Checkmarx Zero @CheckmarxZero
Checkmarx Zero Working to Keep the Open Source Ecosystem Safe https://t.co/3yB6kPHV9B checkmarx.com/zero/ Joined April 2022-
Tweets291
-
Followers202
-
Following18
-
Likes22
📢 malicious VisualStudio Code (#VSCode & #VSCodium) packages identified. Checkmarx Zero identified the packages below and reported them to Microsoft before they were widely distributed. Microsoft responded promptly and has removed them from the Visual Studio Marketplace.…
Ghostscript has a stack-based buffer overflow in versions 9.* and 10.* ; it's only a medium severity, but so many PDF processing apps and libraries use Ghostscript — it's sort of the "ImageMagick of PDFs" — the impact of this could be far-reaching. devhub.checkmarx.com/cve-details/CV……
Two under-the-radar issues happened #LastWeekInAppSec, while we were all focused on the Shai-Hulud attacks: ☕️ Jenkins + Jenkins Core HTTP/2 DoS when using embedded web server (CVE-2025-5115). Impact: unauth DoS when HTTP/2 is enabled. Fix: Jenkins 2.524/LTS 2.516.3. Interim:…
🎣 #PHP #Packagist maintainers being targeted by phishing attack. Contained for now, no signals of wide-ranging compromise. Great job by Packagist working with service providers to terminate the campaign. #ApplicationSecurity #SupplyChainSecurity phpc.social/@packagist/115…
We've updated our #ShaiHulud blog post to reflect what we've learned in the past 48 hours. TL;DR it's looking contained enough for most orgs to return to business as usual, but it's important to follow through with monitoring and reviewing of defenses. checkmarx.com/zero-post/npm-…
We're cautiously optimistic that the worst of the #ShaiHulud attack is over. These things can definitely have a resurgance over time, and we're continuing to monitor closely, but propagation has been massively slowed and it appears the exfiltration endpoint has been disabled.…
Now that our initial #ShaiHulud response has stabilized, we've got some resources and background to share, including a Gist we will update from time to time identifying impacted package versions. Of course, our malicious packages database will have the most up-to-date data as we…
The #ShaiHalud #NPM attack is ongoing; we're tracking about 600 packages impacted so far, and it continues to grow. Our customers got notifications as soon as we confirmed, but this is bad. We're busy making sure our customers our protected, and I'm sure you are all on top of it…
Using AI agents or coding assistants ? You might have a LITL problem — "lies in the loop" can defeat AI agent defenses that rely on "human in the loop" (HITL) style defenses. Prompting a user for permission is great, right up until you can get the AI to lie to the user for you.…
Adobe Commerce / Magento eCommerce just dropped the "most severe ever" issue, rooted in an improper validation of untrusted input: #CVE-2025-54236. Exploitation of this critical vulnerability can allow attackers to take over other user's sessions. For an #eCommerce platform, this…
Sitecore — a cloud-based marketing platform with AI features — experienced and disclosed a 0-day attack via improper deserialization of .NET’s ViewState. The root cause: a sample “machine key” in Sitecore’s own deployment guides turned out to be valid. This is a strong…
Hono JS framework auth bypass, Netty java framework 0-day, and Claude Code warning about its warnings #LastWeekInAppSec (09. September 2025) 🙉 Developers using the Hono JavaScript web framework, which is rapidly gaining popularity, are affected by a High (CVSS 7.5) severity…
