AI fights and more attacks on dev infrastructure: Last Week in AppSec for 4. March 2026 - Checkmarx Last week: an “AI bot” abusing GitHub Actions to run code and steal tokens, agent takeover paths from a single browser visit, and fresh reminders that npm packages and WordPress plugins can still…

Whoever had "AI attacks against GitHub Actions" on their #AppSec bingo card won this last week with the "hackerbot-claw" thing. We cover that story and more: buff.ly/F0NUqYS

#LastWeekInAppSec #AISecurity #SupplyChainSecurity #ApplicationSecurity #Cybersecurity

Last Week in AppSec for 26. February 2026 - Checkmarx Last Week In AppSec saw public disclosures relating to AI code assistants trusting context that can be attacker-controlled.

Last Week In AppSec we're seeing yet more ways in which researchers are able to trick AI code assistants by abusing trust in sources of context: like configuration files in code repositories and the contents of bug reports.

Read more: buff.ly/jD3gRHj

#ApplicationSecurity #LastWeekInAppSec #AI

Last Week in AppSec for 29. January 2026 - Checkmarx Denial of Service in Java SE and React server, and pnpm lets a directory traversal (Zip) slip in. Last week in AppSec.

Looking at the #LastWeekInAppSec, we see two widely-used application components with #DoS, and a nasty little path traversal in a package manager.

Details, mitigations, context for making risk-based decisions all on our blog: buff.ly/xL4NKOg

#React #NodeJS #Java #pnpm #npm #CVE #Vulnerability

Last Week in AppSec for 15. January 2026 - Checkmarx Potentially serious flaws, depending on your uses, in sigstore, n8n, and pnpm made last week in appsec all about tools in the software supply chain.

This #LastWeekInAppSec is a great reminder that automation and dev tooling is part of an organizations attack surface. #Sigstore, #pnpm, and #n8n all have vulns to pay attention to, but (mostly) not panic over.

👉 should you worry? read: buff.ly/ATRNVz3

#AppSec #ProductSecurity #DevSecOps #DevOps

Last Week in AppSec for 02. December 2025 - Checkmarx Last week in AppSec was busy; with Shai-Hulud 2, node-forge signature bypasses, Apache Syncope hard-coded AES key, renewed focus on libxml2 vulnerabilities, and some big patched from GitLab

#LastWeekInAppSec was a busy one! Not only did we have #ShaiHulud rear its head again, but a number of big patching efforts came up as well 🧵1/5

Get details and analysis here: buff.ly/T63yQWd

#LastWeekInAppSec brings two cases where “safe by design” didn’t hold up — an #NPM math sandbox with an RCE flaw, and an #AI workflow tool with dangerous password-change logic.

Full roundup:
buff.ly/YrPW8GN

🧵1/4

☔️ #LastWeekInAppSec (Nov 11) highlights two low-severity issues with interesting implications for real-world #AppSec and #DevSecOps.
🔗 buff.ly/wN1crc3
🧵1/4

☔️ #LastWeekInAppSec: Two major regressions hit key #DevOps tools this week — both with real potential for impact in enterprise environments. 🔗 buff.ly/REjgAW4 🧵1/4

Last Week in AppSec for 21. October 2025 - Checkmarx Access control bypasses in Python's Authlib (OAuth and OpenID) and Java's Spring Framework (CSRF protection failure), last week in AppSec

It's #LastWeekInAppSec time! Access control bypasses in #Python's #Authlib (#OAuth and #OpenID) and Java's #SpringFramework (#CSRF protection failure).

See buff.ly/ZUloV61 for deeper analysis, mitigation steps, etc.

#AppSec #VulnManagement #CyberSecurity #SupplyChainSecurity

Last Week in AppSec for 30. September 2025 - Checkmarx go-mail SMTP injection and Rancher SAML phishing vector with escalation of privilege: Last Week In AppSec

Got 3 minutes? Catch up on the #AppSec news you might have missed #LastWeekInAppSec : buff.ly/dR3PQZJ

This week: go-mail #opensource library has SMTP injection; Rancher subject to SAML flow abuse in Manager & CLI. Read for full details including remediation and mitigation advice. #DevSecOps 🧵1/5

Last Week in AppSec for 23. September 2025 - Checkmarx Jenkins/Jetty HTTP/2 DoS and Kubernetes C# client cert-validation flaw. What’s affected, fixed versions, and fast mitigations—Last Week In AppSec

Two under-the-radar issues — A #Jenkins DoS #vulnerability and a CA cert validation failure opening folks to #MitM with #Kubernetes clients — happened #LastWeekInAppSec, while we were all focused on the Shai-Hulud attacks. buff.ly/o8xS3ox 🧵 1/3

Details, mitigations, and links: buff.ly/H7BB0oC #AppSec #BlueTeam #DevSecOps #CVE #GHSA #LastWeekInAppSec 🧵5/5

Last Week in AppSec for 09. September 2025 - Checkmarx Hono JS framework auth bypass, Netty java framework 0-day, and Claude Code warning about its warnings — last week in AppSec

Last Week in AppSec (09 Sep 2025): Hono auth bypass, Netty 0-day smuggling, Claude Code trust risks. Full write-up: buff.ly/H7BB0oC #LastWeekInAppSec #AppSec #SecurityNews 🧵1/5

#LastWeekInAppSec for 19. August 2025: Code injection in AI Agent dev tool, path traversal in `go-getter`, model code injection protection bypass in TensorFlow Keras, and unsafe ImageMagick use in Rails Active storage buff.ly/clVmcTi 🧵 1/5

Time for another #LastWeekInAppSec for 12. Aug 2025: ChatGPT-5 system prompt leaked, CISA supports CVE, and AppSec Village completes buff.ly/gsnpATQ

Looking for #LastWeekInAppSec for 5. Aug? We're taking a bye week on it to hang out at #BHUSA and #DEFCON -- look for us to get back on it next week! Meanwhile, keep an eye out for your friendly researchers (and Darren) around Las Vegas.

It's time for another #LastWeekInAppSec (29. July 2025) -- AppSec items of interest you might have missed in the last week. buff.ly/1b2laNf

#LastWeekInAppSec
⎈ The Kubernetes package manager Helm has a high-severity Code Injection vulnerability CVE-2025-53547.
🚂 The Conductor open-source microservices workflow orchestrator is vulnerable to a Remote Code Execution #RCE (CVE-2025-26074)
More details: buff.ly/BXWkoeF

Looking for #LastWeekInAppSec? Us too! We had some technical difficulties publishing to our site, which we're working to rectify. Watch this space!

Last Week In AppSec for 08. July 2025 - Checkmarx AI MCP leak from Anthropic, fraudulent verification in IDE extensions, and a Next.js Denial of Service (DoS) — last week in AppSec

Data leaking #MCP Server, tricking IDE's into showing malicious extensions as verified, and a #DoS in #nextjs — #LastWeekInAppSec
buff.ly/domX3aU

#AppSec #vulnerability #AI #Cybersecurity