Application Security

Mastering Application Security: Your Resource for Secure Development, Testing, Code Analysis, and More.

Content Partnership: OWASP Logo SC Media Logo

Simulation highlights OWASP LLM Top 10 risk of unbounded consumption

Laura FrenchSeptember 22, 2026

Forcepoint research showed how poisoned input can run up AI agent costs.

Today's Top AppSec Headlines

Interviews from OWASP Global AppSec USA 2025

Training
OWASP 2025 Wrap-Up: Community, AI Security, and the Future of AppSec – Avi Douglen – OWSP25 #2
Supply chain
The future of CycloneDX and software transparency – Steve Springett – OWSP25 #2
AI/ML
From Transparency to Trust: Shaping AI Security with OWASP AIBOM & AI Exchange – Aruneesh Salhotra – OWASP25 #2
Risk Assessments/Management
AIVSS: Do we need a new Risk Management Approach in the era of Agentic AI? – Ken Huang – OWASP25 #2
Application security
Threat Modeling and The Four Question Framework – Adam Shostack – OWSP25 #1
AI/ML
Secure Coding in the Age of AI – James Manico – OWSP25 #1
Leadership
Security Champions: You Already Have Them! How to Tap Their Potential – Dustin Lehr – OWSP25 #1
AI/ML
Beyond the Firewall: Why Traditional Web Security Still Matters in the AI Era – Felipe Zipitria – OWSP25 #1
Governance, Risk and Compliance
Use OWASP SAMM for CRA compliance – Sebastien Deleersnyder – OWSP25 #1
Training
CyberRisk TV Live from OWASP Global AppSec 2025 – Allan Friedman – OWSP25 #1
Application security
GenAI Security From Assessment to Action – Sandy Dunn – OWSP25 #1
Application security
Agentic Security Risks – John Sotiropoulos – OWSP25 #1

Application Security: Explained and Explored

Application Security News

Vulnerability Management

GitLab patches 10.0 flaw in its CE and EE products

Steve ZurierOctober 13, 2026

GitLab patches critical CVSS 10.0 RCE flaw as experts warn of software supply chain risks.

Vulnerability Management

What’s Not Found in AppSec? – ASW #404

October 13, 2026

To celebrate our 404th episode we discuss what's not found in modern appsec and what still exists that should become not found. The conversation starts with a classic problem of appsec -- looking for a reliable vuln prioritization methodology. But we expand from there to challenge whether a focus on vulns and patches is even the right choice for an...

Application security

Critical Bricksforge WordPress flaw exploited in attacks

Steve ZurierOctober 12, 2026

Attackers exploit critical Bricksforge WordPress flaw to execute code without authentication.

AI processor chip in modern data center server corridor with glowing digital data connections, idea for artificial intelligence computing, cloud technology and big data infrastructure

AI/ML

Dead drops in public: What the AI agent stashed on Hugging Face

Hidden Layer Research TeamSeptember 11, 2026

A technical breakdown of artifacts the agent left in public repositories during the July 2026 Hugging Face intrusion.

The homepage of Atlassian website is displayed on a PC.

DevSecOps

Critical Atlassian flaw exposes files across eight products

Steve ZurierOctober 7, 2026

Unauthenticated attackers could steal credentials and gain access to CI/CD systems.

Application security

Getting Granular with Access, Attributes, and Intent – Alex Olivier – ASW #403

October 6, 2026

The principle of least privilege access is ubiquitous in recommendations, but perhaps too uncommon in practice. Alex Olivier explains how the AuthZen Working Group has been approaching new standards, guidelines, and practical deployment patterns to make it easier for orgs to establish more refined and correct access policies. It's a problem that pr...

Application security

Mobile App Security: Hidden SDK Risks, AI Coding & DevSecOps Best Practices – WC #1

October 1, 2026

Mobile applications have become the primary way customers and employees interact with businesses—but are they secure? In this SC Media webcast, host Adrian Sanabria (Enterprise Security Weekly) sits down with Alan Snyder, CEO of NowSecure, to discuss today's mobile application security landscape and why traditional AppSec approaches often fail to i...

AI coding assistant for software development concept. Machine Learning Code, Programmer use laptop with code and AI robot represent artificial intelligence, AI programming, software development tools

Application security

How coding agents are changing application risk

Hidden Layer Research TeamSeptember 11, 2026

Coding agents expand application risk beyond AI models to the tools, context and systems around them.

Application security

Going From Bug Bounty Bugs to More Secure Systems – Shlomie Liberow – ASW #402

September 29, 2026

Finding flaws with LLMs and agents is changing bug bounty programs. But it's not necessarily changing how orgs fix those flaws. Shlomie Liberow shares his experience across a decade of bounty programs and how they have changed for researchers and orgs. He explains why fixing the bug reported through a bug bounty is more about understanding intercon...

Critical Infrastructure Security

MemTensor npm, PyPI packages compromised with cross-platform credential stealer

Laura FrenchSeptember 24, 2026

A Go binary called sckit was added to four malicious releases, targeting developer secrets.

Application Security

Application Security

Simulation highlights OWASP LLM Top 10 risk of unbounded consumption

Today's Top AppSec Headlines

Meta releases new AI models, Muse Wonder and Muse Wonder Full

Hackers use Bing redirects in Google ads for fake Claude installers

AnyDesk Linux exploit grants root access before connection approval

Interviews from OWASP Global AppSec USA 2025

Application Security: Explained and Explored

The highest risk for AI agents is the software development organization

NVIDIA can stop a rogue agent. Can it revoke its access?

How identity and permissions become the blast-radius boundary for LLMs

Application Security News

GitLab patches 10.0 flaw in its CE and EE products

What’s Not Found in AppSec? – ASW #404

Critical Bricksforge WordPress flaw exploited in attacks

Dead drops in public: What the AI agent stashed on Hugging Face

Critical Atlassian flaw exposes files across eight products

Getting Granular with Access, Attributes, and Intent – Alex Olivier – ASW #403

Mobile App Security: Hidden SDK Risks, AI Coding & DevSecOps Best Practices – WC #1

How coding agents are changing application risk

Going From Bug Bounty Bugs to More Secure Systems – Shlomie Liberow – ASW #402

MemTensor npm, PyPI packages compromised with cross-platform credential stealer

Fast Five

Selected by the SC Media Editorial team every Tuesday.

AppSec Events

Bridging the Gap from CISO-Developed Tools to Black Hat Hype: What AI Security Leaders Should Watch Next

Protecting Application User Data for Better Privacy, Governance, and Compliance

Scaling secure software in the age of AI: Turning intelligence into action

Gen AI Application Security & Risk Virtual Conference presented by the OWASP Gen AI Security Project and CSS