Insights from experts shaping secure development

操作系统命令注入攻击可以由入门级和技能较低的黑客执行，这使其成为安全团队最常见的漏洞之一。值得庆幸的是，有很多非常有效的方法可以防止他们取得成功。

会话是使用网络时获得良好用户体验的关键。但是，不当管理会话会导致安全漏洞，攻击者可以利用这些漏洞。

你不认为是时候改头换面了吗？这就像改变对话然后让一切变得更积极一点一样简单（更不用说有趣了！）对于双方，尤其是开发团队。

虽然对于另类摇滚乐队来说，Padding Oracle 听起来像是一个非常糟糕的名字，但它实际上是一个漏洞，攻击者可以在不知道加密密钥的情况下利用它来解密信息。

当恶意用户可以操纵 LDAP 查询时，可能会出现问题。这样做可能会诱使接收服务器执行通常不允许的无效查询，甚至向没有密码的无效或低安全性用户授予高级或管理员访问权限。

我们面临的真正战斗不是针对剧本小子或危险的有组织网络犯罪集团... 而是要让更多的人关心数据泄露的发生。

在网络安全领域，攻击者可以快速利用任何被允许支持不受限制文件上传的应用程序或程序。结果可能是毁灭性的。

NoSQL 数据库越来越受欢迎。很难否认它们处理非结构化数据的速度和便捷性，但是随着使用的普及，越来越多的漏洞不可避免地浮出水面。

CSRF 攻击相当复杂，需要多层才能成功。换句话说，必须破坏很多有利于攻击者的东西才能起作用。尽管如此，它们还是非常受欢迎、利润丰厚的攻击载体。

攻击者正在使用 SQL 注入，这是最古老的注入之一（自 1998 年以来！）还有最讨厌的数据漏洞——窃取和更改全球数百万个数据库中可用的敏感信息。

当在线隐私试图在没有安全的情况下存在时，混乱就会占据上风。问问罗斯·乌尔布里希特就行了。

观察：金融机构在提高开发人员安全编码技能方面的创新和领导地位不断提高。

有一种众所周知的理论认为，蟑螂基本上可以在任何情况下存活下来，即使是核爆炸也是如此。

有许多解决方案可以发现代码中的漏洞，但是安全性需要更加重视教导开发人员遵循安全准则，以防止他们从一开始就犯这些错误。

我们必须努力改变对话方式，使安全成为每个开发人员工作生活中不可或缺的一部分。我认为做到这一点的最佳方法之一是通过游戏化等在安全方面赋予开发人员权力，并与他们互动。

我们必须停止将安全视为公司创新道路上的刺激性障碍。

我以为我最终会从事基础设施或服务支持类的职业，然后在研究生课程中获得了发展机会。原来那正是我需要去的地方。

让开发人员从一开始就能够编写安全代码，这为首席信息安全官提供了从安全困境中抓住一些主动控制的机会，也有可能为安全和开发团队带来快速、简单和可衡量的改进。

调查人员说，防止爆炸的唯一因素是攻击者的计算机代码错误。

我们的愿景是通过提高安全性，为开发人员提供从一开始就编写安全代码的技能和工具，使他们成为组织中的第一道防线。

如果没有人教过开发人员为什么安全代码很重要，不安全代码的后果，最重要的是，如何防止在各自的编程框架中写入这些漏洞，那么开发人员应该如何编写安全代码？

XML 和 XML 架构的规范包括多个安全漏洞。同时，这些规范提供了保护 XML 应用程序所需的工具。尽管我们使用 XML 架构来定义 XML 文档的安全性，但它们仍可用于执行各种攻击。

我们可以将一个文件注入到一个名称前缀为 zip 的 zip

更改一台航空电子设备上的一行代码的成本为100万美元，实施需要一年的时间。对于其机队以波音737为基础的西南航空来说，它将 “破产”

