Vídeo novo no canal

Você deve ter visto que as últimas semanas foram movimentadas com tantos pacotes NPM sendo comprometidos. No vídeo de hoje vamos falar sobre a estratégia de AppSec para mitigarmos este tipo de risco.

DevSecCon

Dia 22 de outubro vamos ter a DevSecCon! Online e gratuito!

Faça seu cadastro aqui!

Links

• Snyk publicou um artigo sobre detectar Tool Poisoning em MCPs: https://labs.snyk.io/resources/detect-tool-poisoning-mcp-server-security/

• Caido lançou um lab gratuito para entender e praticar webhacking: https://labs.cai.do/

• Lakera publicou um artigo sobre um Zero Click RCE em MCP: https://www.lakera.ai/blog/zero-click-remote-code-execution-exploiting-mcp-agentic-ides

• Amazon publicou um artigo sobre acelerar Threat Modeling com IA Generativa: https://aws.amazon.com/pt/blogs/machine-learning/accelerate-threat-modeling-with-generative-ai/?utm_source=chatgpt.com

• Um site foi criado especificamente para segurança de MCP: https://modelcontextprotocol-security.io/

• Snyk publicou um artigo sobre uso de IA por bibliotecas maliciosas para otimizar o exploit: https://snyk.io/pt-BR/blog/weaponizing-ai-coding-agents-for-malware-in-the-nx-malicious-package/

• Paper sobre MCP landscape, security threats e pesquisas futuras: https://arxiv.org/pdf/2503.23278

• A Michelle publicou um artigo sobre arquitetura + STRIDE com MCP no Cursor: https://michelleamesquita.medium.com/automatizando-arquitetura-stride-com-mcp-no-cursor-c778de635110

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

Se você desenvolve aplicações que recebem um input do usuário e envia ele para uma LLM processar, seja local ou remoto, é importantíssimo que você entenda os riscos que corre nesta integração.

Links

• Top 10 threats and mitigation for AI Agents | OWASP

• MCP Security Checklist: A Security Guide for the AI Tool Ecosystem | Slow Mist

• Secure Software Development Practices for Generative AI and Dual-Use Foundation Models | Nist

• What 17,845 GitHub Repos Taught Us About Malicious MCP Servers | VirusTotal Blog

• Starting a Security Program from Scratch (or re-starting) | Phil Venables

• Anatomy of a Kubernetes Attack: How Cortex Cloud Provides End-to-End Protection | Palo Alto

• Defeating FIDO2/CTAP2/WebAuthn using browser in the middle and reflected cross site scripting | Springer

Snyk

• Snyk anuncia a primeira plataforma AI Trust para revolucionar o desenvolvimento de software seguro na Era da IA

• Snyk Acquires Invariant Labs to Accelerate Agentic AI Security Innovation

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

A essa altura do campeonato você já deve ter ouvido sobre MCP. Bem, vamos entender um pouco mais do que é o protocolo e criar o nosso primeiro:

Links

• 🏆 Lakera Gandalf - Prompt Injection Online CTF | lakera.ai

• Remote Code Execution vs. Remote Command Execution vs. Code Injection vs. Command Injection vs. RCE | hakluke.com

• Deceiving users with ANSI terminal codes in MCP | trailofbits.com

• How MCP servers can steal your conversation history | trailofbits.com

• Awesome MCP Security | puliczek

• The MCP Authorization Spec Is... a Mess for Enterprise | christianposta.com

• The Rise of Slopsquatting: How AI Hallucinations Are Fueling a New Class of Supply Chain Attacks | socket.dev

• Securing the Model Context Protocol | block.github.io

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

• CVE-2025-29927: Next.js Middleware Authorization Bypass - Technical Analysis | Project Discovery

• GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment (Updated 3/21) | PaloAlto

• From Pandora's Box to Nuclear Fishing: Escalating Threats in Build Pipelines Security | BoostSecurity

• TM-Bench - A Benchmark for LLM-Based Threat Modeling

• Vulnerability Exploitation in the Wild - A look at the inaugural study of EPSS Data and Performance | Resilient Cyber

• Securing AI/LLMs in 2025: A Practical Guide To Securing & Deploying AI

• Github Well Architected - Best Practices for Designing, Implementing, and Optimizing Your GitHub Environment

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

• 🎖️ Michelle Mesquita| DevSecOps com GitHub Actions

• Github | Secret scanning expands default pattern support

• MITRE | QUANTUM COMPUTING: QUANTIFYING THE CURRENT STATE OF THE ART TO ASSESS CYBERSECURITY THREATS

• CyberSecTools | The Largest Hub of Cybersecurity Tools

• CrowdStrike | Improving Kubernetes Security: Lessons from an Istio Configuration Finding

• xvnpw | Forget Threats, Mitigations are All You REALLY Need

• OWASP Smart Contract Top 10

• How Palantir Secures Source Control (Software Supply Chain Security Series, #3)

• Socket | Go Supply Chain Attack: Malicious Package Exploits Go Module Proxy Caching for Persistence

• Google | Secure by Design: Google's Blueprint for a High-Assurance Web Framework

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

Links

• https://github.com/ossf/package-analysis: The Package Analysis project analyses the capabilities of packages available on open source repositories.

