Appsec adventures

RapidFort is an open-source platform and GitHub project that automatically hardens container images by profiling their actual use, stripping out unused components, and eliminating the majority of vulnerabilities. By using coverage scripts or runtime profiling, it identifies exactly which parts of a container are necessary and safely removes the rest. This approach can reduce attack surfaces by 60–90% and automatically remediate up to 95% of common vulnerabilities without requiring code changes. RapidFort provides a catalog of pre-hardened images for popular platforms like PostgreSQL, Redis, NGINX, MongoDB, and more, all updated weekly. Developers and security teams benefit from faster, leaner, more secure workloads, reduced patching burden, and improved compliance—especially useful for cloud and DevSecOps pipelines. The project fosters community involvement by offering free hardened images, encouraging contributions, and supporting CI/CD integration to ensure safer container deployment...

A study by EY reveals that organizations using agentic AI in their cybersecurity operations are saving an average of $1.7 million annually while significantly improving their defensive capabilities. These AI-driven systems reduce threat detection and response times by roughly 21 percent, streamline security tech stacks, and free up resources for more advanced protections. Agentic AI can autonomously perform tasks like isolating compromised devices or applying patches, allowing teams to manage more endpoints with fewer manual processes. This shift enables cybersecurity professionals to focus on strategic oversight, collaboration, and aligning security with business objectives. The study emphasizes that cybersecurity is evolving from a cost center into a value-generating function, thanks to the speed, scalability, and intelligence that agentic AI brings to the field. https://aibusiness.com/agentic-ai/agentic-ai-helps-organizations-scale-cybersecurity-faster-ey-studys.

Artificial intelligence and quantum computing are progressing in ways that increasingly complement each other, with experts predicting this convergence could dramatically reshape industries. AI’s ability to analyze and learn from massive datasets pairs well with quantum computing’s potential for solving complex problems at speeds far beyond classical systems. Together, they are expected to accelerate breakthroughs in areas like drug discovery, financial modeling, materials science, logistics, and climate simulations. In cybersecurity, the combination creates both risk and opportunity, as quantum capabilities threaten current encryption while AI can help build stronger defenses. Despite the promise, significant challenges remain, including fragile quantum hardware, a shortage of skilled professionals, and the need for better software and ethical standards. Experts emphasize that realizing the full potential of this convergence will require global collaboration, sustained investment, and...

Google’s new whitepaper on AI agent security outlines a high-level approach to identifying and mitigating risks in agentic systems. The post on Shostack.org reviews the document as a de facto threat model, despite Google not framing it explicitly as one. It identifies two central risks: rogue agent actions and sensitive data exposure. The paper presents helpful architecture diagrams and introduces core principles like human control, restricted powers, and transparency. However, concerns remain about the clarity of roles between platform and deployers, and ambiguity in terms like “alignment.” While Google offers a solid starting point, more specificity is needed for practical implementation.  https://shostack.org/blog/google-approach-to-ai-agents-threat-model-thursday/

 A researcher demonstrated how attackers can exploit Chromium-based browsers to silently capture screenshots by launching them with specific flags that auto-select screen sharing sources, bypassing user consent. JavaScript on a malicious webpage can use the getDisplayMedia API to take snapshots and send them to a server. The attack can run in headless mode or off-screen to remain hidden. This method doesn't require malware, making it an effective post-exploitation tool, and defenders are advised to monitor for suspicious command-line flags. https://mrd0x.com/spying-with-chromium-browsers-screensharing

IBM has donated its Cryptographic Bill of Materials (CBOM) toolset to the Linux Foundation’s Post-Quantum Cryptography Alliance. CBOM provides a detailed inventory of cryptographic elements in software, such as algorithms, keys, and configurations, helping organizations track and secure their cryptographic assets. Originally open-sourced by IBM in 2024, the toolset includes components for scanning source code, analyzing containers, and integrating with CI/CD pipelines. This move aims to promote broader adoption of CBOM standards, support cryptographic transparency, and enhance preparedness for post-quantum security challenges.  https://research.ibm.com/blog/cryptographic-cbom-linux-foundation

Escape DAST has developed a pioneering state‑aware web application crawling algorithm aimed at thoroughly auditing modern web architectures—including SPAs, MPAs, and hybrid systems. Built on a finite‑state machine (FSM) framework, the crawler maps the application’s functional states rather than simply traversing URLs, enabling it to detect both deep and external states intelligently. Through content fingerprinting, action deduplication, and the identification of state transitions, the algorithm avoids redundant exploration while prioritizing high‑risk interactions. It determines state uniqueness by examining DOM structure, visible text, interactive elements, and even API activity, striking a balance between precision and performance. Although methods like DOM hierarchies, hashing, visual snapshots, and AI‑driven detection were explored, Escape chose the most efficient combination to prevent state explosion. The result is more realistic user emulation, optimized scanning efficiency, and...