menu

Recent posts tagged appsec

Level UI • 21 hours • in Articles • 9 min read
An MCP server is not a new API. It is a thin layer over the one you already have
Somewhere in the last year, "do we need an MCP server?" joined the list of questions that arrive in a brief before anyone has said what the thing is for. It is usually framed as MCP vs API, as though the Model Context Protocol were a newer kind of AP...
post-cover-33074
  • ai
  • api
  • webdev
  • security
7 Reactions 7 Comments
dianaiminza • 1 day • in Articles • 3 min read
Cybersecurity Is a Developer's Responsibility, Not Just the Security Team's
Cybersecurity is often treated as something that happens after an application has been built. Developers focus on functionality, deadlines, and user experience, while security is left to a separate team. But what if some of the most important securi...
post-cover-33049
  • cybersecurity
  • appsec
  • securecoding
  • cybersecurityawarenessmonth
2 Reactions 0 Comments
Tom Smithverified • 2 days • in Articles • 3 min read
Oracle AI Security Mesh Gives Each Agent Its Own Identity and Just-in-Time Permissions
An AI agent that hunts for vulnerabilities needs access to the systems it tests. That is the uncomfortable part of agentic security. The tool that finds the weak spot also holds keys to the house. On Tuesday at Oracle AI World in Las Vegas, Oracle a...
post-cover-32841
  • aiagents
  • zerotrust
  • appsec
  • openai
0 Reactions 2 Comments
peternasarah • 2 days • in Articles • 1 min read
I've been gone for 5 months. Here is what I built while I was away (and how you can help me test i
Hey CoderLegion! 👋 It’s been a minute since I last posted here. I went heads-down into the trenches of building, and to be honest, I neglected this community while focusing heavily on LinkedIn. But I’m back, and I brought something with me. When...
post-cover-32836
  • python
  • nigeriantech
  • ndpa
  • appsec
4 Reactions 2 Comments
Tom Smithverified • 3 days • in Articles • 4 min read
Oracle Plans Post-Quantum TLS for Java 8 and 11 in Late 2027, and Wants Testers Now
Security teams are starting to ask a question platform teams don't like: what's our plan for post-quantum encryption? For shops still running Java 8 or 11, the answer has mostly been a shrug. At Oracle AI World in Las Vegas this week, I got a firmer...
post-cover-32755
  • java
  • postquantumcryptography
  • openjdk
  • appsec
0 Reactions 0 Comments
Tom Smithverified • Oct 22 • in Articles • 4 min read
HiddenLayer: A Hijacked LLM Gateway Can Turn Your Coding Agent's Own Permissions Against You
Most security talk about AI coding agents focuses on the model. Will it run a bad command? Can a poisoned README trick it? New research from HiddenLayer looks somewhere else: the plumbing between the agent and the model. In a report released today, ...
post-cover-32043
  • aiagents
  • devsecops
  • appsec
  • codingagents
5 Reactions 7 Comments
Tom Smithverified • 17 hours • in Articles • 9 min read
Developer Weekly Briefing — October 30, 2026
Security dominated this week, but not in the usual way. Two active campaigns turned GitHub configuration files into attack surfaces. Researchers demonstrated that the built-in browsers inside AI coding tools can read your SSH keys. And at Oracle AI ...
post-cover-33104
  • agenticai
  • devsecops
  • github
  • localai
6 Reactions 3 Comments
Tom Smithverified • Oct 22 • in Articles • 6 min read
PHP2Shell: Two 9.2-Rated Flaws Reach Back to PHP 5. Here's the Plan for EOL Teams
PHP shipped emergency patches on October 21 for two critical flaws now known as PHP2Shell. Both are rated 9.2 under CVSS v4.0. Both can let an unauthenticated attacker run code on your server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. ...
post-cover-32048
  • php
  • php2shell
  • appsec
  • opensource
1 Reactions 0 Comments
mohamed.aboelkheir • Oct 6 • in Articles • 11 min read
Use AI to Get Smarter, Not Lazier
I promise this isn't another post saying AI is making us dumber. AI does make us faster, and we can't afford to give that up. But if you're not careful, "faster" quietly turns into "I shipped this and can't explain it". This post is about a way to u...
  • ai
  • security
  • appsec
  • learning
4 Reactions 2 Comments
Kudzai • Sep 30 • in Articles • 2 min read
The Plausible PR: I Gave 4 LLMs 10 Sneaky Refactors, and They All Missed the Same Bug
What I Benchmarked I keep seeing posts about using AI to review pull requests before they get merged. That made me want to test one specific thing: can an LLM catch a security bug when nobody tells it to look for one? So I built a benchmark cal...
post-cover-29226
  • ai
  • llm
  • kaggle
  • appsec
0 Reactions 1 Comments
Tom Smithverified • Sep 17 • in Articles • 4 min read
OWASP Founder Jeff Williams: Stop Studying the Robot's Brain. Start Controlling Its Body.
