Application Security

Mastering Application Security: Your Resource for Secure Development, Testing, Code Analysis, and More.

Content Partnership: OWASP Logo SC Media Logo

Malicious AI robot holding keys to open padlock. Vector illustration for cybersecurity articles, tech blogs, reports

AI agents breach production systems, spread malware in major exploits

OWASP GenAI Security Project Team October 14, 2026

AI agents breached production systems, stole credentials and spread malware through software supply chains.

Today's Top AppSec Headlines

Interviews from OWASP Global AppSec USA 2025

Training
OWASP 2025 Wrap-Up: Community, AI Security, and the Future of AppSec – Avi Douglen – OWSP25 #2
Supply chain
The future of CycloneDX and software transparency – Steve Springett – OWSP25 #2
AI/ML
From Transparency to Trust: Shaping AI Security with OWASP AIBOM & AI Exchange – Aruneesh Salhotra – OWASP25 #2
Risk Assessments/Management
AIVSS: Do we need a new Risk Management Approach in the era of Agentic AI? – Ken Huang – OWASP25 #2
Application security
Threat Modeling and The Four Question Framework – Adam Shostack – OWSP25 #1
AI/ML
Secure Coding in the Age of AI – James Manico – OWSP25 #1
Leadership
Security Champions: You Already Have Them! How to Tap Their Potential – Dustin Lehr – OWSP25 #1
AI/ML
Beyond the Firewall: Why Traditional Web Security Still Matters in the AI Era – Felipe Zipitria – OWSP25 #1
Governance, Risk and Compliance
Use OWASP SAMM for CRA compliance – Sebastien Deleersnyder – OWSP25 #1
Training
CyberRisk TV Live from OWASP Global AppSec 2025 – Allan Friedman – OWSP25 #1
Application security
GenAI Security From Assessment to Action – Sandy Dunn – OWSP25 #1
Application security
Agentic Security Risks – John Sotiropoulos – OWSP25 #1

Application Security: Explained and Explored

Application Security News

Vulnerability Management

More Vulns and More Guesswork from Less Data – Jeremiah Grossman – ASW #407

November 3, 2026

Following the catalog of CVEs is great for enumeration, but chasing those CVEs for patching is terrible for strategy. Jeremiah Grossman shows what breach data tells us about the differences between having over 400,000 CVEs, a few thousand KEVs, and a few hundred ways that attackers compromise orgs. We go into the importance of distinguishing vulns ...

(Credit: Rafael Henrique – stock.adobe.com)

Application security

Over 1,000 GitLab servers exposed to exploited critical RCE flaw

Steve ZurierNovember 2, 2026

Security experts warn unpatched GitLab servers pose serious software supply chain risks.

Drupal website. Drupal is a free and open-source web content management system (CMS) written in PHP.

Application security

Drupal Commerce Core access bypass flaw exploited in attacks

Steve ZurierOctober 30, 2026

Attackers exploit critical Drupal Commerce Core flaw to bypass access controls and manipulate orders.

A glowing green shield with a fingerprint and a checkmark inside

Identity

How to Find the Right Identity Security Partner?

iC ConsultNovember 2, 2026

Choosing an IAM partner requires specialized expertise, vendor neutrality and end-to-end support.

Application security

Securing Modern Financial Systems in the Age of AI – Rashid Feroze – ASW #406

October 27, 2026

Proactive security doesn't have to wait for a vuln to be disclosed. Even if a patch isn't available, it's possible to deploy controls and design systems to be resilient against how vulns are exploited. Rashid Feroze talks about runtime security and the benefits of deploying eBPF filters to improve observability and block unauthorized behavior. He w...

Application security

CISA advises orgs to patch PHP2Shell bugs immediately

Steve ZurierOctober 21, 2026

CISA urges immediate PHP2Shell patching as attackers target critical flaws in widely used PHP code.

