Confidence Staveley

How do you move from submitting less than 20 bugs per month to finding over 193 bugs in just 3 weeks? From nearly becoming a doctor, to having 3 CVEs assigned to her name, @Thezinnekalu's Cybersecurity journey will keep you glued to your screen! In this episode of AI Cyber Podcast, Ezinne shows us how she uses AI as her Second brain, best practices for reporting vulnerabilities as a researcher, and how you could implement AI without breaking the bank. Watch the full chat on @aicybermagazine👇 📽️ youtu.be/iCo2885anuI

This guy rocked up at my backyard and posed for a quick photo 😂

I’ve never seen this many critical (score of 10) vulnerabilities in one week with such widespread possible impact. There were 27 this week across 10 products! 1. HPE Aruba Wi-Fi systems: This is the equipment behind a lot of business Wi-Fi 2. Apache Traffic Server: Behind-the-scenes software that sits at the edge of content delivery networks, and inside large companies to route their web traffic. 3. GitLab: Where many companies store and build the code for their apps. An attacker could run their own commands on a company's GitLab server without ever logging in, and it affects every version going back to 2014. 4. Oracle business software; The affected systems handle logins, finance, databases, and other core operations at large companies. 5. Microsoft cloud services: A troubleshooting tool for virtual computers in Microsoft's Azure cloud, a service that manages app setups on Azure, and the gateway that lets employees reach internal company apps from outside the office. 6. IBM DataStage: A tool companies use to move and process large amounts of data on IBM's shared platform. 7. Apache Pulsar Manager: The control panel for a system apps use to pass messages and data to each other. Outsiders can create their own administrator accounts and steal credentials. 8. Mercury: A tool that turns data scientists' working files into shareable web apps and dashboards. 9. YOOtheme Pro for Joomla. A popular website design add-on. 10. WP Mailster for WordPress. A plugin that runs email lists on WordPress sites. Honorary mention, are those of PHP, the programming language behind nearly 70% of websites, had two serious flaws this week that scored just below 10. There’s a third vulnerability with no fix yet.

What can possibly go wrong? Cybersecurity awareness month: 👇

Blaming AI for breaches is not the flex you think it is, when you’ve NOT done the security basics…that, my friends, is NEGLIGENCE !!! This trend has to stop! Anyone who followed OpenCode last year will remember the cross-origin remote code execution flaw that turned a locally running OpenCode HTTP server into an open door. This meant a malicious webpage could run arbitrary commands on your machine. That was a design failure, not a sophisticated attack. We’ve been asking for hardening and more transparency about how the service handles trust boundaries, even before this breach. What I've learned over years of doing this work is that insecure software is usually a decision, even when it looks like an accident. The engineering to harden a service like this is well understood. What varies between teams is whether anyone decides that doing it MATTERS enough to spend time and budget on it. Teams that make that decision ship resilient products. Teams that don't, end up playing victim and pointing at AI.

We now have the 10 final fellows for our pilot cohort of the CyberSafe x SANS AI Security fellowship. Our fellows are from 7 countries; Egypt, Morocco, Kenya, Nigeria, Senegal, Zambia and Uganda. On Monday, I’ll begin sharing each fellows story. Can you tell I’m super excited for these women? 💃🏻

Don’t miss Ezinne’s talk at the AWS community event tomorrow. She’ll be talking about Kiro, the Agentic IDE from AWS and how we should be baking threat modelling into how it works from day one!