Sam Stepanyan
LightNews LightNews
banner
securestep9.bsky.social
Sam Stepanyan
@securestep9.bsky.social
990 followers 120 following 200 posts
OWASP London Chapter Leader. #OWASP Global Board Member. OWASP #Nettacker Project Leader. #AppSec Consultant, #CISSP. Follow me on Twitter/X and Mastodon https://twitter.com/securestep9 https://infosec.exchange/@securestep9
Posts Replies Media Videos
securestep9.bsky.social
#TrustWallet: in a potential supply chain attack TrustWallet browser extension is compromised in the latest update with injected malicious code quietly sending the wallet's seed phrase to malicious domain named "metrics-trustwallet(.)com"- registered only a few days ago
👇
www.ccn.com/education/cr...
How Trust Wallet Crypto Users Lost $6M+ in a Browser Extension Incident
$6M+ in BTC, ETH, and SOL was lost via a Trust Wallet browser extension incident, prompting an urgent user warning.
www.ccn.com
December 26, 2025 at 7:53 AM
securestep9.bsky.social
#MongoDB and MongoDB Server multiple versions are vulnerable to Remote Code Execution (#RCE) #vulnerability CVE-2025-14847 and may be abused by unauthenticated threat actors in low-complexity attacks that don't require user interaction. Patch now!
👇
www.bleepingcomputer.com/news/securit...
MongoDB warns admins to patch severe RCE flaw immediately
MongoDB has warned IT admins to immediately patch a high-severity vulnerability that may be exploited in remote code execution (RCE) attacks targeting vulnerable servers.
www.bleepingcomputer.com
December 26, 2025 at 6:47 AM
Reposted by Sam Stepanyan
owasp.org
🎉 Big news! Early Bird tickets for OWASP Global AppSec Vienna 2026 are here!
25 years of OWASP ✨ Stunning Vienna 🇦🇹 World-class training 🧠 & a conference like no other 🔥
Why wait? Register now for early bird pricing: owasp.glueup.com/eve...
#appsec #owasp #cybersecurity #securebydesign
December 19, 2025 at 2:48 PM
securestep9.bsky.social
#n8n: Critical CVSS 10.0 Remote Code Execution (#RCE) #Vulnerability in n8n via expression injection. Users advised to upgrade to version 1.122.0 or later immediately:

github.com/n8n-io/n8n/s...
Remote Code Execution via Expression Injection
### Impact n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users dur...
github.com
December 21, 2025 at 9:51 AM
securestep9.bsky.social
#Gemini Zero-Click #Vulnerability Let Attackers Access Gmail, Calendar, and Docs. No clicks or warnings were needed. An attacker simply shared a poisoned Google Doc, Calendar invite, or email embedding hidden prompt injections.
#AISecurity
👇 cybersecuritynews.com?p=135749
Gemini Zero-Click Vulnerability Let Attackers Access Gmail, Calendar, and Docs
A critical zero-click vulnerability dubbed "GeminiJack" in Google Gemini Enterprise and previously Vertex AI Search that let attackers siphon sensitive corporate data from Gmail, Calendar, and Docs wi...
cybersecuritynews.com
December 12, 2025 at 8:20 AM
securestep9.bsky.social
If you missed @shehackspurple.bsky.social 's talk "30 Tips for Secure #JavaScript" at the @owasplondon.bsky.social meetup last week - you can watch the recording on the #OWASPLondon YouTube channel [please subscribe!]:
December 8, 2025 at 12:24 AM
securestep9.bsky.social
#Swiss government urges citizens to ditch #Microsoft365 and other #Cloud providers due to lack of proper E2E encryption citing US Cloud Act requirement to hand over data to US authorities, even if it’s stored in Switzerland:
#DataSecurity
👇
www.techradar.com/pro/security...
Swiss government urges people to ditch Microsoft 365 and others due to lack of proper encryption
Switzerland is worried about data privacy
www.techradar.com
December 3, 2025 at 8:36 AM
securestep9.bsky.social
#Wordpress: 100,000+ WordPress Websites Affected by Remote Code Execution (#RCE) #vulnerability in Advanced Custom Fields Plugin:
👇

www.wordfence.com/blog/2025/12...
December 2, 2025 at 10:40 PM
securestep9.bsky.social
#VSCode: 24 malicious VS Code and #OpenVSX extensions are stealing developer credentials - spreading through popular names like Flutter, React, and Tailwind.

