AppSec Now

DevCentral

AppSec Now is a podcast aimed at delivering the top stories from the latest (mosttly application) security news and interesting guests from the application security community.

  1. 28/04/2025

    Tackling CVE Chaos, Parquet Tool Insights, and EU Cyber Resilience Act Unpacked

    🔒 Welcome to this week’s episode of AppSecNow, the DevCentral podcast dedicated to all things application security! 🚨 This week, we unpack critical updates including: 💥 A zero-day SAP CVE with a CVSS score of 10—what it means, how it's being exploited, and what you can do to defend against it.🛠️ A groundbreaking Parquet tool from F5 Labs that simplifies vulnerability testing for critical supply chain security issues. Link: https://github.com/F5-Labs/parquet-canary-exploit-rce-poc-CVE-2025-30065🌍 The EU Cyber Resilience Act—what it means for manufacturers, open-source stewards, and secure-by-design initiatives. Learn how AppSec professionals leverage cutting-edge tools and protocols to tackle some of the biggest challenges in software security today. Whether you're prepping for RSA or managing zero trust architectures, this episode is packed with actionable insights! ✅ Like, subscribe, and follow to keep up with the latest in application security. 00:00 Introduction02:20 Parquet Tool06:30 VulnCon 202509:09 EU Cyber Resilience Act16:45 CVE Program Chaos20:29 Pay Your Tolls!27:17 SAP Critical Vulnerability29:18 Outro

  2. 21/04/2025

    EV Car Hacking, AI-Generated Passports, & Japan’s Active Cyber Defense Bill

    Join Merlyn Chase, MegaZone, and Aubrey on this week’s AppSec Now podcast as they dive into the latest topics in application security! 🚀 From the recent B-Sides Seattle conference to critical discussions on EV car hacking, cybersecurity quandaries, AI-generated passports bypassing KYC, and Japan’s groundbreaking Active Cyber Defense Bill—you don’t want to miss this one. Plus, learn how AppSecNow is keeping you ahead with insights by F5 Labs and the F5 Security Incident Response Team.Stay informed, stay secure—like, subscribe, and follow for all things AppSec!00:00 Introduction03:10 EV Car Hacking12:25 AI Generated Passports21:35 LLMs Do Not Trust Humans28:31 Japan's Active Cyber Defense Bill34:19 Outro

  3. 14/04/2025

    Amazon EC2 SSRF Breach, Oracle Cloud Breach & Malicious NPM Packages Exposed

    Join our AppSec experts—Merlyn, Malcolm, MegaZone, and host Chase Abbott—as they dig into some of the latest stories shaking up the cybersecurity world. This week's AppSec Now explores an active campaign targeting Amazon EC2 instance metadata via SSRF vulnerabilities, and why that's a wider-reaching problem than you might think. We discuss Oracle's controversial handling of their cloud breach and the impact of trust in the disclosure process. Also in the mix: malicious NPM packages deployed by North Korean hackers, a sneaky Golang malware employing "click-fix" tactics for crypto theft, and a critical Apache Parquet remote code execution bug rated CVSS 10.0—but how worried should we really be? 🔗 Relevant Links Here:https://community.f5.com/kb/security-insights/oracle-hack-north-korean-hackers-critical-flaw-in-apache/340708 00:00 Introduction 04:01 F5 Labs: AWS EC2 SSRF 10:44 Oracle Cloud Breach 16:44 Verizon iOS App Exposure 20:23 BeaverTail Malware via NPM 24:43 Golang Ghost Malware 28:34 Apache Parquet RCE - CVSS 10 !!! 34:12 Outro

  4. 07/04/2025

    NGINX Kubernetes IngressNightmare, Critical Next.js CVE, Chrome Zero Day - Ep.32

    Dive into the latest episode of AppSecNow, where we break down the Ingress Nightmare vulnerability impacting NGINX and Kubernetes environments, plus the implications of a critical CVE in Next.js, one of the most widely-used JavaScript frameworks with 9 million weekly downloads. Join Aubrey, Chase, and Merlyn for expert analysis on the security landscape, from Chromium Zero Day concerns to ransomware gangs getting pwned. Stay informed on the front lines of application security with actionable advice from DevCentral's experts. 00:00 Introduction01:45 IngressNightmare08:39 Next.js Critical CVE12:07 Chrome Zero Day16:22 New Agents For Security Copilot24:57 HaveIBeenPwned Mail List Leak27:10 BlackLock RaaS Gang Pwned30:28 Outro