Early analysis of the #NPM #bitcoin / #etherium / other cryptocurrency transaction stealer #malware is available on the Checkmarx Zero blog: checkmarx.com/zero-post/chal…
Our researchers evaluated Claude Code’s new security review feature. The results? ✔️ Finds simple vulnerabilities quickly ⚠️ Misses more complex issues ⚠️ Can be tricked into approving malicious code ⚠️ May even introduce new risk during analysis Bottom line: AI security review…
Yep, there's still new SQL Injection #vulnerability in 2025 -- this one is #CVE-2025-49870, in a popular #WordPress plugin that manages paid subscriptions (like when you want people to pay to subscribe to your blog, course content, etc. on your WordPress site). Someone didn't…
Lessons from session takeovers in Payload CMS, and malicious workflows in the Nx build system leaked secrets; #LastWeekInAppSec (2. September 2025) 🪪 Payload CMS SQLite adapter session management issues can lead to account takeover (CVE-2025-4644 and CVE-2025-4633). New…
🔒 AI vs CAPTCHA: Who’s really winning the fight? CAPTCHAs were once the frontline defense against bots. But with modern AI solving text, image, and even behavior-based challenges at near-human levels, traditional CAPTCHAs are crumbling. Our latest blog dives into: •How AI…
Prehistoic @prehistoic1463
0 Followers 2 Following
💜Moni⁷💜𝐄�... @JinIsMyO2AndH2O
156 Followers 191 Following OT7..Kim SeokJin is my ult bias..PTD LA D3&D4.. PTD LV D1..RUN SEOKJIN DALLAS D1&D2💜💜💜 🇮🇳 🇺🇸
Maren @FossiMarmar
7 Followers 151 Following
Eitan @EitanLepton
0 Followers 40 Following
オカダリョウタ... @okdt
4K Followers 1K Following 日本のセキュリティリサーチャ | アスタリスク・リサーチ代表📈 | 神戸デジタル・ラボCSA⚓️ | 神戸高専OB | BBT大学講師 | OWASP🐝Japan Leader | Hardening Project Organizer | SBOM CycloneDX | カレー🍛派|加速装置ほしい
Isidora @FgZ9E5UNTP7KR
42 Followers 1K Following
teycir bensoltane @teycirben
69 Followers 2K Following
Fatesblind @Fatesblind
5K Followers 3K Following Proud Republican for freedom, family, & strong America | Tech/AI enthusiast, STEM advocate, wine lover, & creative storyteller. 🇺🇸💪 #GOP #AmericaFirst
Thomas Moerkerken @moerketh
115 Followers 938 Following Software Engineer with a passion for open source and cloud-native technologies. DevSecOps | Blue Team
Aaditya Mahale @aaditya_mahale_
2 Followers 25 Following Tech enthusiast | CDAC PG-DAC | MCA Graduate | Java | Spring Boot | Passionate about digital solutions. Let's connect and innovate!🚀
比个心 @vbigthing
87 Followers 4K Following
John Kiefer @johnkiefer66
0 Followers 25 Following
rebootmaster @rebootmast66993
0 Followers 363 Following
Hjuwhnbds @hjuwhnbds97696
3 Followers 128 Following
Bheema @Bheema_0x01
24 Followers 767 Following
Eran Kinsbruner @ek121268
4K Followers 3K Following VP Portfolio Marketing at Checkmarx ,speaker, author of https://t.co/sZbo0v1S4C, https://t.co/wmjiqB1WUh #dev #AppSec #DevOps #DevSecOps #CISO #SAST #SCA #ASPM #DAST
ARPSyndicate - Cyber ... @arpsyndicate
535 Followers 297 Following A Global Cyber Intelligence Company with hyperspecialization in Information Discovery, Shadow IT & Vulnerability Intelligence
noraneko_nobuo @HVKHgyjaijz1IOw
75 Followers 601 Following
カリウム45 @kalium45
158 Followers 519 Following アナログ回路/自作PCは面白い。 サカナクションとHoneyWorks好き。なんか最近プロセカなどの音ゲー配信をしてます。 配信用垢→https://t.co/cs5NjqEWML この垢は雑多ですがよろしくお願いします！ 🌂
ALT @IxkatLobo
31 Followers 175 Following
Justice Hernandez @JHernandez47276
12 Followers 110 Following
Alexander Thandi Uban... @thandiubani
1K Followers 2K Following Lead Editor @Tori_Nigeria. Poet. Lover. Husband. 🇳🇬Onye Abia.