• s1r1us blog: a nice security blog =)

• Hacking Discord for $5000 Bounty: A video of Mrgavyadha explaing a bug report in Discord BBP.

• Chainguard Images: Build secure applications on a foundation of minimal, hardened container images to protect against vulnerabilities and attacks.

• CVE-2024-39025 by cnetsec: Vulnerability in LettaAI

• Shock News: SHA-256, ECDH, ECDSA and RSA Not Approved by ASD in Australia for 2030 by Prof Bill Buchanan

• OWASP SAMM v2.1.0 Core: New version of SAMM

• XML-RPC npm Library Turns Malicious, Steals Data, Deploys Crypto Miner

• 3 DevSecOps success stories by Michael Nadeau and Dan Swinhoe

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

• 🎖️ Monitoramento Regular de Repositórios Git para Identificação de Dados PII com AWS Macie | Gustavo Rorato

• eBPF Foundation Releases Security Threat Model and Audit Reports | TheNewStack

• Supply Chain Attacks Targeting LLM Application Developers: The Hidden Dangers of Fake Open Source Packages | Socket.dev

• The Future Application Security Engineer | Gyan Security

• SSRF & URI validation bypass in 2FAuth | XBOW

• Magika - Detect file content types with deep learning | Google

• Supply Chain Attack Using Ethereum Smart Contracts to Distribute Multi-Platform Malware | Checkmarx Zero

• Developing Secure Software (LFD121) - Course Free | The Linux Foundation

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

Vídeo Novo no canal Guia de AppSec

Links

• 🎖️ Google | If It’s Not Secure, It Should Not Compile: Preventing DOM-Based XSS in Large-Scale Web Development with API Hardening

• AWS | How to build a Security Guardians program to distribute security ownership

• Santander Bootcamp Cibersegurança #2

• FIDO | FIDO Alliance Publishes New Specifications to Promote User Choice and Enhanced UX for Passkeys

• SEMGREP | Easily create custom SAST guardrails with human language and Semgrep Assistant (AI)

• SHIKIDA | Appsec adventures - Blog

• Github | EPSS Scores in the GitHub Advisory Database

• Hacken | Key Discovery in ECDSA: Understanding Implementation and Security Risk

• Tiago Tavares | Processo de Gestão de Vulnerabilidades e Automação para OffSec e AppSec Utilizando Atlassian Jira: Proposta e Tutorial

• Sysdig | Runtime Is The Way

• Mitre-Engenuity | Threat-Informed Defense to Secure AI

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

• URL validation bypass cheat sheet | PortSwigger

• Learn AWS Pentesting | Tyler Ramsbey

• Burp Suite - Deep Dive | Cristi Vlad

• Microsoft Copilot: From Prompt Injection to Exfiltration of Personal Information

• SaaS attack techniques

• CAPEC-STRIDE Mapping

• Gotta cache 'em all: bending the rules of web cache exploitation

Links

• Splitting the email atom: exploiting parsers to bypass access controls

• Using AI for Offensive Security

• Bypassing API rate limiting using IP rotation in Burp Suite

• TruffleHog Now Analyzes Permissions Of API Keys and Passwords

• How did Facebook intercept their competitor's encrypted mobile app traffic?

• Datadog Extension for Visual Studio Code

• Fast, Cheap and Good | An Unusual Trade-off Available in Threat Modeling by Adam Shostack

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

• 🚨 ZAP | Polyfill.io Script Detection

• Not The Hidden Wiki - The largest repository of links related to cybersecurity

• PLORMBING YOUR DJANGO ORM

• Kubernetes Cluster Security - Nuclei Templates v9.9.0

• Cloud Commotion intends to cause chaos to simulate security incidents

• Private Cloud Compute: A new frontier for AI privacy in the cloud

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

• Agile Manifesto for a Holistic AppSec Environment | Synopsys

• What is Kyverno?- Policy Management using Kyverno

• 🎖️ https://github.com/danielmiessler/fabric | open-source framework for augmenting humans using AI

• The state of AppSec: Are we getting ahead of attackers — or falling behind?

• GitHub and JFrog partner to unify code and binaries for DevSecOps

• https://github.com/prowler-cloud/prowler | Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes.

• Writing Burp extensions in Kotlin

Vagas

• Analista de Segurança da Informação Sênior | AppSec | Conta Simples

• DevSecOps | Mutant

Links

• 🎖️ Conviso Academy | Formação em AppSec gratuita

• Defending CI/CD Environments - The NSA/CISA Way

• 41 Thought Leaders in InfoSec to Watch in 2024

• dependabot-core is now open source with an MIT license

• Deep Dive into Falco: Empower DevSecOps with Real-time Container Security

• Is Bruno a good Postman alternative for API hacking?