Jeff Williams, founder of OWASP and founder and CTO of Contrast Security, has spent the last several years watching the security industry pour its attention into one question: can you jailbreak the model, trick it, make it say something dangerous. He...
post-cover-27559
  • owasp
  • appsec
  • cybersecurity
  • agenticai
6 Reactions 0 Comments
Tom Smithverified • Sep 3 • in Articles • 3 min read
F5's AI WAF Caught 15 Zero-Days Before a Human Ever Saw Them
F5's Jimmy White, the company's CTO AI Security, put a number on the problem last week: mean time to exploit for a new vulnerability is now under seven days. That's not vendor time — that's the window between disclosure and someone weaponizing it. If...
post-cover-26103
  • waf
  • zeroday
  • appsec
  • cybersecurity
1 Reactions 0 Comments
Tom Smithverified • Sep 2 • in Articles • 4 min read
Cycode's AI Scanner Found 38 Bugs in MLflow. The Press Release Only Mentioned One.
Every AI security vendor ships a benchmark chart these days. Most of them don't survive a second phone call. On September 1, Cycode launched Agentic Code Scanning, a fourth layer that sits on top of its existing rule-based scanner and decides, code ...
post-cover-26085
  • agenticai
  • appsec
  • aisecurity
  • devsecops
2 Reactions 0 Comments
Tom Smithverified • Aug 28 • in Articles • 4 min read
Developer Weekly Briefing — August 28, 2026
A quieter week after the Black Hat stretch, but the five pieces that came out of it are worth your time. All five circle the same territory: what AI can and can't actually do in security, and who ends up owning the outcome when it falls short. Tria...
post-cover-25622
  • devops
  • appsec
  • aiagents
  • devsecops
2 Reactions 0 Comments
Tom Smithverified • Aug 27 • in Articles • 4 min read
Contrast Security: Triaging AI Scanner Output Costs 400x More Than Running the Scan
Here's a number worth sitting with: scanning a 2-million-line codebase with an AI-powered tool costs roughly $315 in tokens. Triaging what that scan finds costs $128,000. That 400x gap, buried in Contrast Security's new AppSec Overflow 2026 report, i...
post-cover-25388
  • appsec
  • devsecops
  • applicationsecurity
  • cybersecurity
5 Reactions 1 Comments
jomynn • Aug 26 • in Videos • 3 min read
Manually Breaking Authentication — A Full Walkthrough (CWE-307, CWE-330, CWE-640
> ⚠️ Educational / authorized testing only. Everything below targets a local, deliberately vulnerable training application, not a live system. Never run these techniques against anything you don't own or don't have explicit written authorization to t...
post-cover-25416
  • security
  • appsec
  • testing
  • tutorial
0 Reactions 0 Comments
jomynn • Aug 24 • in Videos • 2 min read
Manually Proving and Documenting an IDOR (CWE-639) — A Full Walkthrough
Most IDOR write-ups stop at "change the ID in the URL and you get someone else's data." That's the easy part. The part that actually matters — proving it rigorously, ruling out the boring explanation, and turning it into a report someone can act on —...
post-cover-25293
  • security
  • appsec
  • webdev
  • tutorial
2 Reactions 0 Comments
Tom Smithverified • Aug 19 • in Articles • 4 min read
Harness GM Rahul Sood: Most "AI Remediation" Claims Don't Actually Work. Here's What Does.
Application security has operated on human timelines for as long as it's existed: a scanner flags something, a ticket gets filed, developers and security argue over priority, and a fix ships weeks or months later, if it ships at all. Rahul Sood, GM o...
post-cover-24833
  • appsec
  • devsecops
  • aisecurity
  • applicationsecurity
2 Reactions 0 Comments
Tom Smithverified • Aug 17 • in Articles • 3 min read
Detectify's Rickard Carlsson: Attackers Don't Have New Tricks, They Have a Faster Clock
Ask Rickard Carlsson, co-founder and CEO of Detectify, whether AI is handing attackers new capabilities, and he'll correct the premise. It's not new vulnerabilities. It's not new techniques. It's the same attacks, running on a clock that used to be m...
post-cover-24781
  • appsec
  • cybersecurity
  • aisecurity
  • devsecops
0 Reactions 0 Comments
Tom Smithverified • Aug 4 • in Articles • 4 min read
CVE Disclosures Have Doubled Two Years Running — And Now the Backlog Is "Radioactive"
"Vulnpocalypse" isn't a term Jeff Williams coined himself — he credits his marketing department — but the Contrast Security founder and OWASP creator uses it anyway, because it captures something real. Frontier AI models, Claude Mythos among them, ca...
post-cover-24117
  • appsec
  • cybersecurity
  • aisecurity
  • vulnerabilitymanagement
0 Reactions 0 Comments
Page:
chevron_left
🔥 29 posts • 👩‍💻 10 active writers
✨ Want to write in this topic?
Share your learning. Get discovered. Build your profile.
Join CoderLegion
💡 Why developers use CoderLegion
Track learning • Share posts • Get ranked publicly
Create your profile