues without slowing every change to a crawl.

#AppSec #DevSecOps #SoftwareEngineering

Have you checked your .NET services yet? Curious whether anyone found Brotli decoding in a less obvious place. 👇

#dotnet #csharp #appsec #cve #cybersec

The difference between a login form that leaks valid usernames and one that doesn't.

Left: Enumeration bug (CWE-204) + SQL string concatenation.
Right: Parameterized PDO queries + constant-time password verification.

Stop trusting client input. Validate on the server.

#AppSec #WebDev #CyberSecurity #SecureCoding

📋 Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

What happened: Vulnerability / Zero-Day...

ift.tt/T4rxM9s

#ZeroDay #AppSec #CloudSecurity #InfoSec

Tencent's Corvus AI found Vghost (CVE-2026-74580): a vhost bug giving local users root across kernels 4.11-7.2. Tencent: "machine-assisted research, not an attack run by AI."

Agents reaching for /dev/vhost-net should pause first.

agentguards.co
#AIAgents #AppSec

I've been saying this for ages: remove, reduce, or restrict things before buying 100 new security tools.

I built a manifesto around it. Now I've collected real-world case studies showing two patterns:

Less is good.
More is bad.

reducetheattacksurface.com/case-studies/

#infosec #appsec #webappsec #defend

**2/9 The uncomfortable truth 👇** Can we ever fully secure software? Every package, dependency, library and module is a potential attack surface. Nobody audits everything across the entire software supply chain. Attackers only need to find one weak link. #InfoSec #AppSec 2/11

OWASP Top 10:2025: Misconfiguration up to #2, SSRF folded into Broken Access Control, two new entries (supply chain, exceptional conditions). Which change surprised you?

Book a Web App VAPT against the OWASP Top 10:2025

#OWASP #AppSec #WebSecurity

SAST reviews the branch. The store ships the package, SDKs and build config included. Unpack the release and compare the library list to what your review covered. Our evaluation worksheet records the gap. offensive360.com/guides/applica… #MAST #AppSec

Ruby 4.0.9, 3.4.12 and 3.3.13 fix Onigmo regex bugs behind GitLab's four critical CVEs. You're exposed if your app builds regex patterns from user input. A regex timeout won't help. Upgrade, or escape user input first. ruby-lang.org/en/news/2026/1… #Ruby #RubyOnRails #AppSec