SirAppSec
34 posts
SirAppSec
@SirAppSec
Web Application Security Engineer
Tel Aviv, Israel Katılım Ağustos 2021
114 Takip Edilen22 Takipçiler
SirAppSec retweetledi
Last night my wife asked me to install a “cute little npm package” she found on GitHub.
I checked the code.
No lockfile. No 2FA. Seven maintainers with anime avatars. Last commit was “pls work” from 2019. Published from a username that looked like a WiFi password.
The package had 57 transitive dependencies maintained by 119 people and 3 nation-state adversaries.
One dependency pulled in a prebuilt binary from a phpBB forum hosted on the dark web.
Another tried to contact an IP that belongs to a guy named “Big Ron.”
She said “babe it’s fine.”
I said “that’s what people say right before a supply chain incident.”
She went to bed annoyed.
I went to bed with a clean SBOM.
We all make choices.
IT Unprofessional@it_unprofession
Last week I hosted family for Thanksgiving. My 12-year-old nephew asked for the WiFi password. He wanted to play Roblox on his iPad. I looked at the device. Unmanaged. No antivirus. No encryption. I’m an IT Professional. I don't run an open network. So I didn’t give him the password. Instead, I spent 45 minutes provisioning a Guest VLAN. I set up a captive portal. I throttled the bandwidth down to 56kbps. Then I blocked all traffic on ports 80 and 443. He came back crying. He said it wouldn't load. My sister screamed at me to "just let him play." I told her that Zero Trust architecture doesn't care about bloodlines. We didn't have a "fun" Thanksgiving. But we had a secure perimeter. You’re welcome for the compliance.
English
thanksgiving 2021: log4shell
thanksgiving 2025: react2shell
some things never change...
Sylvie@_sy1vi3
react2shell:11/29/25:lachlan2k:sy1vi3 sha256:18571097aedaec16f729c4227e1e508fe161d5d6b4256eec7d0525535ebb3fa0 cve.org/CVERecord?id=C…
English
The watchTowr team is reacting to CVE-2025-55182, a critical pre-auth RCE (CVSS 10) vulnerability in React - used by Next.js, Remix, and others.
In-the-wild exploitation is imminent - immediate action is necessary.
Need to understand your exposure? watchTowr.com
English
SirAppSec retweetledi
There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it.
A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
react.dev/blog/2025/12/0…
English
Is your AI coding agent a security expert?
20+ Claude Code skills:
SAST • DAST • SCA • Secrets • Containers • Policy • Offensive Security - and more!
Looking for testers and contributors 👀
github.com/AgentSecOps/Se…
#DevSecOps #AI #Security #OpenSource #AgentSecOps
English
SirAppSec retweetledi
It's time! @BSidesLV 2025 is happening, and so is Pros V Joes! It's going to be awesome, and we want YOU to sign up as a Joe or a Pro!! @PvJRedCell @PvJGoldTeam
Joes: forms.gle/pdDTs9ft8PWG2c…
Pros: forms.gle/9LDubL8mNTBjvR…
August 4 & August 5
August 6 - with post-game debrief
GIF
English
SirAppSec retweetledi
🚨New giveaway alert🚨 We are giving away some vouchers for @offsectraining
* 1x PEN-200 Course and Cert exam bundle (OSCP)
* 1x Learn Fundamentals Subscription
* 1x Annual PG Practice access
Read the full post to learn How to participate:
1⃣Subscribe to our youtube channel (@BugBountyVillage" target="_blank" rel="nofollow noopener">youtube.com/@BugBountyVill…)
2⃣Follow us on tiktok (@bugbountydefcon" target="_blank" rel="nofollow noopener">tiktok.com/@bugbountydefc…)
3⃣Like ❤️ and retweet 🔁this post.
This is one of the biggest giveaways we have ever made. We will select 3 winners. Total value of these rewards is around $3.000 USD in value 😱. Thanks @offsectraining for providing these ❤️!
Note: You need to be 18 or older to claim the rewards!
We will announce winners here on Friday 5/16.
Good luck!
English
SirAppSec retweetledi
It's time! @BSidesNYC 2024 is happening, and so is Pros V Joes! We are going to be onsite, it's going to be awesome, and we want YOU to sign up as a Joe or Pro! Apply here! Apply Now!
Pro reg: tinyurl.com/BSIDES-NYC-PRO…
Joe reg: tinyurl.com/BSIDES-NYC-JOE…
prosversusjoes.net
English
SirAppSec retweetledi
Got to take part in the Pros vs Joes CTF in #BSidesLV 2023 where I got to defend hack and code systems and applications during the conference.
This tool was made just before the competition as prep, it monitors sensitive live file changes
github.com/SirAppSec/file…
English
SirAppSec retweetledi
New: we proved it could be done. I used an AI replica of my voice to break into my bank account. The AI tricked the bank into thinking it was talking to me. Could access my balances, transactions, etc. Shatters the idea that voice biometrics are foolproof vice.com/en/article/dy7…
English
@meijin007 למה אתה צריך לכתוב הוכחה מתמטית כל פעם שאתה עושה חשבון פשוט?
עברית
