Жизненный цикл API-токенов: От генерации до компрометации
JWT не защищает от кражи. Подпись гарантирует, что токен не подделан, но не мешает злоумышленнику использовать его, если тот оказался в чужих руках. В…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
- игры
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
claude
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
tutorial
typescript
webdev
Сколько Shadow API спрятано в ваших продуктах и как вывести их из тени
Теневые API редко появляются из злого умысла. Чаще это побочный эффект быстрой разработки: временный маршрут для пилота, отдельная точка доступа для м…
DevSecOps на практике: райтапы заданий с митапа CyberCamp глазами тех, кто их придумал
В марте состоялся второй эпизод DevSecOps-митапа CyberCamp, в программу которого вошли киберучения на платформе Jet CyberCamp. Три задания, максимальн…
I shipped an unauthenticated RCE in my own port scanner — here's the whole chain, and how I killed it
I built a web front end for an Nmap-based port scanner: a FastAPI backend, a React dashboard, background scan jobs, a plugin system, the works. It ran…
Роадмап по информационной безопасности
Цивилизация... Какие у вас ассоциации с этим словом? А если написать его по-другому, например, на английском. Вот так - Civilization... Ядерный Ганди?…
"183 Local Tools, Zero Guardrails: What Local MCP Gets Wrong About 'Privacy'"
Hook An indie dev just built the exact thing every enterprise security team has nightmares about — an LLM with read/write access to your iMessage, Tea…
Your Phishing Simulation Score Is 99%. Here's Why That Worries Me.
The 2025 Verizon DBIR has a number that should change how you think about security training budgets. The median phishing click rate after years of rep…
Agentic AI Security: Risks, OWASP Agentic Top 10, and Defensive Patterns (2026)
Agentic AI applications — LLM-powered systems that take autonomous action against external tools, services, and APIs based on model reasoning rather t…
Your Coding Agent Is a New Attack Surface and Most Devs Aren't Ready for It
When Your AI Assistant Gets Hijacked Mid-Flight If you've handed your coding agent an automated task and walked away, this story should make you a lit…
Phantom Squatting: When AI Hallucinated Domains Become Attacker Infrastructure
The Attack Is Simpler Than You Think Researchers at Palo Alto Networks Unit 42 documented a technique they're calling phantom squatting : attackers re…
Agentjacking: How Fake Bug Reports Are Hijacking AI Coding Agents — and How to Stop It
AI coding agents can't tell the difference between a legitimate bug report and one with hidden instructions buried inside it. That gap is now being ex…
282 AI Apps Are Handing Strangers Your API Bill — And Calling It a Product
The App Store Has an API Key Problem and "Move Fast" Culture Is to Blame Sixty-three percent of iOS AI chatbot apps studied are leaking secrets in net…
Your AI Agent Is Being Fed Lies, and Your Logs Won't Tell You
Tool Descriptions Are Now a Threat Vector. Act Accordingly. Microsoft's own incident response team just demonstrated that you can manipulate an AI age…
Your AI Agents Are Privileged Identities. You're Treating Them Like Interns.
Your AI Agents Are Privileged Identities. You're Treating Them Like Interns. Enterprises are handing autonomous AI systems the keys to critical workfl…
Рантайм-безопасность на Go и eBPF: что это за класс инструментов и зачем он нужен
Антивирус и сканер проверяют систему в какой-то момент и уходят. А между двумя проверками остаётся окно, и в нём обычно и случается компрометация. Ран…
ASOC from scrap. Как реализовать автоматизацию DevSecOps контролей за несколько вечеров, используя OpenSource и LLM
Привет, Хабр! Сегодня я хочу поделиться своим опытом разработки ASOC платформы. В статье я расскажу о преимуществах такого решения, затем оп…
AI Coding Agents Are the New Attack Surface Nobody's Ready For
The Trust Problem Hiding in Your Automated Pipeline The moment you give an AI agent the ability to act — clone, configure, execute — you've created a …
Mobile App Authentication: Best Practices for iOS and Android Developers (2026)
The mobile app authentication best practices question is the single hardest one to answer well in mobile application security, because the answers tha…
How Malicious MCP Configs in Amazon Q Developer Could Execute Arbitrary Code — and How to Stop It
A flaw in Amazon Q Developer let malicious repositories inject rogue Model Context Protocol (MCP) configurations into the agentic coding assistant's p…
Я нанял себе AI-пентестера: как LLM помогают мне искать уязвимости быстрее
Привет, друзья! Сегодня хочу поговорить об одной из самых обсуждаемых тем последних лет — использовании AI в пентесте. За последние два года вокруг LL…
The Tool Found Corridor Nodes — But the Bigger Finding Was Where It Found None
A few weeks ago I published corridor-lab — a Docker lab that proved a triage mismatch: a service that stores nothing sensitive can become high-priorit…
Who Actually Owns This Service Account?
When that AWS service account gets compromised, who do you call? A question that shouldn't be hard. If you're in security or platform engineering, you…
North Korean Hackers Poisoned 140+ npm Packages in an AI Dev Tooling Attack. Here's What Would Have Caught It.
The Incident Microsoft's threat intelligence team has attributed a supply chain attack targeting the Mastra AI ecosystem to Sapphire Sleet (also track…
DBD Cornucopia is now available to play online!
In development, we are used to understanding threat modelling as a structured method to make applications and other software secure. And in this, “sec…
AI is shipping code faster than security was built to handle
AI coding tools have done something nobody planned for: they've made the security review cycle the bottleneck. Not CI. Not deployment. Security. Snyk'…
Безопасность Bitrix без иллюзий — 10 проблем для которых не нужен новый CVE
Когда говорят о безопасности, обсуждение быстро сводится к CVE/BDU Какая версия уязвима? Существует ли публичный эксплойт? И успел ли вендор выпустить…
Agentjacking: How AI Coding Agents Get Hijacked Through Their Own Tool Pipeline
Your AI coding agent can read files, run shell commands, and call external APIs. That's also the exact description of an arbitrary code execution prim…
The Invisible Breach: Why Modern Web Frameworks Aren't Immune to LFI
Introduction: The Comfortable Lie There's a comfortable story developers tell themselves: "I'm using a modern framework. It handles all that low-level…
Python’s Private Variables Aren't Private: An AppSec Reality Check
Coming to Python from Java or C++? You might have a dangerous assumption about data encapsulation. Look at this typical snippet used for "secure" stat…
Notification Hijacking: How WhatsApp and Slack Content Could Weaponize Google Gemini
Your phone buzzes. A WhatsApp message lands. Gemini reads it. And now Gemini is compromised. That's the essence of what researchers found in a class o…