Discussions, questions and news about OWASP from cybersecurity professionals on Cyberr.
0 members · 40 posts
Schomer — Principal Security Solutions Architect & Founder
The Architectural Manifesto: Part 2 — Why "Black October" Proves Your Threat Model is Dead. The global cybersecurity ecosystem is scrambling over the new PHP "php2shell" zero-days (CVE-2026-109618 & CVE-2026-109619). CISA is yelling to patch, tech stacks are forcing emergency of…
· 6 reactions · 0 comments
Erlend Andreas Gjære — Co-founder / Chief Executive Officer at Secure Practice AS
Websites are going offline due PHP2Shell, with WordPress and 70% of the Internet affected. The biggest risk here may however be not the most obvious one, and may eventuall affect a lot more people than we'd like to think. A vulnerable webshop based on e.g. WooCommerce may of cou…
· 11 reactions · 2 comments
Maxwell Bwire — Technical Support Technician
I'm happy to share that I've been working through the OWASP Top 10 on TryHackMe, building my understanding of common web application security risks through hands-on practicals. During this learning journey, I've explored topics including: - Injection— understanding how unsafe in…
· 6 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
A critical vulnerability doesn't automatically mean you're compromised. But an exposed critical vulnerability is a very different story. This distinction is becoming increasingly important. Organizations are dealing with an enormous volume of vulnerabilities. Google Threat Intel…
· 1 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
AI is discovering RCE vulnerabilities (like php2shell) faster than human teams can patch them. Taking websites offline shouldn't be your incident response plan. If your security isn't embedded at Layer Zero, you're just renting safety until the next zero-day drops. Build determi…
· 5 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Inside the ETBV Engine State Machine: Eliminating Vulnerability Classes in <0.15ms If you want to survive sub-minute weaponization windows, your defenses must be completely deterministic. Here is exactly how the Execution-Time Boundary Verification (ETBV) engine processes, handl…
· 5 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Chained Memory Exploits vs. Authentication Spoofing: Why the Application Plane is Failing Under Fire The simultaneous exploitation of BeyondTrust (CVE-2026-102764) and the PHP2Shell memory chain (CVE-2026-109618/19) exposes the complete collapse of application-level trust bounda…
· 3 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
What if the code running your website can become the doorway into your server? That's exactly why the latest PHP security incident deserves attention. PHP has released emergency security updates for two critical vulnerabilities: CVE-2026-109618 CVE-2026-109619 Both are rated CVS…
· 1 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
The Last 24 Hours Proved It: Your Patch Management Strategy is Broken 🛑 Look at the threat intelligence feed from just the last day. It’s a total structural failure across the entire software stack: • Edge Infrastructure: Palo Alto PAN-OS (CVE-2026-0322) under active RCE exploi…
· 3 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
Layer Zero telemetry shouldn’t require enterprise overhead to be presentable. When auditing network infrastructure, drowning in thousands of raw packet captures or standard octet-stream updates makes real-time analysis impossible. The gap isn't a lack of logging; it's a lack of…
· 2 reactions · 0 comments
David Seagal — Information Security Engineer / Security Operations Consultant
PromptFuzz v2 has been released and uploaded to my github after months of hands-on LLM red-teaming. Spent the last few months actually breaking LLM applications in production environments, RAG pipelines leaking documents across users, MCP tool descriptions executing embedded ins…
· 2 reactions · 1 comments
Idris Adeniji — Senior Security Engineer
Has successfully verified Certified DevSecOps Professional (Practical DevSecOps) and OWASP API Security Top 10 (2 hours) (APIsec University)
· 0 reactions · 0 comments
Christopher Neitzert — Sr. Operator & Advisor
