Application Security

Mastering Application Security: Your Resource for Secure Development, Testing, Code Analysis, and More.

Content Partnership: OWASP Logo SC Media Logo

OWASP updates top 10 security risks for LLM applications

OWASP GenAI Security Project Team August 26, 2026

OWASP’s 2026 LLM Top 10 highlights prompt injection, AI agents and emerging RAG security risks.

Today's Top AppSec Headlines

Interviews from OWASP Global AppSec USA 2025

Training
OWASP 2025 Wrap-Up: Community, AI Security, and the Future of AppSec – Avi Douglen – OWSP25 #2
Supply chain
The future of CycloneDX and software transparency – Steve Springett – OWSP25 #2
AI/ML
From Transparency to Trust: Shaping AI Security with OWASP AIBOM & AI Exchange – Aruneesh Salhotra – OWASP25 #2
Risk Assessments/Management
AIVSS: Do we need a new Risk Management Approach in the era of Agentic AI? – Ken Huang – OWASP25 #2
Application security
Threat Modeling and The Four Question Framework – Adam Shostack – OWSP25 #1
AI/ML
Secure Coding in the Age of AI – James Manico – OWSP25 #1
Leadership
Security Champions: You Already Have Them! How to Tap Their Potential – Dustin Lehr – OWSP25 #1
AI/ML
Beyond the Firewall: Why Traditional Web Security Still Matters in the AI Era – Felipe Zipitria – OWSP25 #1
Governance, Risk and Compliance
Use OWASP SAMM for CRA compliance – Sebastien Deleersnyder – OWSP25 #1
Training
CyberRisk TV Live from OWASP Global AppSec 2025 – Allan Friedman – OWSP25 #1
Application security
GenAI Security From Assessment to Action – Sandy Dunn – OWSP25 #1
Application security
Agentic Security Risks – John Sotiropoulos – OWSP25 #1

Application Security: Explained and Explored

Application Security News

(Credit: Mojahid Mottakin – stock.adobe.com)

AI/ML

Anthropic finds 4th real-world attack by Claude agent, details models’ ‘biased reasoning’

Laura FrenchSeptember 11, 2026

Mythos 5 was highlighted as being especially prone to believing the real world was a simulation.

Vulnerability Management

Security Conversations on AI, Agents, and Emerging Threats from Black Hat 2026 – Michael Leland, Sean Murphy, Idan Plotnik, Ido Geffen – ASW #399

September 8, 2026

We showcase recordings from this year's Black Hat. The Hidden Risks of the AI Supply Chain - Black Hat interview with Michael Leland, VP and Field CTO of Island. Agents can independently discover and install tools, but the emerging ecosystem of Skills and MCP servers lacks many of the trust and security controls applied to traditional software. Mic...

Identity

Grafana fixes critical SSRF flaw affecting Grafana MCP servers

Laura FrenchSeptember 3, 2026

An MCP caller could potentially reach unintended internal services leveraging the MCP server’s network position.

AI processor chip in modern data center server corridor with glowing digital data connections, idea for artificial intelligence computing, cloud technology and big data infrastructure

AI/ML

Dead drops in public: What the AI agent stashed on Hugging Face

Hidden Layer Research TeamSeptember 11, 2026

A technical breakdown of artifacts the agent left in public repositories during the July 2026 Hugging Face intrusion.

Application security

JFrog Artifactory flaw exploited days after patch release

Steve ZurierSeptember 1, 2026

Attackers exploited a JFrog Artifactory flaw days after its patch, threatening software supply chains.

Application security

Fixing Software Weaknesses Rather Than Just Finding More Flaws – Nidhi Aggarwal, Gil Geron, Braden Russell – ASW #398

September 1, 2026

AppSec has always emphasized techniques and tools for discovering vulns, along with taxonomies and lists for describing them. But just piling up more CVEs into a prioritized patching queue has never been an effective strategy. Nidhi Aggarwal talks about some of the economics and decisions that orgs evaluate when figuring out how to improve and prot...

AI/ML

1,200 OpenAI agents colluded to cheat evaluations in lead-up to Hugging Face attack

Laura FrenchAugust 28, 2026

OpenAI and more than 100 other organizations are now calling for urgent collective action on cyber defense.

AI coding assistant for software development concept. Machine Learning Code, Programmer use laptop with code and AI robot represent artificial intelligence, AI programming, software development tools

Application security

How coding agents are changing application risk

Hidden Layer Research TeamSeptember 11, 2026

Coding agents expand application risk beyond AI models to the tools, context and systems around them.

AI/ML

Shadow AI surges as 80% of employee AI tools evade IT oversight

Laura FrenchAugust 27, 2026

Reco’s The State of Agent Security 2026 report highlights shadow AI, MCP risks and AI vulnerability trends.

Application security

Mobile banking trojans expand capabilities; 66% now allow full device takeover

Laura FrenchAugust 26, 2026

Banking trojans have evolved to include remote control and ransomware capabilities.

Selected by the SC Media Editorial team every Tuesday.

Sign up now for the top five issues cybersecurity pros need to know this week.

Application Security

Application Security

OWASP updates top 10 security risks for LLM applications

Today's Top AppSec Headlines

New WeWorm tool hacks Android and iOS phones via WeChat calls

Mozilla rolls out ad blocking to Firefox for iOS

Signal contact discovery service vulnerabilities allowed enclave escape

Interviews from OWASP Global AppSec USA 2025

Application Security: Explained and Explored

Ping YOUniverse: How to classify and manage AI agents

Security at the moment of action: Applying access gateway for AI agents

6 ways teams can leverage zero-trust to manage AI agents

Application Security News

Anthropic finds 4th real-world attack by Claude agent, details models’ ‘biased reasoning’

Security Conversations on AI, Agents, and Emerging Threats from Black Hat 2026 – Michael Leland, Sean Murphy, Idan Plotnik, Ido Geffen – ASW #399

Grafana fixes critical SSRF flaw affecting Grafana MCP servers

Dead drops in public: What the AI agent stashed on Hugging Face

JFrog Artifactory flaw exploited days after patch release

Fixing Software Weaknesses Rather Than Just Finding More Flaws – Nidhi Aggarwal, Gil Geron, Braden Russell – ASW #398

1,200 OpenAI agents colluded to cheat evaluations in lead-up to Hugging Face attack

How coding agents are changing application risk

Shadow AI surges as 80% of employee AI tools evade IT oversight

Mobile banking trojans expand capabilities; 66% now allow full device takeover

Fast Five

Selected by the SC Media Editorial team every Tuesday.

AppSec Events

Bridging the Gap from CISO-Developed Tools to Black Hat Hype: What AI Security Leaders Should Watch Next

Protecting Application User Data for Better Privacy, Governance, and Compliance

Scaling secure software in the age of AI: Turning intelligence into action

Gen AI Application Security & Risk Virtual Conference presented by the OWASP Gen AI Security Project and CSS