Sam Stepanyan :verified: 🐘

https://twitter.com/securestep9

#OWASP London Chapter Leader(OWASP London (npub1ra0…shgr)). Application Security (#AppSec) Architect & Consultant. OWASP Global Board Member. OWASP Nettacker Project co-leader. #CISSP

Blog: https://medium.com/@securestep9

Public Key

npub1gr8f0c2al23r8wpv2v7vt2na36g3xnpz06pceqhrysmlg8gahyjqp9gp67

NIP-05 Address

securestep9_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsypn5hu9wl4g3nhqk9x0x94f7caygnfs38aquvst3jgdl5r5wmjfqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsz6pw4d

Publishing to

nostr.mom

nos.lol

Author Public Key

npub1gr8f0c2al23r8wpv2v7vt2na36g3xnpz06pceqhrysmlg8gahyjqp9gp67

Show more details

Last Notes

2026-10-09 18:22:16 UTC

#Anthropic launches FREE AI-powered vulnerability scanning service for established #opensource projects that have a critical impact on infrastructure and user security.
🔍 Periodic scans using Claude Mythos
🤖 Fully AI-generated reports
#AppSec
👇
https://thehackernews.com/2026/10/anthropic-launches-free-ai.html

2026-10-09 14:42:56 UTC

#GitHub repos hit by a new supply chain attack - GhostAction attackers compromised maintainer accounts and injected malware into 346 repositories, including #Uber's athenadriver stealing cloud&AI credentials, CI/CD secrets:
#SoftwareSupplyChainSecurity
👇
https://socket.dev/blog/ghostaction-cloud-credentials

2026-09-30 13:29:51 UTC

#AI coding agents asked for review screenshots leaked internal images in public #GitHub repos, researchers say.
Researchers counted 13,000+ images at 300+ orgs, including customer billing records!
#AISecurity
👇 https://thehackernews.com/2026/09/ai-coding-agents-exposed-13000-internal.html

2026-09-25 07:49:35 UTC

Well, good morning #ChatGPT! It's Friday, so you decide to crash with this verbose production error:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/330/580/315/181/067/original/f27c0c286f6e2fc5.png

2026-09-22 18:48:25 UTC

Why “We Patched #WordPress Last Week” Is Not Enough: WordPress has urgently released v7.1.2 for a critical core #vulnerability: an unauthenticated attacker can make template resolution include a chosen local PHP file and in some conditions, achieve RCE:
👇
https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html

2026-09-19 16:07:05 UTC

#WordPress admin clicks a link. WordPress clicks Install.
“Click2Shell” abuses the admin’s logged-in session to silently install an attacker-chosen theme. Chain it with a vulnerable theme: server-side PHP execution.
Patch WordPress core to 7.1.1 now! 👇
https://thehackernews.com/2026/09/new-wordpress-click2shell-flaw-forces.html

2026-08-25 08:27:29 UTC

#AI: Zero-click Grok and Gemini chat history theft possible using cryptographic context injection technique that bypasses AI safety filters - demonstrated by @Adversa_AI:
#AISecurity
👇
https://securityaffairs.com/197717/hacking/zero-click-grok-chat-history-theft-adversa-ai-demonstrates-cryptographic-context-injection.html

2026-08-07 18:57:23 UTC

#Wordpress: A Critical pre-auth #XSS to RCE vulnerability chain (CVE-2026-64638) dubbed #XSS2Shell is affecting all versions of WordPress Core. This vulnerability was discovered by AI (@pwn_ai). Patch to v7.0.3 ASAP - older versions backported:
👇
https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html

2026-08-04 19:48:29 UTC

#npm: A massive #SupplyChain attack has compromised 868+ npm packages carrying 2 billion+ monthly installs with a credential-stealing worm.
It started with the compromise of the #GitHub account of the #keyv library with 127 million+ weekly downloads:
👇
https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack

2026-07-31 11:27:12 UTC

#VMware: three critical #vulnerabilities in VMware vCenter, ESX, Workstation, and Fusion, allow attackers to bypass authentication, execute arbitrary code, or escape from a virtual machine to the host. Patches released by Broadcom - it's time to patch!
👇
https://www.bleepingcomputer.com/news/security/vmware-fixes-three-critical-flaws-allowing-auth-bypass-vm-escapes/

2026-07-30 08:51:01 UTC

#XSS vulnerability is still causing havoc in 2026. XSS flaw in Microsoft Outlook Web Access (OWA) CVE-2026-42897 is actively exploited by attackers who target U.S. and EU government entities, telecommunications, financial, hospitality, aerospace:
👇
https://thehackernews.com/2026/07/russian-hackers-exploit-microsoft-owa.html

2026-07-27 21:44:35 UTC

#AI: Comparing Open-Source AI Code Security Harnesses - a useful blog post from @npub1l6z…2ry3 - some interesting approaches are emerging:
👇
https://semgrep.dev/blog/2026/comparing-open-source-ai-code-security-harnesses/

2026-07-27 11:28:42 UTC

#AI: A Reddit post this weekend revealed that hundreds of #Claude AI shared chats were publicly discoverable through Google. Users searching queries such as 'site:claude[.]ai/share' could access Claude's users' conversations:
#AISecurity
👇
https://cybersecuritynews.com/claude-ai-shared-chats/