  5. 31/03/2025

    Vibe Coding, F5 Labs Bot Report, Google Buys Wiz And More | AppSec Now Ep 31

    Welcome to the 31st episode of AppSec Now! This week, our hosts Aubrey, David Warburton, Chase Abbott, and MegaZone get into some hot topics in the world of application security. Our focus is on the latest F5 Labs Advanced Persistent Bots report, highlighting the ever-evolving landscape of bot attacks and the importance of robust mitigation strategies. We analyze Google's hefty $32 million acquisition of Wiz, exploring what this move means for the tech giant's security posture and its potential impact on the cloud security market.We also tackle the sensitive topic of personal data with a focus on 23andMe's bankruptcy and the critical steps you should take to safeguard your genetic information. Finally, we explore the emerging trend of "vibe coding" and its implications for both seasoned developers and novices. Join us for these engaging discussions and more, and don't forget to like, subscribe, and leave a comment with your thoughts!00:00 Introduction01:08 Google / Wiz Deal04:57 Electrical Fire Closes Heathrow12:39 23andMe Bankrupt! Delete data. 19:10 Advance Persistent Bots Report32:06 Vibe Coding Roundtable42:37 Outro

  6. 24/03/2025

    Latest AppSec Threats: Coinbase Phishing, BRUTED, OBSCURE#BAT, KoSpy And More!

    Join us for the thirtieth episode of AppSecNow, a DevCentral podcast dedicated to the latest trends and threats in the application security (AppSec) world. In this episode, host Aubrey King is joined by Malcolm Heath, Chase Abbott, and MegaZone to dive into recent security incidents and developments, including a detailed analysis of the Coinbase phishing scam, the resurgence of user-mode rootkits with OBSCURE#BAT, the BRUTED brute force campaign and KoSpy, a sophisticated Android spyware campaign linked to North Korean threat actors.Stay informed with custom-curated content from F5's Security Incident Response Team and relevant data from F5 Labs. Discover how attackers are evolving their methods and learn practical tips to protect your applications from these emerging threats. Whether you’re a security professional or just interested in the latest in cybersecurity, this episode has something for you.00:00 Introduction01:52 Coinbase Phishing Scam12:24 BRUTED Brute Force18:26 OBSCURE#BAT Malware21:14 KoSpy Android Spyware 33:15 CISA KEV Updates34:19 Outro

  7. 18/03/2025

    Latest in AppSec: Apache Camel RCE, X DDoS, Silk Typhoon, and Encryption Debates

    Welcome to the latest episode of AppSec Now, a DevCentral podcast dedicated to the ever-evolving world of application security. In this episode, Chase takes the reins while Aubrey is away, joined by Malcolm Heath, a principal researcher at F5 Labs, and the illustrious MegaZone, a principal security engineer on the SIRT team. We dive deep into the recent Apache Camel remote code execution vulnerability, discussing the initial panic and the eventual revelation that it was a medium-severity CVE with narrow impact. We also explore the ongoing debate on government backdoors in end-to-end encryption, with insights on the recent stances of Signal and Apple. Finally, we shed light on the recent DDoS attack on X (formerly Twitter), attributed to Dark Storm, and discuss the complexities of attributing such attacks. Stay informed and up-to-date with the latest trends and threats in the AppSec world! References: https://community.f5.com/kb/security-insights/appsec-camels-typhoons-and-backdoors/340217 00:00 Introduction 00:59 Apache Camel RCE 10:09 Silk Typhoon 16:11 Government Encryption Backdoors 25:51 X (Twitter) DDoS 30:25 VulnCon Comin' Up! 32:16 Outro

  8. 03/03/2025

    Exploring CISA Layoffs, Microsoft's Quantum Chip, MongoDB Vulnerabilities & More

    Join Aubrey, MegaZone, and Merlyn in this week's episode of AppSec Now as they dive into the latest in application security. This week, we discuss Microsoft's groundbreaking Majorana One chip, capable of scaling up to a million qubits and its potential impact on quantum computing. We also explore the recent critical vulnerabilities in MongoDB libraries and OpenSSH, analyzing their implications and mitigations. We dig into the layoffs at CISA and the potential cybersecurity impacts. Don't miss out on these crucial insights to stay ahead in the cybersecurity landscape. TWIS: https://community.f5.com/kb/security-insights/u-s-government-cuts-majorana-1-chip-cves-for-mongoose-and-openssh/339995 00:00 Introduction 04:28 Majorana1 09:07 CISA Layoffs 16:06 OpenSSH MITM / DoS CVEs 20:28 MongoDB RCE CVEs25:54 Outro

Ver todo (41)

Tráiler

Acerca de

AppSec Now is a podcast aimed at delivering the top stories from the latest (mosttly application) security news and interesting guests from the application security community.

Información

  • Creador
    DevCentral
  • Años de actividad
    2022 - 2025
  • Episodios
    41
  • Clasificación
    Apto
  • Copyright
    © DevCentral
  • Mostrar sitio web
    AppSec Now