SeanWrightSec

SeanWrightSec

@seanwrightsec.com

Principal Application Security Engineer focused on all things #AppSec. Occasionally dabble in my own research. Also keen gamer and aspiring photographer.

1.9K followers124 following305 posts

SeanWrightSec
@seanwrightsec.com

So the release candidate has been will be released today (6 November 2025): owasp.org/www-project-... Comments until 20 November 2025.

owasp.orgOWASP Top Ten | OWASP FoundationThe OWASP Top 10 is the reference standard for the most critical web application security risks. Adopting the OWASP Top 10 is perhaps the most effective first step towards changing your software devel...
SeanWrightSec@seanwrightsec.com

Friendly reminder… the 2025 OWASP Top 10 should be dropping at the end of this week!

SeanWrightSec
@seanwrightsec.com

This is a really tough time of the year for me. I lost my own father 7 years ago. And while it does become easier to cope over time, it’s still difficult. What makes it harder this time is seeing people celebrating the death of someone else’s father all because they don’t agree with their viewpoints

SeanWrightSec
@seanwrightsec.com

Great article by @jpmjr.bsky.social on @reversinglabs.com blog. Thank you for including my comments. It’s going to be an interesting time ahead with AI now playing a larger role in development. www.reversinglabs.com/blog/modern-...

reversinglabs.comThe state of software development: 5 action items for AppSec teams | ReversingLabsApplication security pros need to be ready to cope with security at the speed of code. Here's how to get a handle on modern software risk.
SeanWrightSec
@seanwrightsec.com

I’ve given this advice to several folk, and it’s worth sharing with others. Learning how to become comfortable with not knowing something is liberating. It’ll help give you the confidence to then do something about it.

SeanWrightSec
@seanwrightsec.com

This is so important in our field as we have a constant barrage of new things (technology, attack types, etc). It’s not an easy thing to do, and does take time. But once you are at peace with it, it’ll help things for the better.

SeanWrightSec
@seanwrightsec.com

While having something showing the likelihood of a vuln being exploited is good, I do worry this will end up being just another metric. I hope that I’m wrong, and this will prove helpful. www.darkreading.com/vulnerabilit...

darkreading.comNIST's LEV Equation to Rate Chances a Bug Was ExploitedThe new equation, introduced by the National Institute of Standards and Technology (NIST), aims to offer a mathematical likelihood index that could be a game-changer for SecOps teams and vulnerability...
SeanWrightSec
@seanwrightsec.com

A really important reason why it’s important to have security tooling working and operating as you expect. It’s already difficult to get other teams to buy into these tools so when they are constantly “wrong”, getting those teams onboard is almost impossible.

SeanWrightSec
@seanwrightsec.com

Important to note that CVE is not a database per se. This is why we have the likes of NVD. So if anything, ENISA would be competing with NVD. But I still have concerns of how this may fragment the ecosystem.

Patrick C Miller@patrickcmiller.bsky.social

New EU vulnerability database will complement CVE program, not compete with it, says ENISA

buff.lyNew EU vulnerability database will complement CVE program, not compete with it, says ENISAAfter the CVE’s program’s near-death experience in April, might the Europeans be looking for a more reliable long-term system?
SeanWrightSec
@seanwrightsec.com

One key item of security is accountability. Without it, there’s no single person to go to get a system patched. Processes and procedures don’t get revised or updated. The same procedures and processes are not followed. And the list goes on.

SeanWrightSec
@seanwrightsec.com

A hard coded JWT. This is weird (and not mention extremely poor secure coding), never seen a hard coded JWT. These typically have a limited lifetime. This makes me think there might also be a bit more to this. sec.cloudapps.cisco.com/security/cen...

sec.cloudapps.cisco.comCisco Security Advisory: Cisco IOS XE Wireless Controller Software Arbitrary File Upload VulnerabilityA vulnerability in the Out-of-Band Access Point (AP) Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbit...
SeanWrightSec
@seanwrightsec.com

This may actually be a good model to follow instead. Being reliant on a single source has its obvious risks. This is somewhat similar to Let’s Encrypt in some sense, and look at how that turned out and the change it is having. Perhaps this is a better path forward?

Daniel Cuthbert@dcuthbert.bsky.social

Positive www.thecvefoundation.org Without the CVE process, we don't have any real way, besides legislation (which I'm arguing will help too) to keep vendors honest and hold them to account. Here's hoping good comes out of recent events

thecvefoundation.orgCVE FoundationFOR IMMEDIATE RELEASE April 16, 2025 CVE Foundation Launched to Secure the Future of the CVE Program [Bremerton, Washington] – The CVE Foundation has been formally established to ensure the long-term ...
SeanWrightSec
@seanwrightsec.com

Another great writeup by @kateoflaherty.bsky.social. Thank you for including my comments. I think it’s important to avoid speculation at this stage and wait for the details to come out. And then take it from there. Who knows what the eventual outcome may be.

Kate O'Flaherty@kateoflaherty.bsky.social

New on @forbes.com What does the CVE funding cut mean? Thanks @phat-hobbit.bsky.social and @seanwrightsec.com www.forbes.com/sites/kateof...

forbes.comCVE Program Funding Cut—What It Means And What To Do NextU.S. President Donald Trump has cut funding for the global database of security flaws, the Common Vulnerabilities and Exposures database. Here's what you need to know.
SeanWrightSec
@seanwrightsec.com

Already seen a lot of confusion going on. It’s important to understand that Mitre does not operate the National Vulnerability Database (NVD). While NVD does ingest CVE’s from Mitre, it does not operate this database…

View full thread
SeanWrightSec
@seanwrightsec.com

So the recent news about Mitre’s contract would likely only affect new vulnerabilities. Historical vulnerabilities should not be affected. It’s important to call this distinction out, as there’s already been some confusion.

SeanWrightSec
@seanwrightsec.com

While not great, hopefully we will be able to find out further details in the next couple of days. Also important, it’s the NVD team that enriches the CVE (e.g. assign a CVSS score).

SeanWrightSec
@seanwrightsec.com

Already seen a lot of confusion going on. It’s important to understand that Mitre does not operate the National Vulnerability Database (NVD). While NVD does ingest CVE’s from Mitre, it does not operate this database…