AI is shipping code faster than security was built to handle
AI coding tools have done something nobody planned for: they've made the security review cycle the bottleneck. Not CI. Not deployment. Security. Snyk'…
Programming
⚑ Report a ProblemLatest Programming news from Tech News
All topics
AI
agents
ai
api
architecture
automation
aws
beginners
career
claude
database
devchallenge
devops
javascript
learning
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
rust
security
showdev
tutorial
typescript
webdev
Agentjacking: How AI Coding Agents Get Hijacked Through Their Own Tool Pipeline
Your AI coding agent can read files, run shell commands, and call external APIs. That's also the exact description of an arbitrary code execution prim…
The Invisible Breach: Why Modern Web Frameworks Aren't Immune to LFI
Introduction: The Comfortable Lie There's a comfortable story developers tell themselves: "I'm using a modern framework. It handles all that low-level…
Python’s Private Variables Aren't Private: An AppSec Reality Check
Coming to Python from Java or C++? You might have a dangerous assumption about data encapsulation. Look at this typical snippet used for "secure" stat…
Notification Hijacking: How WhatsApp and Slack Content Could Weaponize Google Gemini
Your phone buzzes. A WhatsApp message lands. Gemini reads it. And now Gemini is compromised. That's the essence of what researchers found in a class o…
«РБПО для бедных»: сказ о том, как стартап безопасность прикручивал
Сказка — ложь, да в ней намек, разработчикам урок. В некотором опенспейсе, в некотором коворкинге завелся один стартап. С кофе-машиной, горящими дедла…
How Meta's AI Support Bot Got Tricked Into Hijacking Instagram Accounts
The Incident In June 2026, Krebs on Security reported that hackers were circulating step-by-step instructions on Telegram showing how to manipulate Me…
Трансформер в on-premise AppSec: как мы встроили ML-модель для классификации секретов в продукт без GPU
Рассказываем, как мы интегрировали CodeBERT-based модель классификации секретов в production-продукт с жёсткими ограничениями по железу, сократив врем…
Platform Lockdowns Will Doom Your Business
The Problem We Were Actually Solving At first glance, it seemed simple: we wanted to add PayPal as a payment option to our e-commerce platform. Our us…
The Ghost Platforms That Broke Our Payment Rails and How We Unchained Ourselves
The Problem We Were Actually Solving By Q3 2024, creators in Beirut, Tripoli, and Amman were telling us the same story: PayPal wouldnt verify accounts…
The Egregious Cost of Compliance: One Platform's Overly Broad Restrictions
The Problem We Were Actually Solving We were actually trying to solve the classic problem of onboarding new creators. We believed that by supporting P…
The Dark Side of Standardized E-commerce Solutions for Global Creators
I still remember the day we realized our digital marketplace couldn't handle transactions for creators in countries like Bangladesh, Nigeria, and Ghan…
The Shai-Hulud Worm Is Now Open Source — Here's How to Stop Self-Replicating Prompts Before They Reach Your LLM
A worm that spreads through prompts just had its source code dropped publicly. That changes the threat model for every team running agentic AI. The Sh…
Hidden Audio Attacks on Voice AI: How Transcription Pipelines Get Hijacked
Voice AI is eating the enterprise stack faster than security teams can audit it. And now researchers have demonstrated something that should give ever…
GraphQL Authorization Bypass: A Real CVE Code Review
Real-World GraphQL Authorization Bypass CVE Example Code Review A tenant isolation bug in a GraphQL API differs from a REST IDOR in one uncomfortable …
[Перевод] Иголка в стоге сена: как LLM помогают искать уязвимости
За последние несколько недель я отправил довольно много репортов об уязвимостях. Небольшая их часть уже исправлена и раскрыта через бюллетени безопасн…
The 26-Dimensional Feature Vector: How a Machine Learns to Recognise a Secret
hen my secrets detector evaluates a candidate string, it doesn't see code. It sees a vector of 26 numbers. That vector is the bridge between human int…
We scanned 50+ MCP servers and found HIGH-severity bugs in Atlassian, GitHub, Cloudflare, and Microsoft — here's what we learned
MCPSafe (mcpsafe.io) runs automated security scans of Model Context Protocol (MCP) server repositories using a five-model LLM judge panel and a purpos…
Your MCP dependency scan can pass and still miss HIGH vulnerabilities
Quick story, then the practical part. We scanned five official MCP reference servers from the @modelcontextprotocol npm namespace. Standard tooling ag…
Yes! It’s time to party! Again!! You may ask, but this time we have combined the strength of the OWASP Foundation’s open-source projects. 25 years of accumulated knowledge and wisdom distilled onto 158 playing cards.
Introducing a OWASP Game for threat modeling Agentic AI, Cloud, Devops, Frontend, LLM, Automation, and Web Johan Sydseter Johan Sydseter Johan Sydsete…
Why I Built an ML-Powered Secrets Detector Instead of Just Using Regex
ost secrets scanners work the same way. They maintain a list of regex patterns — one for AWS access keys, one for GitHub personal access tokens, one f…
What Building a SAST Tool Taught Me About AppSec That 13 Years of Software Engineering Didn't
I've been writing software professionally since 2011. Java, C#, Kotlin, Node.js. Enterprise backends, microservices, APIs, data pipelines. I've shippe…
Writing Custom SAST Rules for Vulnerabilities Your Scanner Doesn't Cover
Every SAST tool ships with a default ruleset. And every default ruleset has gaps. Sometimes the gap is a framework-specific vulnerability that the too…
Один ИИнженер – десять рук: как мы исследовали LLM в AppSec
Всем привет, на связи Solar appScreener! В этой статье расскажем о нашем опыте использования ИИ в нашем собственном продукте. ИИ-агенты уже стали неот…
SnowFROC 2026: Secure Defaults, Real Trust, and a Better Layer on Top
Denver likes a good origin story. The city still keeps a marker for Louis Ballast and the Humpty Dumpty Barrel, the local spot tied to the cheeseburge…
From a Single IP to Exfiltrated Passwords in a PNG: My First Freelance Pentest Engagement
Disclaimer: This article describes a security research activity carried out in a controlled context , with educational goals and the aim of improving …