节目 139：Matias Madou 讨论安全开发培训和软件安全测试研究

Android 全设备加密可安全保存所有数据并将其写入存储空间，只有在设备解锁后才能看到。向安全代码勇士学习。

有时，应用程序必须能够在用户完全知情和同意的情况下验证操作是否正在执行

通过定义自定义权限范围，应用程序可以与其他应用程序共享其资源和功能。

大约 95,000 个应用程序中的近 300,000 名开发人员使用 BSIMM8 来帮助规划、执行和衡量他们的软件安全计划 (SSI)。

用户名枚举是指黑客使用暴力攻击来获取用户名和密码信息。使用安全代码勇士学习如何避免用户名枚举。

关于如何推出有效的开发人员安全培训的 5 条重要课程

这项工作的意义在于，我们为大量令人震惊的安全编码问题提供了经验证据，这些问题以前从未报告过

该错误仍然存在。这不是可以立即修复的问题。在过去的几个月中，作为漏洞赏金计划的一部分，我联系了数十家公司和受影响的供应商，以修复他们的设置。

随着首席信息官积极建立企业敏捷能力，安全编码技能将成为创新的武器，没有这些技能将是一种破坏工具。

无论你是对高管进行网络安全培训，还是帮助开发人员掌握 JAVA 或 C# 安全编程技能，都有创造力、游戏化和乐趣的地方。

如果开发人员在使用 JavaScript 编码时写入了跨站脚本错误，并且他们能够在创建该漏洞后的几分钟内检测到该错误

每个开发者都需要问一个问题，无论你是毕业生还是资深人士。答案很重要。

上周我正在研究 Java Spring 中的漏洞，以更新我们的安全编码指南。

根据一位名为x0rz的研究人员的推文，向前跳到2016年，一位安全研究人员在Equifax的主要网站上发现了一个称为跨站脚本（XSS）的常见漏洞。

该漏洞与 Struts 如何解析此类数据并将其转换为 Java 编程语言可以解释的信息有关。

数据剩余是以某种方式被删除的数据的剩余物理表现形式。

再一次，Equifaxblackeach客攻击的根本原因是网络应用程序漏洞。这个类的漏洞已经存在了十多年，但今天确实非常棒。

Post-quantum cryptography (PQC) is critical for protecting data from quantum computing threats. Learn how “harvest now, decrypt later” exposes risk and how developers can prepare for quantum-safe security.

Recently we interviewed some of the future leaders in the secure development or “DevSec” world and found their individual career paths into cybersecurity fascinating. For those of you out there wishing to become a security champion, jump into the elusive AppSec realm, or even just learn more about secure coding, here are the stories from three security professionals with a background in development, about how they got interested in security and the security lessons they wish every organization would follow.

Kamer van Koophandel shares how it embedded secure coding into everyday development through role-based certifications, Trust Score benchmarking, and a culture of shared security ownership.

See how Paysafe's partnership with Secure Code Warrior led to a 45% boost in developer productivity and a major reduction in code vulnerabilities.

DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.

Explore the Devlympics 2023 results in this report. Dive into developer engagement, tech stack and languages trends in each industry that participated, and key vulnerabilities and CWEs covered in the annual global event hosted by Secure Code Warrior.

Discover how Sage enhanced security with a flexible, relationship-focused approach, creating 200+ security champions and achieving measurable risk reduction.

Discover how Workday transformed developer training with agile learning through Secure Code Warrior. By empowering developer with hands-on, language-specific education, Workday reduced vulnerabilities early in the SDLC. See their impressive results and key takeaways to build a secure code culture.

In this case study, learn how Thales has developed people, process, and technology approaches for an agile secure code learning program in order to engage developers to become active security champions.

Discover how retail giant Colgate-Palmolive reshaped its application security during its digital transformation journey. Facing challenges in secure coding, they innovated their approach by integrating bite-sized, in-context learning into the developer workflow.

Learn how Blue Prism, the global leader in intelligent automation for the enterprise, used Secure Code Warrior's agile learning platform to create a security-first culture with their developers, achieve their business goals, and ship secure code at speed

IAG Group is the name behind many of the leading insurancecompanies in the Asia-Pacific region, underwriting policies formillions of customers to the tune of approximately AUD $11.4 Billionin premiums per annum.

Learn how they created an in-house technology education initiative, aimed at supporting thousands of employees to learn practical, cutting-edge skills in a number of disciplines, including machine learning and cybersecurity.

Explore this comprehensive case study to learn more about how they utilized Secure Code Warrior's tournaments to engage developers, increase awareness of key vulnerabilities affecting automotive software, and gain metrics across multiple languages and frameworks.

​The cybersecurity industry, which has been advocating for “security by design” principles for more than a decade, stands in wide-eyed amazement at the risks posed by artificial intelligence (AI). As organizations rush to embrace AI enablement, a CISO’s most pressing priority is to avoid becoming a roadblock. However, without effective AI usage and governance, observability and traceability, organizations may be blindsided by their AI risk.​

Secure Code Warrior has introduced the SCW AI Adoption Model, a framework designed to help organisations govern AI use in software development as the industry shifts from the traditional software development lifecycle (SDLC) toward what the company calls the Agentic Development Lifecycle (ADLC).

With many software engineering teams moving from AI coding assistants into full agentic AI code generation and increasing the amount of code they produce exponentially, ensuring the security of that code must be a top priority. The study produces practical guidance for organizations that are getting on board the AI-assisted or agentic code development train.

Token use can create unexpected, sizeable costs for organizations.

AI enables faster development cycles and allows developers to focus on higher-value work. For many businesses, these efficiencies are becoming essential to remaining competitive. The challenge, therefore, is not whether to adopt AI, but how to do so responsibly. Businesses that invest in developer education, governance frameworks, AI observability and robust security controls will be better positioned to capture the benefits while limiting the associated risks.