2026-07-26 11:28:29 UTC

#Windows: if you haven't patched your MS Windows estate with July Patch Tuesday updates, now it's time to do it! #CertiGhost CVE-2026-54121 vulnerability allows an unprivileged user on your network to fully compromise the Active Directory and the Proof-of-Cocept (#POC) is out:
👇
https://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.html

2026-07-08 13:52:14 UTC

#AI: GitHub AI allows unauthenticated attackers to pull data from private repositories by posting a crafted GitHub Issue in a public repository. Noma Security research dubbed this prompt injection attack #GitLost:
#AISecurity
👇
https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/

2026-06-09 11:11:23 UTC

#LiteLLM command injection vulnerability CVE-2026-42271 that could allow any authenticated user to run arbitrary commands on the host, has been added to the CISA KEV catalog:
👇
https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html

2026-05-14 12:57:14 UTC

#NGINX: An 18-year-old RCE vulnerability CVE-2026-42945 in the rewrite module enables server takeover. Update to NGINX 1.31.0 or 1.30.1 immediately!
👇
https://thehackernews.com/2026/05/18-year-old-nginx-rewrite-module-flaw.html

2026-05-05 11:44:10 UTC

#WhatsApp Vulnerability CVE-2026-23866 Lets Attackers Leverage Instagram Reels to Execute Malicious URLs:
👇
https://cybersecuritynews.com/whatsapp-vulnerability-leverage-instagram-reels/

2026-03-24 15:52:06 UTC

#LiteLLM Compromised! LiteLLM - a popular Python Library used by a lot of AI tooling got compromised on PyPI, and the malicious versions are stealing everything they can find on your machine:
#SoftwareSupplyChainSecurity
👇
https://www.xda-developers.com/popular-python-library-backdoor-machine/

2026-01-07 17:43:51 UTC

#jsPDF: Critical Path Traversal Vulnerability (CVE-2025-68428) in jsPDF - a widely-adopted #npm package for generating PDF documents in JavaScript applications allows attackers to read & exfiltrate arbitrary files from the local filesystem:
👇
https://www.endorlabs.com/learn/cve-2025-68428-critical-path-traversal-in-jspdf

2025-08-21 09:06:31 UTC

⚠️#Docker: If you are using Docker for Desktop you need to update it TODAY to v4.44.3. Critical CVE-2025-9074 #vulnerability in previous versions allows malicious containers to access host system:
👇
https://www.heise.de/en/news/Docker-Desktop-Critical-vulnerability-allows-host-access-10560707.html

2025-06-27 07:55:38 UTC

#CISCO: Critical severity CVSS 10 CVE-2025-20281 and CVE-2025-20282 vulnerabilities allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root! Updates released - patched now:
👇
https://thehackernews.com/2025/06/critical-rce-flaws-in-cisco-ise-and-ise.html

2025-06-27 07:21:25 UTC

Actively exploited vulnerability in CVE-2024-54085 in AMI MegaRAC gives attackers extraordinary control over server fleets by allowing a remote attacker to create an admin account without any authentication:
👇
https://arstechnica.com/security/2025/06/active-exploitation-of-ami-management-tool-imperils-thousands-of-servers/

2025-05-16 07:13:54 UTC

CISA Warns of #Google Chromium #ZeroDay Vulnerability CVE-2025-4664 Actively Exploited in the Wild affecting #Chrome, MS #Edge and Opera – Make sure to update your browser to the latest version today!
👇
https://cybersecuritynews.com/cisa-warns-of-google-chromium-vulnerability-actively-exploited-in-the-wild/

2025-05-05 09:30:48 UTC

#Webmin: a critical security vulnerability discovered in a widely-used web-based system administration tool, allowing authenticated attackers to escalate privileges to root level and execute code.
Caused by CRLF injection: CVE-2025-2774 (CVSS 8.8)
👇
https://cybersecuritynews.com/webmin-vulnerability-escalate-privileges/

2025-04-30 07:52:03 UTC

#Mozilla: Multiple Vulnerabilities in Mozilla Products (Firefox, Firefox Updater, Thunderbird) Could Allow for Arbitrary Code Execution:
CVE-2025-2817, CVE-2025-4082, CVE-2025-4083:
👇
https://www.mozilla.org/en-US/security/advisories/mfsa2025-28/

2025-04-17 07:39:39 UTC

#CISA Warns of Credential Risks Tied to #Oracle Cloud Breach:
👇
https://securityonline.info/cisa-warns-of-credential-risks-tied-to-oracle-cloud-breach/

2025-02-18 09:04:31 UTC

#LibreOffice: patches two #vulnerabilities allowing arbitrary file writes & remote data extraction from environment variables & configuration files. CVE-2024-12425 & CVE-2024-12426 require no user interaction beyond opening a malicious document containing a malicious font or an image:
👇
https://securityonline.info/libreoffice-vulnerabilities-cve-2024-12425-cve-2024-12426-pocs-released-patch-asap/

2024-12-27 20:56:36 UTC

#PaloAlto: firewalls are being rebooted en-masse into maintenance mode remotely by attackers actively exploiting CVE-2024-3393 vulnerability by sending a malicious DNS packet to the target device.
Patched PanOS versions now available:
👇
https://www.bleepingcomputer.com/news/security/hackers-exploit-dos-flaw-to-disable-palo-alto-networks-firewalls/

2024-10-31 14:27:14 UTC

#Strava: Fitness app Strava gives away location of Biden, Trump and other leaders, French newspaper says:
https://apnews.com/article/biden-trump-macron-bodyguards-security-strava-0a48afca09c7aa74d703e72833dcaf72