Sam Stepanyan

Sam Stepanyan

@securestep9.bsky.social

OWASP London Chapter Leader. #OWASP Global Board Member. OWASP #Nettacker Project Leader. #AppSec Consultant, #CISSP. Follow me on Twitter/X and Mastodon https://twitter.com/securestep9 https://infosec.exchange/@securestep9

1K followers127 following366 posts

Sam Stepanyan
@securestep9.bsky.social

A leaked #LiteLLM master key helped attackers steal #GitHub tokens and poison software releases. The post-mortem of the attack is a fascinating read, particularly if you are using GitHub: 👇 #AppSec #SoftwareSupplyChainSecuritu thehackernews.com/2026/10/leak...

thehackernews.comLeaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release PipelineAn unrevoked LiteLLM master key enabled GitHub token theft and a malicious PyPI release that steals credentials and installs a backdoor.
Sam Stepanyan
@securestep9.bsky.social

Running #NodeJS? #Node2Shell (CVE-2026-111497) can turn malicious Brotli-compressed data into #RCE (Remote Code Execution). Upgrade #Node to 22.23.4, 24.22.1 or 26.12.1 and rebuild your containers. #AppSec 👇

aikido.devNode2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) and the fixNode.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix.
Sam Stepanyan
@securestep9.bsky.social

#LiteLLM compromised AGAIN! LiteLLM v1.107.0 on #PyPI carries a remote code execution backdoor and a credential stealer which steals Cloud and AI credentials. #Malware runs at Python startup, no import needed. #SoftwareSupplyChainSecurity 👇

thehackernews.comLiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and BackdoorCompromised LiteLLM 1.107.0 packages run a credential stealer at Python startup and can fetch and execute additional code.
Sam Stepanyan
@securestep9.bsky.social

🚨 #PHP2Shell: Two critical #PHP flaws (CVE-2026-109618 & CVE-2026-109619) allow unauthenticated #RCE! #WordPress, #Drupal, #Magento and countless web apps may be exposed. PHP powers 69% of websites. Emergency patches are OUT. Update PHP now! 👇

laravel-news.comPHP Security Releases Fix Two Critical RCE VulnerabilitiesPHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two critical vulnerabilities that allow unauthenticated remote code execution. Here's who's at risk and how to update…
Sam Stepanyan
@securestep9.bsky.social

Global #HTTPS trust incident! #eMudhra, an Indian Certificate Authority trusted worldwide, issued 8 CA certificates with trivially weak private keys. Impact: forged HTTPS certificates, website impersonation & risks beyond browsers. 👇

bleepingcomputer.comMozilla, Google, Apple block compromised eMudhra CA certificatesCertificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites.
Sam Stepanyan
@securestep9.bsky.social

#NPM - A malicious npm package 'imgdecode' hides a Windows DLL that downloads encrypted shellcode from GitHub and injects it into "dllhost.exe". One "require()" could compromise a developer’s machine: #SoftwareSupplyChainSecurity 👇 thehackernews.com/2026/10/malf...

thehackernews.comMALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native AddonThe MALFEX-linked npm package imgdecode uses a Windows DLL to fetch and decrypt a GitHub payload before injecting it into dllhost.exe.
Sam Stepanyan
@securestep9.bsky.social

#Anthropic launches FREE AI-powered vulnerability scanning service for established #opensource projects that have a critical impact on infrastructure and user security. 🔍 Periodic scans using Claude Mythos 🤖 Fully AI-generated reports #AppSec 👇

thehackernews.comAnthropic Launches Free AI Vulnerability Scanner for Open-Source ProjectsAnthropic's opt-in OSS Scanner offers free, periodic AI vulnerability scans for open-source projects, with no human review required for reports
Sam Stepanyan
@securestep9.bsky.social

#GitHub repos hit by a new supply chain attack - GhostAction attackers compromised maintainer accounts and injected malware into 346 repositories, including #Uber's athenadriver stealing cloud&AI credentials, CI/CD secrets: #SoftwareSupplyChainSecurity 👇

socket.devNew GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud CredentialsA new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.
Sam Stepanyan
@securestep9.bsky.social

