Sam Stepanyan :verified: 🐘 on nostr

#Bitwarden CLI was compromised in a supply chain attack!

@bitwarden/[email protected] included malicious code:

#SoftwareSupplyChainSecurity
👇
https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html

Sam Stepanyan :verified: 🐘

@Sam Stepanyan :verified: 🐘 1776898517

#NPM: Self-Propagating Supply Chain Malware Hijacks npm Packages to Steal Developer Tokens.
Impacted packages:

@automagik/genie
@fairwords/loopback-connector-es
@fairwords/websocket
@openwebconcept/theme-owc
pgserve

also Python xinference compromised:

https://thehackernews.com/2026/04/self-propagating-supply-chain-worm.html

Sam Stepanyan :verified: 🐘

@Sam Stepanyan :verified: 🐘 1776634363

⚠️ #Vercel hacked.
The popular platform behind tens of thousands of AI apps and the creator of NextJS framework has confirmed a breach. Hackers claiming to be ShinyHunters are selling stolen customer + employee data:
#databreach
👇

https://www.bleepingcomputer.com/news/security/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/

Sam Stepanyan :verified: 🐘

@Sam Stepanyan :verified: 🐘 1776530569

Want to present a talk at the #OWASP Global #AppSec Conference 2026 in San Francisco in November?
Call For Papers is now open
👇

Sam Stepanyan :verified: 🐘

@Sam Stepanyan :verified: 🐘 1776295991

#Nginx: A critical vulnerability CVE-2026-33032 in Nginx UI with Model Context Protocol (#MCP) support is now being exploited in the wild for full server takeover without authentication.
👇
https://www.bleepingcomputer.com/news/security/critical-nginx-ui-auth-bypass-flaw-now-actively-exploited-in-the-wild/

Sam Stepanyan :verified: 🐘

@Sam Stepanyan :verified: 🐘 1776295991

#Nginx: A critical vulnerability CVE-2026-33032 in Nginx UI with Model Context Protocol (#MCP) support is now being exploited in the wild for full server takeover without authentication.
👇
https://www.bleepingcomputer.com/news/security/critical-nginx-ui-auth-bypass-flaw-now-actively-exploited-in-the-wild/

Sam Stepanyan :verified: 🐘

@Sam Stepanyan :verified: 🐘 1776178984

#AWS introduced Agentic Penetration Testing - while everyone is going crazy about Mythos, if you are on AWS you can have an AI Agent relentlessly finding and validating vulnerabilities 24/7:
#Pentesting
👇
https://aws.amazon.com/blogs/security/aws-security-agent-on-demand-penetration-testing-now-generally-available/

Sam Stepanyan :verified: 🐘

@Sam Stepanyan :verified: 🐘 1776176393

#Axios - yet another issue with this popular #NPM library: A newly discovered critical vulnerability CVE-2026-40175 in axios has exposed countless web & cloud apps to potential Remote Code Execution (#RCE) and full infrastructure compromise:
👇
https://cyberpress.org/axios-vulnerability-3/

Sam Stepanyan :verified: 🐘

@Sam Stepanyan :verified: 🐘 1776110228

#Booking.com warns customers of a #databreach - attackers accessed the database including names, emails, phone numbers, booking details & anything shared with the property. It is unclear if passport details were stolen too, payment info unaffected:
👇
https://securityaffairs.com/190757/data-breach/hackers-access-booking-com-user-data-company-secures-systems.html

Sam Stepanyan :verified: 🐘

@Sam Stepanyan :verified: 🐘 1776069195

#PDF Adobe Acrobat Reader Critical Vulnerability CVE-2026-34621 affects
* Acrobat DC versions 26.001.21367 and earlier
* Acrobat Reader DC versions 26.001.21367 and earlier
* Acrobat 2024 versions 24.001.30356 and earlier
👇
https://thehackernews.com/2026/04/adobe-patches-actively-exploited.html

Sam Stepanyan :verified: 🐘 · 2w

nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqe87jnlwnerc4aa0ew9glhj08hdyx52vex4rwzcte6vh74wfqheeq8m93hd this ship has long sailed. AI can generate a phishing email 100% of people will click ...

Sam Stepanyan :verified: 🐘 @Sam Stepanyan :verified: 🐘 1776035752

@nprofile1q... now that's another level of phishing:

https://socket.dev/blog/attackers-impersonating-linux-foundation-leaders-in-slack-targeting-oss-developers/