The issue is no longer simply about protecting AI models themselves. Increasingly, attackers are focusing on the software ecosystem surrounding those models, including the development tools, middleware, open-source libraries, and automated deployment pipelines that organisations rely upon every day.

As we will unpack together, there is a lot of movement around the world, with some collaboration between nations, but the path forward is far from uniform or clear, particularly in business environments where AI adoption is often mandated before holistic safeguarding measures are in place.  

According to one expert, AI guardrails are not designed as “security boundaries” but rather to influence behaviour – but what if that behaviour is hacking one of your industry partners?

‍

Cyber security experts have warned that the breach of Hugging Face infrastructure during an OpenAI security evaluation marks a turning point in the risks posed by autonomous AI agents. In the incident, AI models moved beyond a controlled test and carried out a live, multi-stage intrusion against the AI platform.

AI-generated code introduces an average of 15 confirmed vulnerabilities per codebase, research published by Secure Code Warrior indicates.

Frontier AI is facing a PR crisis. After Hugging Face released a blog post on July 16 claiming an autonomous agent had breached its internal environment, OpenAI posted on July 21 that the incident occurred when GPT 5.6 Sol and a “pre-release model” escaped a controlled testing environment.

Secure Code Warrior research reveals AI-generated code introduces an average of 15 vulnerabilities per codebase.

‍

Secure Code Warrior introduced the SCW AI Trust Index, a living benchmark for AI coding security that grows with every new model, helping organizations understand and govern the security risks introduced by AI-generated code. Built on a methodology created with RMIT University, Australia, then extended by Secure Code Warrior, the research presents comprehensive benchmarks on how often leading LLMs produce insecure code, with material implications for every enterprise scaling AI-assisted development.

AI-generated code introduces 15 vulnerabilities on average per codebase, but the actual risk depends on framework pairing more than the model used.

New SCW AI Trust Index shows AI-generated coding risk is not random, it's predictable by model and framework, giving security leaders the data to safely scale AI-assisted development.

The challenges with AI implementation, constant updates, and the race for industry dominance are coming thick and fast, and security professionals are among the most affected by its vast risk profile.

The Australian government has said AI is very much in the country’s future national interest – but where does it stand today? Here’s what the industry’s best and brightest have to say about artificial intelligence and its role in the modern enterprise.

‍

The emergence of agentic AI marks a structural shift in software development, introducing systems that not only accelerate production cycles but also perform autonomous reasoning and action beyond direct human control.

As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production.

This category has taken on new urgency in 2026 for a reason that’s specific to this moment: AI coding tools and agents are dramatically increasing how much code gets written and how often it needs to be deployed, tested, and provisioned for. Platform engineering is the layer that determines whether that increased velocity translates into shipped value or into chaos.

According to a recent report from Gartner, the rampant use of shadow AI and rogue automation is further fueling the proliferation of AI vulnerabilities. Gartner notes that 32% of IT workers using generative AI tools at work say they keep them hidden from cybersecurity teams. Combined with low-code/no-code platforms and vibe coding practices, the AI copilots are greatly expanding the enterprise attack surface.

For this article, we asked a central question for security and risk leaders: "What differentiates a policy that genuinely mitigates enterprise risk from one that exists primarily to demonstrate that the organization has acknowledged AI risk?"

Secure Code Warrior's Pieter Danhieux on Managing AI-Driven Development Risks

As generative AI cements its place in enterprise software development, a familiar discipline is taking on new urgency: risk management.

Secure Code Warrior have today announced SCW Trust Agent: AI, the industry’s first governance solution designed to make Artificial Intelligence (AI) influence in software development visible, attributable, and enforceable at the point of commit — enabling enterprises to scale AI coding tools with measurable control over software risk.

Even as we restructure the SDLC around the most impactful elements of the Agile methodology with careful, DevSecOps-centric security considerations, is this the end of the road for AppSec as we know it?

Global InfoSec Awards 2026 Secure Code Warrior Wins Outstanding Achievement in Cybersecurity Risk Management and Compliance Excellence

New AI Software Governance solution makes AI-generated code visible at commit, enforces policy before production, and connects real development behavior to measurable risk reduction.

Secure Code Warrior (SCW) this week added an artificial intelligence (AI) agent that both identifies code generated by an AI coding tool and automatically applies the appropriate governance policies.

Secure Code Warrior has launched SCW Trust Agent: AI, a software governance product that tracks the use of AI coding tools in development and links that usage to software risk when developers commit code.

2026 Globee® Awards for Cybersecurity: Secure Code Warrior Wins Gold Globee for Software Development Cybersecurity Solutions (Best Of)