appsec

S Stefan Mitocaru · Jun 29, 2026 · 11 min

OWASP Global AppSec EU 2026: thoughts and conclusions from the floor

A practitioner's recap of OWASP Global AppSec EU 2026 at the Austria Center in Vienna, OWASP's 25th anniversary edition: how AI security, su...

P Paraschivoiu Alexandru · Jun 26, 2026 · 19 min

When the attacker has an AI too: AppSec scanning in an era where exploits arrive before patches

Inside the AI-offense era: autonomous systems like XBOW, Big Sleep, and Claude Mythos find and weaponize flaws in hours, while 28.3% of CVEs...

P Paraschivoiu Alexandru · Jun 24, 2026 · 21 min

Classic SAST vs AI-powered SAST: why pattern matching stops at the function boundary and reasoning takes over

Inside the SAST shift: why rule-based static analysis drowns teams in false positives and misses logic bugs, how AI-powered SAST reasons abo...

P Paraschivoiu Alexandru · Jun 17, 2026 · 19 min

npm v12: how switching off one install-time default cuts the legs out from under almost every recent npm worm

Inside npm v12: GitHub is disabling preinstall/install/postinstall scripts, Git, and remote-URL dependencies by default, killing the install...

P Paraschivoiu Alexandru · Jun 12, 2026 · 18 min

Miasma: how a 157-byte binding.gyp file turned npm install into a self-spreading credential worm

Inside Miasma (Shai-Hulud's npm successor): a 157-byte binding.gyp file executes code during npm install with no lifecycle script, compromis...

P Paraschivoiu Alexandru · Jun 10, 2026 · 18 min

When the attacker is an agent: securing infrastructure with AI powered red teaming

Inside the shift to autonomous offense: AI agents now run the full infrastructure kill chain at machine speed, from recon to domain takeover...

P Paraschivoiu Alexandru · Jun 3, 2026 · 18 min

CVE-2026-45659: how an ordinary site member turns on-prem SharePoint into a remote code execution box

Inside CVE-2026-45659: an insecure-deserialization (CWE-502) flaw lets any authenticated SharePoint Server Site Member run code on-prem (CVS...

P Paraschivoiu Alexandru · Jun 2, 2026 · 17 min

CVE-2026-48095: how a 1-byte heap buffer turned 7-Zip's NTFS parser into an extension-agnostic code execution primitive

Inside CVE-2026-48095: an undefined-behavior shift in 7-Zip's NTFS handler allocates a 1-byte buffer, then writes 256 MB into it, corrupting...

P Paraschivoiu Alexandru · May 28, 2026 · 6 min

Continuous Web DAST: what it does, where it fits, and what an annual pentest cannot

AI agents run continuous black-box and grey-box DAST against your live web apps, returning real bugs with a request, a response, and a repro...

S Stefan Mitocaru · May 22, 2026 · 19 min

CVE-2026-43640: how one `&&` short-circuit turned a stolen Bitwarden session into a persistent SCIM key

Inside CVE-2026-43640: the C# short-circuit boolean that lets any authenticated Bitwarden admin with a stolen session pull or rotate the org...

S Stefan Mitocaru · May 20, 2026 · 16 min

CVE-2026-6973: Ivanti EPMM RCE Actively Exploited in the Wild and Already in CISA KEV

Ivanti Ivanti Endpoint Manager Mobile (versions up to 12.8.0.0) contains an improper input validation vulnerability that allows remote code...

P Paraschivoiu Alexandru · May 18, 2026 · 22 min

CVE-2026-42945: how an 18-year-old flaw in NGINX's rewrite module turned the world's most popular web server into a one-shot RCE target

Inside CVE-2026-42945 (NGINX Rift): the 18-year-old heap buffer overflow in NGINX's ngx_http_rewrite_module that enables unauthenticated RCE...