This week in appsec: Issue #19

> Roundcube forgot SVG image bypasses remote image blocking

> First malicious MCP in the wild: postmark-mcp v1.0.16

> Claude Opus 4.6 autonomously discovered hundreds of real 0-days in heavily fuzzed OSS projects

appsecweekly.net/p/issue-19-a...

#appsec

This week in appsec: Issue #18

> GCP Apigee cross-tenant bug leaked plaintext tokens via metadata server pivot

> Notepad++ supply chain attack ran June-Dec 2025

> Moltbook exposed 1.5M agent tokens

> Deno Sandbox: <1s microVMs for untrusted LLM code

appsecweekly.net/p/issue-18-a...

New AppSec Weekly Issue #17 covers

💣 the cURL bug bounty program ending
🔥 automated exploit generation with LLMs,
⚓ nodes/proxy GET behavior in Kubernetes.

Plus tools for LAN discovery and PDF sanitization.
appsecweekly.net/p/issue-17-a...

New galaxies. New friends. Yoshi joins the adventure. The Super Mario Galaxy Movie is only in theaters April 1.

Issue #16 of AppSec Weekly

🪏 CodeBreach: AWS CodeBuild misconfiguration → full SDK takeover
🪏 Google weaponizes Net-NTLMv1 with rainbow tables
🪏 OpenCode CVSS 10.0 RCE (unauthenticated localhost server)
🪏 Svelte ecosystem: 5 CVEs DoS + XSS
🪏 Handling shell secrets without leaking to /proc
#AppSec

Issue #15 of AppSec Weekly 🛡️

🪓 6-bug chain → pre-auth RCE in LogPoint SIEM
🪓 PassSeeds: hijacking passkeys for crypto beyond WebAuthn
🪓 Tailscale kills default TPM encryption
🪓 Malicious VS Code extensions in the wild
🪓 Notion AI prompt injection exfiltration
🪓 npm staged publishing post

#AppSec

Started publishing weekly roundups of what's happening in #AppSec

🪏 MongoDB CVE that hit self-hosted instances
🪏 tokenless CSRF making it into OWASP guidance
🪏 OpenPGP implementation bugs.
🪏 LangChain CVE-2025-68664
🪏TruffleHog's JWT liveness checks.

appsecweekly.net/p/issue-14-a...

#DevSecOps

Hello bluesky 🦋!