New OWASP Top 10! I know there's an initial bump in security vulnerabilities due to vibe coding, but surely the floor on exploiting some risk categories has gone up. As LLMs learn to produce secure code better, I wonder how this list will change.

owasp.org/Top10/2025/0...

I believe something like this would need to be paired with tooling and processes that insert such "watermarks" in sensitive assets, but in general this kind of insider threat modeling is fun and creative. I'm curious to see how this will be iterated upon!

research.eye.security/prompt-injec...

Conversely, I wonder what paths might exist for developers in different orgs to get exposure to and assist in tasks outside of their roles' typical scopes.

Even at a lower level, I think more interdisciplinary work is both fun and arguably more productive.

www.assembled.com/blog/why-i-c...

Looks like banking is really picking up momentum in its use of AI. I'm curious to see whether this will be used to train up more junior analysts faster, or as more of a replacement measure.

www.bankingdive.com/news/banks-c...

www.bloomberg.com/news/article...

I used jj in my previous role (there was a pretty active jj community there!), and often use it in my own projects. In addition to the benefits outlined in this post, its user base regularly shares workflows, scripts, etc. that make using it even more enjoyable.

steveklabnik.com/writing/i-se...

"Instead, we are to embrace scattered cognition and context switching between a swarm of Agents that are doing our thinking for us. Creative puzzle-solving is left to the machines, and we become mere operators disassociated from our craft."

hojberg.xyz/the-programm...

When ChatGPT Agent launched, I tried to see how easy it was to pull off a prompt injection attack; I had a POC in a few hours. As these agentic tools are released, it's important to remember they often make use of non-deterministic security controls.

securetrajectories.substack.com/p/claude-ski...

I've had to review a lot of SOC 2 reports, and the variance in quality is pretty high. This makes risk management difficult since these reports are usually the main documents newer (and thus riskier) SaaS vendors share. Would love to see a new standard someday!

sensiblesecurity.xyz/p/soc-2-is-d...

BSidesNYC is a wonderful time, would recommend to anyone in the area! Saw some great talks today, including Amit Serper's presentation on k8s (plus related hacking) and Jonathan Fuller's talk on hunting dead drops (a very cool application of symbolic execution, which I haven't seen since college).

Newsletters that I subscribe to posted in 🧵

"One in two EC2 instances enforces IMDSv2, but older instances lag behind."

I'm curious to know the distribution of reasons on why this is the case. I imagine this is some mix of limited security scanning and upgrade challenges (e.g. from a complex ECS setup).

www.datadoghq.com/state-of-clo...

There's a reason Broken Access Control is setting comfortably in the OWASP Top Ten (and I would be surprised if it isn't in next month's updated list). LLMs make this kind of enumeration, for both REST and gRPC, so much easier.

www.adversis.io/blogs/blind-...