Application security

Standardizing Mobile Defense: Inside the OWASP Mobile App Security Project v2 – Ryan Lloyd, Jan Seredynski – ASW #405

October 20, 2026

The OWAS Mobile Application Security (MAS) project recently released an updated version of its guidance, with excellent advice organized into common weaknesses, a verification standard for devs (MASVS), and a testing guide (MASTG). Ryan Lloyd and Jan Seredynski from Guardsquare dive into the project to talk about how it's been updated, how orgs can...

Identity

Why Identity Security Assessments Matter in the Age of AI

iC ConsultNovember 2, 2026

Identity security assessments help organizations identify IAM gaps and manage emerging AI risks.

Vulnerability Management

GitLab patches 10.0 flaw in its CE and EE products

Steve ZurierOctober 13, 2026

GitLab patches critical CVSS 10.0 RCE flaw as experts warn of software supply chain risks.

Vulnerability Management

What’s Not Found in AppSec? – ASW #404

October 13, 2026

To celebrate our 404th episode we discuss what's not found in modern appsec and what still exists that should become not found. The conversation starts with a classic problem of appsec -- looking for a reliable vuln prioritization methodology. But we expand from there to challenge whether a focus on vulns and patches is even the right choice for an...

Application Security

AI agents breach production systems, spread malware in major exploits

Today's Top AppSec Headlines

Hackers compromise emergency alert apps in Ukraine and Russia

Critical vulnerability in Node-RED exploited to deploy Linux bot

Trigger.dev discloses security incident involving exposed environment variables

Interviews from OWASP Global AppSec USA 2025

OWASP 2025 Wrap-Up: Community, AI Security, and the Future of AppSec – Avi Douglen – OWSP25 #2

The future of CycloneDX and software transparency – Steve Springett – OWSP25 #2

From Transparency to Trust: Shaping AI Security with OWASP AIBOM & AI Exchange – Aruneesh Salhotra – OWASP25 #2

AIVSS: Do we need a new Risk Management Approach in the era of Agentic AI? – Ken Huang – OWASP25 #2

Threat Modeling and The Four Question Framework – Adam Shostack – OWSP25 #1

Secure Coding in the Age of AI – James Manico – OWSP25 #1

Security Champions: You Already Have Them! How to Tap Their Potential – Dustin Lehr – OWSP25 #1

Beyond the Firewall: Why Traditional Web Security Still Matters in the AI Era – Felipe Zipitria – OWSP25 #1

Use OWASP SAMM for CRA compliance – Sebastien Deleersnyder – OWSP25 #1

CyberRisk TV Live from OWASP Global AppSec 2025 – Allan Friedman – OWSP25 #1

GenAI Security From Assessment to Action – Sandy Dunn – OWSP25 #1

Agentic Security Risks – John Sotiropoulos – OWSP25 #1

Application Security: Explained and Explored

The MCP server nobody inventoried

A clean code review does not mean a safe runtime

A revoked certificate is not a blocked connection

Application Security News

More Vulns and More Guesswork from Less Data – Jeremiah Grossman – ASW #407

Over 1,000 GitLab servers exposed to exploited critical RCE flaw

Drupal Commerce Core access bypass flaw exploited in attacks

How to Find the Right Identity Security Partner?

Securing Modern Financial Systems in the Age of AI – Rashid Feroze – ASW #406

CISA advises orgs to patch PHP2Shell bugs immediately

Standardizing Mobile Defense: Inside the OWASP Mobile App Security Project v2 – Ryan Lloyd, Jan Seredynski – ASW #405

Why Identity Security Assessments Matter in the Age of AI

GitLab patches 10.0 flaw in its CE and EE products

What’s Not Found in AppSec? – ASW #404

Fast Five

Selected by the SC Media Editorial team every Tuesday.

AppSec Events

Bridging the Gap from CISO-Developed Tools to Black Hat Hype: What AI Security Leaders Should Watch Next

Protecting Application User Data for Better Privacy, Governance, and Compliance

Scaling secure software in the age of AI: Turning intelligence into action