Appsec adventures

The guide presents threat modeling as a way to identify security risks during the design phase, when architecture changes can be simpler than fixing a flaw after the code has been developed and deployed. By structuring the analysis of assets, threats, and controls, including approaches such as STRIDE, teams can anticipate problems like missing authorization checks and build security requirements into development earlier. Source: https://techgenyz.com/threat-modeling-stride-guide/

A community post on the DevSecOps subreddit presents a report that monitors the latest releases of 78 open source security tools. The checks mentioned include vulnerable dependencies, binary reachability analysis, presence in known-exploited-vulnerability catalogs, release verification, and OpenSSF Scorecard signals. The initiative illustrates how to automate the monitoring of supply chain risk in tooling. Source: https://www.reddit.com/r/devsecops/comments/1xlxx5g/weekly_supplychain_report_for_78_oss_security/

A community discussion follows the proposal of a seven-day waiting period before new packages or versions are made available in the npm, PyPI, and pub ecosystems. The idea is to create time to detect signs of compromise or suspicious behavior before newly published dependencies spread to downstream projects. The post reports on the measure after its first days and debates its possible effects on security and the development workflow. Source: https://www.reddit.com/r/devsecops/comments/1xlfz6l/a_7day_package_cooldown_for_npm_pypi_and_pub_12/

The article uses the Binance incident as a warning about the potential impact of a compromised DevOps workstation. The company's initial investigation suggested that a compromised laptop may have allowed access to a service container and unauthorized transactions; the investigation was still ongoing. Because developer computers often have access to source code, cloud accounts, and production pipelines, protecting them and limiting their privileges is an essential part of organizational security. Source: https://www.endorlabs.com/learn/the-binance-hack-is-a-warning-developer-workstations-hold-the-keys-to-your-business

This playbook proposes four levels of maturity for teams that want to apply AI to application security, organized into two tracks: building software securely and defending systems. The material includes a self-assessment, guidance for moving from governed generation to orchestrated agents, criteria for deciding whether to build or buy solutions, and a 90-day action plan. The goal is to help AppSec leaders adopt AI with governance and practical targets. Source: https://www.endorlabs.com/learn/four-levels-for-architecting-security-into-agentic-sdlc

Endor Labs and Google Antigravity present an integration that brings security checks and fixes into the coding agent workflow, instead of relying only on a later review. The proposal lets agents plan tasks, write code, and add dependencies with specialized security tools available during development. The announcement reflects a growing trend of embedding AppSec controls directly into AI-assisted development environments. Source: https://www.endorlabs.com/learn/endor-labs-google-antigravity-secure-code-by-default-in-agentic-workflows

Bruce Schneier highlights the observation that a significant share of known critical vulnerabilities was reportedly discovered recently, raising the possibility that AI tools are accelerating flaw identification. The post draws attention to the change in scale of vulnerability discovery and to the challenge it poses for those who must verify, prioritize, and fix software problems. Source: https://www.schneier.com/blog/archives/2026/11/ai-vulnerability-finding-2.html

The article discusses the challenges of defending PHP systems after PHP2Shell, noting that the technology's wide deployment can make rapid patching difficult while exploit windows shrink. Besides fixing vulnerable systems, teams may need to combine traffic monitoring, network controls, and threat analysis to identify exploitation attempts, including when encrypted traffic limits the effectiveness of traditional signatures. Source: https://www.bankinfosecurity.com/after-php2shell-network-defense-must-go-beyond-patching-a-33261

The article examines the attention generated by AI-powered code analysis features such as Claude Code Security, and argues that finding flaws is only one part of managing software risk. Organizations still need to validate results, prioritize issues, fix root causes, and integrate analysis into the development lifecycle and existing AppSec controls. AI can expand review capacity, but it does not replace a comprehensive security process. Source: https://securityboulevard.com/2026/11/hype-vs-reality-claude-code-analysis-highlights-shift-toward-ai-in-software-security/

This opinion piece discusses how artificial intelligence may transform cybersecurity: in the future, software may ship with fewer vulnerabilities, but in the short term AI tools can also uncover flaws in products that are already deployed and increase the volume of urgent patches. The challenge for vendors and customers will be to adopt these tools effectively, prioritize risk, and keep the ability to protect systems as the pace of discovery accelerates. Source: https://www.darkreading.com/cyberattacks-data-breaches/microsoft-ai-cyber-risk-report-miss

A report in The Register describes how criminals who gain access to corporate language-model accounts can consume large amounts of compute and generate fraudulent charges. In incidents analyzed by Google Mandiant, losses exceeded US$100,000 per day and reached millions before the organizations cut off the intruders. The episode reinforces the need to protect tokens and API keys, limit permissions, and monitor for unexpected spending and usage. Source: https://www.theregister.com/security/2026/11/02/token-thieves-costing-companies-100k-per-day-in-illicit-llm-charges/5306967

Google Mandiant researchers report incidents in which attackers hijacked enterprise access to large language models, a practice known as LLMJacking. Fraudulent use of cloud resources and AI APIs can generate charges above US$100,000 in a single day and, in some cases, reach US$1 million before access is revoked. The case highlights the importance of protecting credentials and tokens, monitoring model consumption, and responding quickly to anomalous access. Source: https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models

Singapore's Cyber Security Agency published an alert on two vulnerabilities in Oracle Application Object Library, CVE-2026-101767 and CVE-2026-101700, with CVSS scores of 9.8 and 8.1. Unauthenticated exploitation over the network could let an attacker take over the component, and exploitation attempts against one of the flaws have reportedly been observed. Organizations running affected versions should consult Oracle's advisory and update their systems. Source: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-156/

A critical Linux kernel vulnerability, tracked as CVE-2026-98432 and rated 9.8 in severity, could allow remote code execution through the TCP stack. Aikido's article describes the risk, the potentially affected systems, and the recommended fixes. Administrators should consult their distribution vendor's latest guidance and apply the relevant patches. Source: https://www.aikido.dev/blog/linux-kernel-tcp-rce-vulnerability-cve-2026-98432

An analysis of vulnerabilities disclosed between 1999 and September 2026 indicates that only a small fraction has been linked to real-world exploitation. Attackers tend to prioritize flaws that allow remote code execution, privilege escalation, or authentication bypass. Because AI-assisted discovery and exploit development can shorten defenders' response time, defense should combine patching with prioritization based on the likelihood of exploitation and the potential impact of each flaw. Source: https://www.microsoft.com/en-us/security/blog/2026/11/02/exploited-vulnerabilities-common-data-driven-analysis-real-world-attacks/