Appsec adventures

The webinar examines how AI is increasing the sophistication of identity-based attacks through AI-powered phishing, deepfake impersonation, synthetic identities, and advanced social engineering. It argues that point-in-time identity verification may no longer be sufficient as attackers increasingly exploit trusted identities and bypass traditional controls. The discussion focuses on continuously evaluating identity risk throughout the identity lifecycle, identifying gaps in conventional identity security controls, and defining priorities for an updated identity security strategy.  https://www.govinfosecurity.com/webinars/ai-changing-identity-attacks-are-your-defenses-keeping-up-w-7384

The article reports that organizations are accelerating evaluation of quantum-resistant encryption in 2026, driven by finalized NIST post-quantum standards and the threat of "Harvest Now, Decrypt Later" attacks, in which adversaries intercept and store encrypted data for future decryption once quantum computers running Shor's algorithm mature. It explains that current public-key cryptography rests on prime factorization and will not survive quantum processing, so post-quantum cryptography (PQC)—synonymous in practice with quantum-resistant encryption—instead relies on lattice-based math, hash structures, or physical laws, with schemes like Module Learning With Errors (M-LWE). NIST's first finalized PQC standards (FIPS 203 for ML-KEM key encapsulation, FIPS 204 for ML-DSA digital signatures, and FIPS 205 for stateless hash-based signatures) arrived in August 2024, and HQC was selected as a backup KEM in March 2025. The piece covers a tiered deployment landscape: softwa...

Vulnerability blast radius is the scope of systems, data, users, and code that could be affected if a vulnerability is exploited. The article explains that measuring reachability across application code, dependencies, containers, and infrastructure provides a more contextual view of risk than CVSS alone. Key factors that increase blast radius include widely shared dependencies, deep transitive dependencies, privileged access, exposed credentials, and flat network architectures. To reduce impact, organizations can prioritize reachable vulnerabilities, apply targeted security patches, segment networks, remove unused dependencies, and enforce least privilege. The article also recommends translating technical exposure into business impact, such as affected applications, users, data, and regulatory exposure.  https://www.endorlabs.com/learn/vulnerability-blast-radius-how-to-measure-and-reduce-impact

TypeSafe AI introduces Jev, a "System One" model designed for fast, narrow security judgments rather than text generation. Unlike LLMs that return free-form text requiring parsing, Jev accepts state data plus typed questions and returns typed answers—probabilities, choices, or scores—with calibrated confidence via RLCD training. The article argues that using large language models for quick AppSec decisions (like reviewing agent skills or triaging bug reports) is slow, expensive, and prone to output-parsing failures and prompt injection. Jev runs in roughly 100 ms at $42 per billion input tokens, operates without tools or text output, and is positioned as a fast judge inside code that escalates uncertain cases to humans or reasoning LLMs. The post walks through three AppSec use cases—catching malicious agent skills, bug bounty triage, and agent tool-call guardrails—and details installation, SDK usage, context-window limits, known weaknesses (adversarial input can still shift a...

On August 26, 2026, the OWASP Open Automated Security Initiative for Software (OASIS) launched as an official OWASP community project. This global initiative combines AI-powered fix automation with human expert validation to remediate open source vulnerabilities at scale. OASIS addresses the critical bottleneck of remediation by generating candidate fixes through automated pipelines, having AppSec professionals validate them for correctness and safety, and then submitting vetted patches to open source maintainers. The project has attracted hundreds of security professionals and founding sponsors AppSecAI, Intigriti, and DryRun Security. Designed to complement other industry initiatives like OpenAI's Patch the Planet and the Linux Foundation's Akrites, OASIS offers a vendor-neutral, community-driven approach that empowers application security professionals to collectively defend against AI-driven exploits and "vibe hacking" threats. The initiative invites participants ...

OpenAI has released GPT-6 Astra, described as its most intelligent and aligned model to date, with strong capabilities in computer use, software engineering, science, and cybersecurity. The model demonstrated the ability to identify and develop zero-day exploits, scoring 100% on ExploitBench and discovering two previously unknown vulnerabilities during internal evaluations. In response to these advanced cyber capabilities and lessons from the Hugging Face incident, OpenAI paused some training to implement stricter alignment protocols and safety processes. Astra now includes human oversight features that can slow, pause, or stop its work and request user review before proceeding with certain actions. The model excels in benchmarks, including 98% on FrontierMath Tier 4 and 88% on SRE-Bench for reverse-engineering tasks. Despite its power, Astra is more likely to refuse advanced cybersecurity tasks such as creating proofs-of-concept. It is rolling out to limited organizations initially an...