Thereisno2ndbest @allinonthechair
125 Followers 687 Following Bitcoin | Altcoin | Meme coin Investor $S $PLS $PLSX $Goggles
Jai Aradhye @JAI_ARADHYE
0 Followers 27 Following
Pavan @Pavan1497670195
0 Followers 24 Following
Mayur Singru @MayurSingru
58 Followers 383 Following
João Guedes @guedesao
0 Followers 12 Following
Fernando Castilla @FerD7010
137 Followers 592 Following CEO & Founder at NOVACODIFY | Purpose-driven tech for startups | MVPs, AI, Web3 & custom software that scales 🚀 #StartupTech #AI #Web3 #Innovation
Shiris Kumar @Shiris_kumar
11 Followers 360 Following Break-Fix-Repeat | Offsec Enthusiast | PwC | Intel Sports | Samsung - Harman | GE HealthCare
Juni15 @mcslaw15
1 Followers 60 Following
Tuğba Karakaya @suigeneris0606
111 Followers 268 Following İnsanın değeri, Kalbinin ağırlığı kadardır..♌️💛💙
ওয়ান ড�... @delaparasa30286
0 Followers 1 Following
S Ƨ lmvich @SoldatTiger
15 Followers 63 Following «Впечатления маленькой девочки внутри большого Саши»
ECHOz @oz_ech
0 Followers 15 Following
Cristhian Anyosa @AnyosaCristhian
33 Followers 422 Following Ingeniero de Sistemas - UNAC SAP - QLIK SENSE Seguridad Informática y Forense C|EH #ClubSportingCristal #AnimePeru
huhrefd111 @huhrefd11142396
0 Followers 82 Following
Harp6X @harp6x
463 Followers 5K Following #vsoc #Malware Research, #threatintel & #threathunting (✿ ♥‿♥)
Simon Bennetts ⚡�... @psiinon
7K Followers 632 Following ZAP (@zaproxy) by @Checkmarx lead, #Mozillian Mastodon: @[email protected]
R M ⚡🇺🇦 @kingthorin_rm
2K Followers 454 Following IT Sec guy, @zaproxy co-lead, @owasp_wstg co-lead, VWAD co-lead, @owasp_ottawa volunteer, Hac≺3r, supporter of oxford commas, #INTJ. (Opinions == mine) 🍁
gdama @gd_gdama
1 Followers 2K Following
TeamX 🌐 @CitiZenS3x
203 Followers 3K Following 👉Follow for LATEST NEWS - international affairs, wars, immigration, security, human rights, media, science, tech & occasional memes 💪🏽🇮🇱 🕊️ 🇺🇦💪🏽
RS @nicesuitbro
2 Followers 19 Following
Eilon Cohen @NoShitOasis
186 Followers 767 Following Not financial advice. Self-made speculator, researcher, developer. Don't follow if you're into the matrix.
tonghuaroot @tonghuaroot
451 Followers 3K Following Staff Security Engineer. Cyber Security enthusiast, not Hacker. Focus on Application Security, Penetration testing. #OSCP #OSEP #RedTeam #AppSec #WebSec
AppSec Village @AppSec_Village
11K Followers 6K Following AppSec Village @DEFCON & @RSAConference A volunteer-run, non-profit focused on education, awareness, and community. Founded by @erezyalon and @tzionit411.
Sam Stepanyan @securestep9
7K Followers 4K Following @OWASPLondon Chapter Leader (#OWASP #OWASPLondon). OWASP Board Member. Application Security (#AppSec) Consultant. OWASP Nettacker Project co-leader. #CISSP
Maciej Mensfeld @maciejmensfeld
2K Followers 205 Following Work @mend_io, Karafka author, and https://t.co/zTioLZz3Jk creator. Tweeting about notable performance improvements in OSS projects, security, and Ruby stuff
Jesse Mitchell @TotalCoder
42 Followers 70 Following Hey! I'm Jesse! I'm a bit of a total tech geek. Developer of https://t.co/WT39abMS4t
Louis Lang @LouiswLang
90 Followers 58 Following Co-founder @phylum_io, former @nsagov and @sony red team. Working on software supply chain security. @[email protected]
Phylum @Phylum_IO
334 Followers 375 Following Phylum automates software supply chain security to contextualize risks, block attacks and allow organizations to only use trusted open-source code.
OpenSSF Scorecard @Scorecards_dev
126 Followers 6 Following OpenSSF Scorecard quickly assesses open source projects for security risks through a series of automated checks. Part of @OpenSSF
Cynthia SW 🌻 @CynSieWil
2K Followers 4K Following Interested in security research and ethical AI. Archaeology volunteer. Tweets & opinions are my own. She/her
BleepingComputer @BleepinComputer
241K Followers 202 Following Breaking cybersecurity and technology news, guides, and tutorials that help you get the most from your computer. DMs are open, so send us those tips!
Dark Reading @DarkReading
343K Followers 48 Following One of the most widely read and trusted cybersecurity news sites, providing IT security professionals informed insights into the latest news and trends.
Ana Lucia Amaral @analucia_B2B
2K Followers 5K Following GTM & Growth Marketing Exec | Helping SaaS & Cybersecurity scale globally, accelerate pipeline & build high-impact ecosystems | 5x CRN WOTC
Erez @ErezYalon
1K Followers 459 Following VP of Security Research @Checkmarx; Founder of @AppSec_Village; API Security Project Leader @OWASP
Jossef Harush Kadouri @jossefharush
103 Followers 41 Following
Checkmarx Open Source @CheckmarxOSS
90 Followers 455 Following @checkmarx Open Source Program Office.
Checkmarx @Checkmarx
7K Followers 3K Following Checkmarx is how the world’s largest enterprises can finally get ahead of application risk without slowing down development.
Cybersecurity and Inf... @CISAgov
309K Followers 100 Following Official communications from CISA on X will always originate from this account. No other accounts are authorized to convey info from CISA or senior CISA staff.Trends for United States
You might like