Using #Atlassian products like #Confluence, #Jira or #Bitbucket on-premise? Critical vulnerability CVE-2026-21589 (CVSS 9.3) lets unauthenticated attackers read known web-root files across 8 Atlassian products. Patch affected self-hosted instances now! 👇

thehackernews.comCritical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 ProductsAtlassian fixes a critical path traversal in 8 Data Center products that lets unauthenticated attackers read files if exact paths are known.
Sam Stepanyan
@securestep9.bsky.social

#MikroTik CVE-2026-84411 is a 9.8 pre-auth root #RCE #vulnerability: one crafted HTTP request can execute code or crash RouterOS! Patched versions available. 367,000+ hosts expose the MikroTik RouterOS web interface directly to the internet. 👇 cybernews.com/securi...

Sam Stepanyan
@securestep9.bsky.social

#AI coding agents asked for review screenshots leaked internal images in public #GitHub repos, researchers say. Researchers counted 13,000+ images at 300+ orgs, including customer billing records! #AISecurity 👇 thehackernews.com/2026/09/ai-c...

thehackernews.comAI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHubGlow found over 13,000 internal images from 300+ organizations exposed in public GitHub repos during AI-assisted code reviews.
Sam Stepanyan
@securestep9.bsky.social

Why “We Patched #WordPress Last Week” Is Not Enough: WordPress has urgently released v7.1.2 for a critical core #vulnerability: an unauthenticated attacker can make template resolution include a chosen local PHP file and in some conditions, achieve RCE: 👇

thehackernews.comWordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some ServersWordPress fixes a critical unauthenticated path traversal flaw that can load local PHP files and, on some servers, enable code execution.
Sam Stepanyan
@securestep9.bsky.social

#WordPress admin clicks a link. WordPress clicks Install. “Click2Shell” abuses the admin’s logged-in session to silently install an attacker-chosen theme. Chain it with a vulnerable theme: server-side PHP execution. Patch WordPress core to 7.1.1 now! 👇

thehackernews.comNew WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code ExecutionWordPress 7.1.1 fixes Click2Shell, which can force theme installs from crafted links and was chained with a theme flaw for code execution.
Sam Stepanyan
@securestep9.bsky.social

A supply-chain attack became a #databreach. Malicious TanStack npm packages stole a GitHub token from an ex-CrowdSec employee whose access remained active. Attackers copied ~170 private repos and exposed data on 83 users and 51 potential investors: 👇

thehackernews.comCrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub RepositoriesCrowdSec says a TanStack-linked GitHub token was used to copy about 170 private repositories from a former employee’s account.
Sam Stepanyan
@securestep9.bsky.social

Fintech company #Revolut has disclosed a #databreach after sharing KYC customer PII data (names, addresses, scanned passports, driving licenses, photos, IBAN bank account numbers & statements) with a threat actor impersonating a government agency: 👇

bleepingcomputer.comRevolut discloses data breach exposing financial info, passportsFintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency.

Sam Stepanyan reposted

OWASP London Chapter
@owasplondon.bsky.social

The next OWASP London Chapter meetup [IN-PERSON] will take place on September 28th 2026 at 6pm. Talks from Chris Holman and Glyn Wintle. This event is kindly hosted by @Civo tech Junction and kindly sponsored by @aikidosecurity.bsky.social Register to attend here: 👇

eventbrite.co.ukOWASP London Chapter meetup [IN-PERSON]Join us to learn from expert speakers, network with like-minded professionals and stay ahead in the ever-evolving world of Cyber Security
Sam Stepanyan
@securestep9.bsky.social

#OWASP GenAI Security Project publishes the "project Crosswalk" - an open-source resource which maps AI risks to compliance requirements from 25 regulatory frameworks NIST, ISO, #MITRE ATLAS, the EU #AI Act and others: #AISecurity 👇

genai.owasp.orgGenAI Security Industry Framework CrosswalkThe OWASP GenAI Security Project Crosswalk is an open-source resource that connects OWASP GenAI security risks to established industry security, governance, and compliance frameworks. It maps 51 GenAI vulnerabilities across four  source lists to controls in 25 frameworks, including NIST, ISO, MITRE ATLAS, the EU AI Act and others. Organizations can use the crosswalk to […]
Sam Stepanyan
@securestep9.bsky.social