Full list of malicious VSCode extensions in the article below:
#SoftwareSupplyChainSecurity
👇
GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools
GlassWorm spreads again using 24 fake extensions across Visual Studio Marketplace and Open VSX, hiding Rust implants & Solana-based C2 to target devs.
thehackernews.com
December 2, 2025 at 3:17 PM
securestep9.bsky.social
#npm: Malicious NPM Package eslint-plugin-unicorn-ts-2 Uses Hidden Prompt and Script to Evade #AI Security Tools:
#SoftwareSupplyChainSecurity

👇
Malicious npm Package Uses Hidden Prompt and Script to Evade AI Security Tools
Malicious npm package mimics an ESLint plugin, embeds an AI-tricking prompt, and steals environment variables via a post-install script.
thehackernews.com
December 2, 2025 at 3:06 PM
securestep9.bsky.social
#OpenAI API Data Breach: OpenAI has disclosed a #databreach affecting some API customers due to a hack at third-party vendor #Mixpanel.
What was exposed: Names & Emails, Approximate Location, UserID/Org IDs
👇
OpenAI discloses API customer data breach via Mixpanel vendor hack
OpenAI is notifying some ChatGPT API customers that limited identifying information was exposed following a breach at its third-party analytics provider Mixpanel.
www.bleepingcomputer.com
November 27, 2025 at 4:42 PM
securestep9.bsky.social
#Maven: hundreds of packages just got caught running Shai-Hulud v2 - the same malware that hijacked npm two days ago.
It spread through automated rebuilds, infecting devs who never used npm stealing & leaking secrets across thousands of GitHub repos:
👇 thehackernews.com/2025/11/shai...
Shai-Hulud v2 Campaign Spreads From npm to Maven, Exposing Thousands of Secrets
Shai-Hulud v2 breached npm and Maven, impacting 28,000+ repos and leaking 11,858 secrets.
thehackernews.com
November 26, 2025 at 7:16 PM
Reposted by Sam Stepanyan
lirantal.com
You all should be starring this repo and following up on every npm security best practice: github.com/lirantal/npm...
GitHub - lirantal/npm-security-best-practices: Collection of npm package manager Security Best Practices
Collection of npm package manager Security Best Practices - lirantal/npm-security-best-practices
github.com
November 25, 2025 at 1:42 PM
Reposted by Sam Stepanyan
bkimminich.bsky.social
If you couldn't make it to German @owasp Day 2025 in person, you can watch the live stream here: media.ccc.de #owasp_god25
home - media.ccc.de
Video Streaming Portal des Chaos Computer Clubs
media.ccc.de
November 26, 2025 at 8:53 AM
securestep9.bsky.social
Over 80,000 files with #passwords and keys from governments, banks, and tech firms were found online pasted into public code tools like #JSONFormatter and #CodeBeautify.

Cybercriminals are already scraping and using the data.
And yes - it’s still live!
👇 thehackernews.com/2025/11/year...
Years of JSONFormatter and CodeBeautify Leaks Expose Thousands of Passwords and API Keys
Researchers uncovered 5GB of leaked credentials from JSONFormatter and CodeBeautify, exposing sensitive data across critical sectors.
thehackernews.com
November 25, 2025 at 11:52 PM
securestep9.bsky.social
#NPM: Second Shai-Hulud Infection Wave Affects 25,000+ Repositories via npm Preinstall Credential Theft:
#SoftwareSupplyChainSecurity
👇
Second Sha1-Hulud Wave Affects 25,000+ Repositories via npm Preinstall Credential Theft
Security vendors warn Sha1-Hulud has hijacked 25,000+ GitHub repos via npm packages, stealing cloud credentials or wiping dev home directories.
thehackernews.com
November 24, 2025 at 5:30 PM
Reposted by Sam Stepanyan
owasplondon.bsky.social
The next OWASP London Chapter in-person Meetup will take place on December 5th, 2025, kindly hosted by @tessl_io.
Raffle prizes sponsored by @semgrep.com & Root.io
Talks from @shehackspurple and @SonyaMoisset

