Application Security Feed

I may have broken @appsecfeed.bsky.social…

That’s what I get for making a small change without testing 😂.

Should be back up a day or two.

🗞️ Better-auth account takeover (CVE-2025-61928) found via ZeroPath

🔗 https://zeropath.com/blog/breaking-authentication-unauthenticated-api-key-creation-in-better-auth-cve-2025-61928

🗞️ Cloudflare Image Proxy as a CSPT Gadget: A Cross-Origin CSPT Exploit

🔗 https://blog.voorivex.team/cloudflare-image-proxy-as-a-cspt-gadget-a-cross-origin-cspt-exploit

🗞️ Organizations Warned of Exploited Adobe AEM Forms Vulnerability

🔗 https://www.securityweek.com/organizations-warned-of-exploited-adobe-aem-forms-vulnerability/

🗞️ ZeroDisco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits

🔗 https://www.trendmicro.com/en_us/research/25/j/operation-zero-disco-cisco-snmp-vulnerability-exploit.html

🗞️ New automated cybersecurity solution for vulnerability detection and remediation

🔗 https://aisle.com/

🗞️ Vulnerability scores, huh, what are they good for? Almost nothing

🔗 https://www.theregister.com/2025/10/16/cve_cvss_scores_not_useful/

🗞️ yIKEs (WatchGuard Fireware OS IKEv2 Out-of-Bounds Write CVE-2025-9242)

🔗 https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242/

🗞️ How App Integration Transactions Increase the Attack Surface of LLMs

🔗 https://www.netspi.com/blog/executive-blog/adversarial-machine-learning/how-app-integration-transactions-increase-the-attack-surface-of-llms/

🗞️ Client-Side Path Traversal: Exploiting CSRF in Header-Based Auth Scenarios

🔗 https://blog.kulkan.com/client-side-path-traversal-exploiting-csrf-in-header-based-auth-scenarios-31c26a1baece

🗞️ F5 Says Nation-State Hackers Stole Source Code and Vulnerability Data

🔗 https://www.securityweek.com/f5-blames-nation-state-hackers-for-theft-of-source-code-and-vulnerability-data/

🗞️ .NET Security Feature Bypass Vulnerability

🔗 https://github.com/dotnet/aspnetcore/security/advisories/GHSA-5rrx-jjjq-q2r5

🗞️ CVE-2025-55315: Asp.net Security Feature Bypass Vulnerability [9.9 Critical]

🔗 https://nvd.nist.gov/vuln/detail/CVE-2025-55315

🗞️ A modern approach to preventing CSRF in Go

🔗 https://www.alexedwards.net/blog/preventing-csrf-in-go

🗞️ Security firms dispute credit for overlapping CVE reports

🔗 https://www.bleepingcomputer.com/news/security/security-firms-dispute-credit-for-overlapping-cve-reports/

🗞️ Silencing a Kitchencook teatime kettle

🔗 https://dustri.org/b/silencing-a-kitchencook-teatime-kettle.html

🗞️ Gecko Security (YC Company) Allegedly Steals CVE Reporting Credit

🔗 https://twitter.com/fuzzinglabs/status/1977720899114606745

🗞️ Apple Introduces $2M Bug Bounty for Spyware-Level Exploits

🔗 https://www.macrumors.com/2025/10/10/apple-bug-bounty-program-overhauled/

🗞️ Research Worth Reading Week 41/2025

🔗 https://pentesterlab.com/blog/research-worth-reading-week41-2025

🗞️ GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)

🔗 https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/

🗞️ Oracle Security Alert CVE-2025-61884 for E-Business Suite

🔗 https://news.ycombinator.com/item?id=45554830

🗞️ Ksmbd – Exploiting CVE-2025-37947

🔗 https://blog.doyensec.com/2025/10/08/ksmbd-3.html

🗞️ Oracle Security Alert Advisory – CVE-2025-61884

🔗 https://www.oracle.com/developer/

🗞️ CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code

🔗 https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code

🗞️ CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code

🔗 https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code

🗞️ Show HN: An open-source starter kit for implementing OWASP ASVS 5.0

🔗 https://github.com/Kaademos/asvs-compliance-starter-kit

🗞️ Hardware Vulnerability Allows Attackers to Hack AI Training Data – NC State News

🔗 https://news.ncsu.edu/2025/10/ai-privacy-hardware-vulnerability/

🗞️ Zero-day in file-sharing software leads to RCE, and attacks are ongoing

🔗 https://www.theregister.com/2025/10/10/zeroday_in_filesharing_software_leads/

🗞️ More Than DoS (Progress Telerik UI for ASP.NET AJAX Unsafe Reflection CVE-2025-3600)

🔗 https://labs.watchtowr.com/more-than-dos-progress-telerik-ui-for-asp-net-ajax-unsafe-reflection-cve-2025-3600/

🗞️ Critical 9.9 Redis vulnerability enables remote code execution

🔗 https://www.scworld.com/news/critical-9-9-redis-vulnerability-enables-remote-code-execution