#WhatsApp: German law enforcement agencies are using features built into apps such as WhatsApp, Signal, #Telegram to monitor people’s messages without breaking their #encryption or installing spyware on the phones - see Netzpolitik report: 👇 cybernews.com/privacy/poli...

cybernews.comGerman police read WhatsApp messages without cracking encryption45 days of Signal history may be exposed by German police messaging surveillance using linked devices, Netzpolitik says. Read what the documents reveal
Sam Stepanyan
@securestep9.bsky.social

This is what modern #AgenticCybercrime looks like. ShinyHunters-linked group used Claude in an automated pipeline that decompiled & scanned 1.8M Android APKs for hardcoded secrets. #AI-assisted cybercrime is moving from prompts to scalable workflows. 👇

bleepingcomputer.comHackers abused Claude to extract secrets from 1.8M Android appsAnthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes.
Sam Stepanyan
@securestep9.bsky.social

#Mikrotik - if you are using Mikrotik routers you should immediately upgrade to the latest version due to the undisclosed security #vulnerability in RouterOS. Fixes included in versions: * 7.25 beta 3 * 7.24.2 * 7.23.4 * 6.49.21 Vendor advisory: mikrotik.com/supportsec/s...

mikrotik.comMikroTikMikroTik makes networking hardware and software, which is used in nearly all countries of the world. Our mission is to make existing Internet technologies faster, more powerful and affordable to wider...
Sam Stepanyan
@securestep9.bsky.social

#JFrog #Artifactory: Attackers are already exploiting critical auth bypass CVE-2026-82329 (CVSS 9.8) to mint admin tokens. Compromising your organisation's artifact repository could poison builds and trigger #SoftwareSupplyChain attacks - patch now! 👇

csoonline.comExploited JFrog Artifactory bug puts software supply chain on alertThe bug is already being exploited in the wild, allowing attackers to generate admin tokens and gain access to Artifactory, the platform that powers many organization’s software supply chains.
Sam Stepanyan
@securestep9.bsky.social

Manchester Airports Group #databreach was caused by the API keys simply #hardcoded in the front-end JavaScript files: something I see a lot recently in AI vibe-coded applications and in the pre-AI era in poorly coded applications which visibly look & work fine before a pentest: x.com/IntCyberDige...

Sam Stepanyan
@securestep9.bsky.social

#GCP: A comment on a single public #GitHub repo issue (gemini-cli 100k+ stars) was enough for an unauthenticated attacker to take over a Google Cloud project abusing Workload Identity Federation(WIF) in exploit chain - great research from @Pillar_sec : 👇 www.pillar.security/blog/a-wif-o...

pillar.securityA WIF Of Fresh Access: How a GitHub Issue on Gemini-CLI Led to GCP Project CompromisePillar Security researchers chained a leaked OIDC credentials file and a broken tool allowlist in Google's run-gemini-cli GitHub Action to escalate a public GitHub issue prompt injection into full Edi...
Sam Stepanyan
@securestep9.bsky.social

#AI: Zero-click Grok and Gemini chat history theft possible using cryptographic context injection technique that bypasses AI safety filters - demonstrated by @Adversa_AI: #AISecurity 👇 securityaffairs.com/197717/hacki...

securityaffairs.comZero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context InjectionNew Cryptographic Context Injection technique bypasses AI guardrails via AES-encrypted payloads, leaking full Grok chat histories zero-click
Sam Stepanyan
@securestep9.bsky.social

Iran-linked #hackers behind cyber attack that shut down UK power plant for 4 days, reports say. For security reasons, neither the government nor the National Cyber Security Centre(NCSC), would give further details of the site affected: #CyberAttack 👇 www.bbc.co.uk/news/article...

bbc.co.ukIran-linked hackers behind cyber attack that shut down power plant, reports sayThe government says at no point was there a risk to the UK's energy system during the attack in July.
Sam Stepanyan
@securestep9.bsky.social

