Sam Stepanyan@securestep9
Nov 7
We all know what happens to a website when it's #SSL certificate expires, but what about your #Tesla?:
Mana Seas@Petroon362495
Nov 6
Hi @elonmusk , need ngineering help with a Tesla Model 3 in Europe (VIN: 5YJ3E1EA8JF038827). The car is completely offline due to expired SSL certificates (GTW LOCKED in Service Mode). It can't handshake with servers, so standard app transfer and Wi-Fi don't work. (1/2)
Community note
As seen on this poster's photo, the Tesla in question has a US VIN, but is located in Russia. Tesla's refusal to put the car back on their network is due to export control policies, this car was illegally exported outside of the US to Russia, a country with active sanctions.

x.com/Petroon362495/…
3
1
4
709
Sam Stepanyan@securestep9
Nov 6
White House IPs for rent?
Krebs: White House staffers’ computers or mobile devices reportedly ran proxy software, with 28 services offering exits through the White House network.
👇
krebsonsecurity.com/2026/11/want-t…
0
1
0
119
Sam Stepanyan@securestep9
Nov 5
⚠️#OpenSSH issues emergency fix for a critical SSH authentication bypass #vulnerability dubbed #sshole on Alpine Linux.

A password longer than 256 bytes can unlock key-only accounts on affected servers, without knowing the actual credentials.
👇
thehackernews.com/2026/11/openss…
0
3
4
352
Sam Stepanyan@securestep9
Nov 5
#DigiCert breached - contact details including customers' passports & driver's licenses leaked:
👇

bleepingcomputer.com/news/security/…
0
1
1
217
Sam Stepanyan@securestep9
Nov 4
#OWASP Releases #LLM Exploit Generation Guide 2.0 comparing human-guided and autonomous AI approaches against live cybersecurity targets:

Download it here:
👇
genai.owasp.org/resource/llm-e…
0
10
34
1,291
Sam Stepanyan@securestep9
Nov 4
Attending OWASP Global AppSec USA 2026 Conference in San Francisco?

Join me and Arkadii Yakovets (@arkid15r) for a session on automated security testing with OWASP #Nettacker!
👇
owaspglobalappsecusa2026.sched.com/event/2ZtMs/au…
0
1
4
229
Sam Stepanyan@securestep9
Oct 29
#Linux zero-click root - CVE-2026-98432 - Claude wrote an exploit that gives a remote attacker root access on Linux servers running a multipath TCP listener. It needs no login and no user action. Patches released:
👇
cybersecuritynews.com/claude-ai-buil…
8
22
120
23,474
Sam Stepanyan@securestep9
Oct 29
An open-weight Chinese #Qwen 3.8 AI model reportedly tried to "call home to China" and send data to a server in Beijing during a security test (was blocked by the sandbox):
#AISecurity

👇
venturebeat.com/data/coheres-t…
2
2
2
567
Sam Stepanyan@securestep9
Oct 25
A leaked #LiteLLM master key helped attackers steal #GitHub tokens and poison software releases.
The post-mortem of the attack is a fascinating read, particularly if you are using GitHub:
👇

#AppSec #SoftwareSupplyChainSecuritu

thehackernews.com/2026/10/leaked…
0
2
0
228
Sam Stepanyan@securestep9
Oct 23
Running #NodeJS? #Node2Shell (CVE-2026-111497) can turn malicious Brotli-compressed data into #RCE (Remote Code Execution).

Upgrade #Node to 22.23.4, 24.22.1 or 26.12.1 and rebuild your containers.
#AppSec
👇
aikido.dev/blog/node2shel…
0
0
0
253
Sam Stepanyan@securestep9
Oct 21
#LiteLLM compromised AGAIN! LiteLLM v1.107.0 on #PyPI carries a remote code execution backdoor and a credential stealer which steals Cloud and AI credentials. #Malware runs at Python startup, no import needed.

#SoftwareSupplyChainSecurity
👇
thehackernews.com/2026/10/litell…
0
3
1
732
Sam Stepanyan@securestep9
Oct 21
Cyber criminals steal children's data after company used 'Password1' #password to protect old account:
👇
bbc.co.uk/news/articles/…
0
1
0
297
Sam Stepanyan@securestep9
Oct 21
#Node.js issued security updates for its 22.x, 24.x, and 26.x versions, fixing high-severity issues in DNS resolution, TLS certificates, Brotli decoding, HTTP agents, and crypto caches:
👇
nodejs.org/en/blog/vulner…
0
2
2
573
Sam Stepanyan@securestep9
Oct 21
🚨 #PHP2Shell: Two critical #PHP flaws (CVE-2026-109618 & CVE-2026-109619) allow unauthenticated #RCE!

#WordPress, #Drupal, #Magento and countless web apps may be exposed. PHP powers 69% of websites.

Emergency patches are OUT. Update PHP now!
👇
laravel-news.com/php-critical-r…
0
1
0
1,260
Sam Stepanyan@securestep9
Oct 21
Global #HTTPS trust incident! #eMudhra, an Indian Certificate Authority trusted worldwide, issued 8 CA certificates with trivially weak private keys.

Impact: forged HTTPS certificates, website impersonation & risks beyond browsers.
👇
bleepingcomputer.com/news/security/…
0
1
3
286
Sam Stepanyan@securestep9
Oct 20
#GoogleCloud outage hits UK banks (HSBC, Lloyds, Revolut), UK courts and many other businesses:
#GoogleCloudDown
#GCPdown
👇
bbc.co.uk/news/live/c58j…
1
1
1
688
Sam Stepanyan@securestep9
Oct 18
If you are an OWASP member - don't forget to vote in the OWASP Global Board elections!
All eligible members should have received an e-ballot (check the email you used to pay for your OWASP membership):
🗳️☑️
OWASP® Foundation
@owasp
Oct 17
🗳️ OWASP Board Election voting is open!

OWASP members, it’s time to make your voice heard! With three Board seats up for election, your vote helps shape the future of our community.

📩 Keep an eye on your inbox for your unique ballot (check both personal and OWASP emails!).

⏰ 0 at midnight UTC.

Learn more: owasp.org/board/election…

#community #opensource #boardelections #appsec
0
0
0
221
Sam Stepanyan@securestep9
Oct 17
#OpenCode #databreach
👇
Matt Johansen
@mattjay
Oct 17
🚨 Confirmed. OpenCode hacked. Keys stolen.

Telling customers to revoke.
0
1
1
498
Sam Stepanyan@securestep9
Oct 17
#NPM - A malicious npm package 'imgdecode' hides a Windows DLL that downloads encrypted shellcode from GitHub and injects it into "dllhost.exe".

One "require()" could compromise a developer’s machine:

#SoftwareSupplyChainSecurity
👇
thehackernews.com/2026/10/malfex…
0
0
5
352
Sam Stepanyan@securestep9
Oct 13
Hijack an #npm package without stealing credentials? #GitHub Tightens npm Publishing After a "SlugFest" Flaw Left 1,500+ Packages Vulnerable to Hijacking:

#SoftwareSupplyChainSecurity
👇
thehackernews.com/2026/10/github…
0
1
3
278
Load more