• jassics/security-study-plan

Vagas

• Contabilizei | Analista de Segurança da Informação Sênior - AppSec

• Ambev Tech | Analista de Segurança da Informação Sênior (AppSec)

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

No estado do Rio Grande do Sul (onde eu moro) tivemos uma das maiores catástrofes de sua história.
Devido as enchentes em diversas cidades, muitas pessoas (muitas mesmo) perderam tudo, estão desabrigadas e precisando de apoio.

A WSS Security está com um PIX para arrecadar fundos para ajudarmos aos mais necessitados.

Links

• 🎖️ Nuclei Templates for AWS Cloud Config Review

• Semgrep Academy

• HexaCluster/pgdsat | PostgreSQL Database Security Assessment Tool

• Hacking Apple - SQL Injection to Remote Code Execution

• ATT&CK v15 Brings the Action: Upgraded Detections, New Analytic Format, & Cross-Domain Adversary Insights

• Dependabot on GitHub Actions and self-hosted runners is now generally available

Vagas

• Stone | [Risk Platform] Arquiteto de Segurança em Desenvolvimento - Senior

• Mercado Livre | Senior Cyber Engineer - Security Education

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

• 🎖️ 8KSEC | Advanced Frida Series For Mobile Security Enthusiasts

• CISA | Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and Security-by-Default

• Kubenomicon | Kubernetes from an offensive perspective

• AWS | Configurando uma pipeline de CI/CD segura em uma Amazon Virtual Private Cloud sem acesso a internet

• Tailspin | A log file highligher

• 8KSEC | Securing Flutter Applications

Vagas

• Remote | Application Security Manager

• Conviso | Senior Application Security Consultant

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

• [artigo] Three key learnings for AppSec teams from the XZ backdoor

• [wiki] ../../../../hacking_methodology

• [artigo] Passkeys – under the hood

• [tutorial] Kubernetes Threat Detection with Kubescape, Prometheus, and Grafana

• 🎖️ [repo] A basic guideline on implementing auth for the web

• [curso] Securing Projects with OpenSSF Scorecard Course

• [artigo] Securing Flutter Applications

Vagas

• Contabilizei :: Analista de Segurança da Informação Sênior (Segurança de Produto)

• Neon :: Senior DevSecOps

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

• [tool] threatcl/threatcl: Documenting your Threat Models with HCL

• [tool] aquasecurity/chain-bench: An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark.

• [video] Webinar: Rapid Threat Modeling with GenAI and LLMs

• [artigo] Product Security Plans: What They Are and Why They Matter

• [video] Secure LLM Architecture - Testing LLM Guard

• [wiki] Risk Based Prioritization

• [tool] sonatype SBOM manager

• [artigo] Jit | The Essential Components of a DevSecOps Pipeline

Vagas

• Loggi - Senior Cybersecurity Manager (App Sec & SOC)

• Compass UOL - Security Champion | Senior

• [artigo] Opening Pandora’s box - Supply Chain Insider Threats in Open Source projects

• [artigo] Docker Security – Step-by-Step Hardening (Docker Hardening) (um dos guias mais completos que já vi)

• [ferramenta] Secret scanning AI-generated custom patterns (public beta) by Github

• [processo] CISA Secure Software Development Attestation Form

• [repositório] Awesome Product Security

• [IA] Cloudflare announces Firewall for AI

Vagas

• Hakai | Engenheiro de AppSec/DevSecOps (PL e SR)

• Luxoft | Application Security Specialist

• Stefanini | DevSecOps Pl

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

• [artigo] Advanced End-to-End DevSecOps Kubernetes Three-Tier Project using AWS EKS, ArgoCD, Prometheus, Grafana, and Jenkins

• [webinar] How to Scale a High-Performing Cybersecurity Team

• [tool] Announcing the General Availability of OpenZeppelin Defender: A New Era in Blockchain Security and Operations

• [course] TryHackMe | Our New DevSecOps Learning Path Has Landed!

• [framework] OWASP Product Security Capability Framework

• [newsletter] tl;dr sec #220 - Detecting Manual AWS Actions, AI Threat Models, Living Off the False Positive

• [checklist] OWASP LLM IA Cybersecurity & Governance Checklist

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br

• [academy] Keycloak Academy

• [artigo] How Github Scaled Appsec

• [newsletter] tl;dr sec #216 - Azure Attack Paths, Recipe for Scaling Security, Cybersecurity Incident Tracker

• [tool] RAVEN (Risk Analysis and Vulnerability Enumeration for CI/CD)

• [artigo] HTTP Request Smuggling | Tryhackme Writeup/Walkthrough | By Md Amiruddin

• [artigo] Why Distributed Application Environments Need a Consistent Security Posture

• [newsletter] AppSec Ezine 519

• [tool] cvemap by ProjectDiscovery

• [artigo] The Importance of Threat Modeling for Building Secure Workloads in AWS

Vagas

• Mercado Livre :: Cyber Security Engineer - Líder Técnico

Siga o Guia de AppSec nas redes!

• Youtube: youtube.com/@GuiadeAppSec

• Twitter / X: twitter.com/guiadeappsec

• Site: guiadeappsec.com.br