Register to attend this event here:
👇
www.meetup.com/owasp-london...
OWASP London Chapter Meetup [IN-PERSON], Fri, Dec 5, 2025, 6:00 PM | Meetup
**This event is kindly hosted by Tessl.** **Raffle prizes are kindly sponsored by Semgrep and Root.** **There is limited seating available for in-person attendees. Regist
www.meetup.com
November 23, 2025 at 9:23 PM
securestep9.bsky.social
#AWS launched Agentic AI Security Scoping Matrix – a framework designed to help organizations securely deploy autonomous AI systems:
#AISecurity
👇
The Agentic AI Security Scoping Matrix: A framework for securing autonomous AI systems | Amazon Web Services
As generative AI became mainstream, Amazon Web Services (AWS) launched the Generative AI Security Scoping Matrix to help organizations understand and address the unique security challenges of foundation model (FM)-based applications. This framework has been adopted not only by AWS customers across the globe, but also widely referenced by organizations such as OWASP, CoSAI, and […]
aws.amazon.com
November 23, 2025 at 11:42 AM
securestep9.bsky.social
#WhatsApp: Largest data leak in history - the entire directory of 3.5bln of WhatsApp users was available online unprotected for retrieval.
Austrian researchers were able to download all phone numbers, profile pictures & data including public keys:
👇

www.heise.de/en/news/3-5-...
3.5 Billion Accounts: Complete WhatsApp Directory Retrieved and Evaluated
Vienna researchers retrieved all WhatsApp numbers. The 3.5 billion profiles represent the largest data leak in history—and it's worse than you might think.
www.heise.de
November 19, 2025 at 4:40 PM
securestep9.bsky.social
#GitHub: Downdetector and social media platforms are currently filled with reports about a GitHub outage, and the official GitHub Status portal has confirmed the problem:
#GitHubDown
👇
GitHub is down right now, it's not just you
Hope you didn't need to work today.
www.howtogeek.com
November 18, 2025 at 9:43 PM
securestep9.bsky.social
#Cloudflare: A Cloudflare outage is taking down big parts of the internet:

#CloudflareDown
👇
A Cloudflare outage is taking down parts of the internet - here's what we know so far
Cloudflare issue is affecting lots of websites
www.techradar.com
November 18, 2025 at 1:05 PM
securestep9.bsky.social
#Fortinet: Critical vulnerability in Fortinet FortiWeb (CVE-2025-64446), is under active exploitation - CISA adds it to KEV catalog:
Critical vulnerability in Fortinet FortiWeb is under exploitation
The company faces criticism as multiple researchers claim a silent patch was issued weeks before official guidance was released.
www.cybersecuritydive.com
November 18, 2025 at 12:55 PM
securestep9.bsky.social
#NPM: Over 67,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack Exposing Major Security Gaps:
👇
Over 67,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack
A mysterious npm worm published 46K fake packages in a two-year spam campaign, exposing major security gaps.
thehackernews.com
November 13, 2025 at 12:40 PM
securestep9.bsky.social
#Linux: Rust-based sudo-rs Affected By Multiple Security Vulnerabilities - Impacting #Ubuntu 25.10 including partial password exposure (CVE-2025-64170) and incorrect User ID in timestamps. Patches for both issues have been released:
👇
www.phoronix.com/news/sudo-rs...
sudo-rs Affected By Multiple Security Vulnerabilities - Impacting Ubuntu 25.10
The Ubuntu 25.10 transition to using some Rust system utilities continues proving quite rocky
www.phoronix.com
November 13, 2025 at 8:30 AM
securestep9.bsky.social
#NPM: Malicious NPM Package @acitons/artifact With 206K+ Downloads Stole GitHub Tokens:
👇

hackread.com/fake-npm-pac...
Fake NPM Package With 206K Downloads Targeted GitHub for Credentials
Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread
hackread.com
November 11, 2025 at 12:09 PM