OWASP's API Security site was replaced with a sales page branded as a pentest firm's security notice. That's neither responsible nor disclosure. Creative Mayhem does penetration testing. We won't hack you to get your attention; we get a signed scope, then we hack you. #Security…
· 3 reactions · 0 comments
ASM Shamimul Islam Shawon — Cyber Security & Client Support Executive
Looking for a Seasoned Enterprise IT Infrastructure & Cyber Security Specialist? Let's connect! With 14+ years of hands-on experience orchestrating distributed enterprise architectures and secure operations, I help organizations build resilient infrastructures and mitigate criti…
· 2 reactions · 0 comments
Sean Moore — Security Architect
AI and its LLMs are not immune to security threats. I have created a high-level threat model that illustrates where some of these threats exist in an LLM's process stack based on OWASP. This model could be more granular to include multiple layers and boundaries, emphasizing even…
· 4 reactions · 1 comments
Nikki Webb — Cybersecurity is not just technical, it is human | Protecting people, businesses & resilience
Pentesters aren't the problem. Annual cadence is. A penetration tester's real value isn't re-confirming the same OWASP Top 10 list once a year. It's judgement: architecture, logic, context, what actually matters to your business. The problem is the snapshot model. One report, th…
· 3 reactions · 0 comments
6 months ago I knew nothing about cybersecurity. Today I built an AI-powered security vulnerability scanner from scratch. It detects: 💀 SQL Injection 💀 Hardcoded secrets & API keys 💀 Missing authentication checks 🔴 Sensitive data exposure 🔴 Path traversal attacks 🟡 Misconf…
· 4 reactions · 4 comments
Haydn Kuti — Lead Community Operator
BSides Maine: Community, Malware, and Identity Residue Spent an awesome day volunteering and connecting at the inaugural BSides Maine. Taking part as an auditorium logistics volunteer was a fantastic experience, and the event brought together an incredible mix of technical depth…
· 2 reactions · 4 comments
Imrane T. — Offensive Security | Attack Chains & Business Logic
Built AttackSaga - an autonomous attack-chain agent for authorized lab environments. It doesn’t stop at finding bugs, it validates the full path to impact: • authentication robustness • access control weaknesses (IDOR) • real data exposure proof • structured report generation En…
· 3 reactions · 1 comments
Biswadeb Mukherjee — Security Engineer & Independent Researcher
Stop storing passwords like this!! #cybersecurity #passwordsecurity #owasptop10 #coding #programming
· 3 reactions · 0 comments
Innocent O. Akpareva — Cybersecurity Analyst
Yesterday, I had the privilege of facilitating another amazing hands-on training session. We covered the OWASP Top 10, installed OWASP Broken Web Applications on VirtualBox, and conducted a brute force attack on DVWA. We also carried out SQL injection and command execution attac…
· 2 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
Whoop! My OWASP Project for OWASP Model Card Security Standard has been approved. The new OWASP github page for this is here: https://lnkd.in/efQ5NaNW Watch this space
· 3 reactions · 0 comments
Christopher Neitzert — Sr. Operator & Advisor
To every engineer over 45 who can't get a callback: Stop applying. Start shipping. Every closed product you're locked out of working on is a feature list, and agents have collapsed the cost of building one to nearly nothing. What agents can't supply is thirty years of knowing wh…
· 1 reactions · 0 comments
Innocent O. Akpareva — Cybersecurity Analyst
I turned my 8-month cybersecurity mentoring curriculum into a free PDF book. Training teaches tools. Mentoring builds judgment. There's a difference, and most people never get the latter. The Cybersecurity Mentor's Handbook walks through everything: attacker mindset, OWASP Top 1…
· 5 reactions · 2 comments
SHERIF SALAH EL-DIN — Cyber Security Analyst
Web & Cloud Security (Cookies, Sessions & OWASP) | أساسيات الأمن السيبراني https://youtu.be/tqSIy5q-86k?si=S_VFDViqero1jHLK #CyberSecurity #CyberSecurityFundamentals #InformationSecurity #InformationSecurityTutorials #WebSecurity #CloudSecurity #OWASP #OWASPTop10 #SQLInjection #…
· 2 reactions · 0 comments