#Rust supply-chain attack: the popular `arrayref` crate (245mln downloads) was compromised to run a remote payload at build time. Simply running `cargo build` was enough to get infected: #SoftwareSupplyChainSecurity 👇 www.stepsecurity.io/blog/arrayre...

stepsecurity.ioRust Supply-Chain Attack: arrayref 0.3.10 and the proc-macro1 Typosquat Execute a Remote Payload at Build Time - StepSecurityThe Rust crate arrayref 0.3.10 is compromised: it pulls in the typosquatted proc-macro1 1.0.107, whose build script downloads and runs a remote binary at build time. Full technical analysis: timeline,...
Sam Stepanyan
@securestep9.bsky.social

#WordPress: Yet another AI-discovered(@pwn_ai) Critical WordPress #RCE #Vulnerability CVE-2026-65640 Allows Authors to Execute Code via Malicious PNG File (via Imagemagick). Patched WordPress version 7.0.4 is now available, older versions backported: 👇 cybersecuritynews.com/wordpress-im...

cybersecuritynews.comCritical WordPress RCE Vulnerability Allows Authors to Execute Code via Malicious PNG FileWordPress has released version 7.0.4, a security-focused update that closes a remote code execution vulnerability affecting sites that process images with the Imagick extension and Ghostscript.
Sam Stepanyan
@securestep9.bsky.social

#Wordpress: A Critical pre-auth #XSS to RCE vulnerability chain (CVE-2026-64638) dubbed #XSS2Shell is affecting all versions of WordPress Core. This vulnerability was discovered by AI (@pwn_ai). Patch to v7.0.3 ASAP - older versions backported: 👇 thehackernews.com/2026/08/new-...

thehackernews.comNew WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAPWordPress fixes CVE-2026-64638, a pre-auth login XSS affecting every version, with a demonstrated path to PHP execution under specific conditions.
Sam Stepanyan
@securestep9.bsky.social

#Linux: a 13-year-old Linux kernel flaw dubbed #OVSWrap lets local users gain root privileges on most Linux distributions. CVE-2026-64531 vulnerability is in the Linux kernel’s Open vSwitch datapath: #PrivilegeEscalation 👇 securityaffairs.com/196657/hacki...

securityaffairs.comOVSwrap: 13-Year-Old Linux Kernel Flaw Lets Local Users Become RootOVSwrap is a 13-year-old Linux kernel flaw that lets local users gain root privileges on most distributions using Open vSwitch.
Sam Stepanyan
@securestep9.bsky.social

#OWASP releases OWASP Top 10 for LLM Applications 2026 - the latest community-driven guide to the most critical security risks facing applications powered by Large Language Models: 👇

genai.owasp.orgOWASP GenAI LLM Top 10 2026OWASP Top 10 for LLM Applications 2026 is the latest community-driven guide to the most critical security risks facing applications powered by large language models. Developed by hundreds of AI security experts, this edition introduces updated rankings, expanded threat coverage, and new research grounded in thousands of real-world AI security incidents. The guide provides practical […]
Sam Stepanyan
@securestep9.bsky.social

#npm: A massive #SupplyChain attack has compromised 868+ npm packages carrying 2 billion+ monthly installs with a credential-stealing worm. It started with the compromise of the #GitHub account of the #keyv library with 127 million+ weekly downloads: 👇 www.aikido.dev/blog/keyv-an...

aikido.devKeyv and friends compromised in npm supply chain attackMini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account
Sam Stepanyan
@securestep9.bsky.social

Imagine finding a master key that can create the keys to access almost every Azure Cosmos DB instance on the planet. That's essentially what #CosmosEscape achieved. One of the most fascinating recent cloud security bugs: #CloudSecurity 👇 www.wiz.io/blog/cosmose...

wiz.ioCosmosEscape: Taking Over Every Azure Cosmos DB | Wiz BlogWiz Research details CosmosEscape, a critical vulnerability in Azure Cosmos DB that granted full read/write access to every database. Now fully remediated.