Sam Stepanyan  🐘

@securestep9@infosec.exchange
953 Followers
129 Following
565 Posts

https://twitter.com/securestep9

#OWASP London Chapter Leader(@OWASPLondon). Application Security (#AppSec) Architect & Consultant. OWASP Global Board Member. OWASP Nettacker Project co-leader. #CISSP

Bloghttps://medium.com/@securestep9
Sam Stepanyan  🐘4d ago

#Antgravity - an AI code editor from Google that has access to your entire codebase and terminal had a Remote Code Execution (#RCE) vulnerability - a great find and write-up by @HacktronAI earning them $10k #BugBounty!
#BugBountyTips
👇

https://www.hacktron.ai/blog/hacking-google-antigravity

RCE in Google's AI code editor Antigravity - $10000 Bounty

Hacktron AI Research Team discovered a critical RCE in Google’s Antigravity IDE that lets attackers take over your system just by opening a malicious website.

Hacktron AI
Sam Stepanyan  🐘6d ago

Malicious updates were published to official #dYdX trading packages on #npm and #PyPI, delivering a wallet stealer and remote access malware.

Malware was published via compromised maintainer accounts:
#SoftwareSupplyChainSecurity
👇
https://thehackernews.com/2026/02/compromised-dydx-npm-and-pypi-packages.html

Compromised dYdX npm and PyPI Packages Deliver Wallet Stealers and RAT Malware

Compromised dYdX npm and PyPI packages delivered wallet-stealing malware and a RAT via poisoned updates in a software supply chain attack.

The Hacker News
Sam Stepanyan  🐘Feb 4

#ReactNative: Critical vulnerability in Metro server for #React Native CVE-2025-11953 allows unauthenticated attackers to execute arbitrary OS commands via a POST request is actively exploited - patch now!
#Metro4Shell
#SoftwareSupplyChainSecurity
👇

https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-react-native-metro-bug-to-breach-dev-systems/
https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-react-native-metro-bug-to-breach-dev-systems/

Hackers exploit critical React Native Metro bug to breach dev systems

Hackers are targeting developers by exploiting the critical vulnerability CVE-2025-11953 in the Metro server for React Native to deliver malicious payloads for Windows and Linux.

BleepingComputer
Sam Stepanyan  🐘Feb 3

The number of startups, products and workflows built on #chatGPT-4.x models is huge!

This is your reminder that #OpenAI will be *retiring all* gpt-4.x, o4-mini and some gpt-5 models next week on February 13th, 2026 🍿:
#AIBOM
👇
https://help.openai.com/en/articles/20001051-retiring-gpt-4o-and-other-chatgpt-models

Sam Stepanyan  🐘Feb 2

#Notepad++ Official Update Mechanism Was Hijacked to Deliver Malware.

Notepad++ downloads between September 2 - December 2, 2025 were diverted to malicious servers.
#SoftwareSupplyChainSecurity
👇
https://thehackernews.com/2026/02/notepad-official-update-mechanism.html

Notepad++ Official Update Mechanism Hijacked to Deliver Malware to Select Users

State-backed attackers hijacked Notepad++ update traffic via a hosting provider breach, redirecting users to malicious downloads since June 2025.

The Hacker News
Sam Stepanyan  🐘Jan 30

#AI on Australian travel company website sends tourists to nonexistent hot springs, describing a non-existing site as a “tranquil haven" rated “favourite among hikers", causing "droves of tourists" turning up in places with no services/cell coverage:

https://edition.cnn.com/2026/01/28/travel/ai-tourism-nonexistent-hotsprings-intl-scli

AI on Australian travel company website sends tourists to nonexistent hot springs

An AI-generated blog on a tour company’s website has landed tourists in hot water — and not the kind they were looking for — after it emerged the “tranquil” northern Tasmania hot springs it recommended don’t actually exist.

CNN
Sam Stepanyan  🐘Jan 30
#Ivanti: Two Ivanti EPMM #ZeroDay Unauthenticated #RCE Vulnerabilities CVE-2026-1281 & CVE-2026-1340 Actively Exploited, Patch Now!
👇
https://thehackernews.com/2026/01/two-ivanti-epmm-zero-day-rce-flaws.html
Two Ivanti EPMM Zero-Day RCE Flaws Actively Exploited, Security Updates Released

Ivanti released fixes for two actively exploited EPMM zero-day RCE flaws, including CVE-2026-1281 added to CISA’s KEV, affecting versions before 12.8.

The Hacker News
Sam Stepanyan  🐘Jan 29
#OpenSSL Critical Vulnerabilities Allow Remote Attackers to Execute Malicious Code (CVE-2025-15467). Patches released:
👇
https://cybersecuritynews.com/openssl-vulnerabilities-code-execution/
Sam Stepanyan  🐘Jan 23

#ESA: European Space Agency's cybersecurity in freefall as yet another breach exposes spacecraft and mission data:

#databreach

👇
https://www.bitdefender.com/en-gb/blog/hotforsecurity/european-space-agencys-cybersecurity-in-freefall-as-yet-another-breach-exposes-spacecraft-and-mission-data

European Space Agency's cybersecurity in freefall as yet another breach exposes spacecraft and mission data

It has just been a few weeks since we reported on the Christmas cyber attack suffered by the European Space Agency (ESA), and the situation has already become worse.

Hot for Security
Sam Stepanyan  🐘Jan 23

#Python : Malicious #PyPI Package called 'sympy-dev' Impersonates #SymPy, Deploys XMRig Miner on Linux Hosts:

#SoftwareSupplyChainSecurity
👇
https://thehackernews.com/2026/01/malicious-pypi-package-impersonates.html

Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts

A fake sympy-dev package on PyPI impersonates the SymPy library to download and run XMRig cryptominers on Linux using in-memory execution.

The Hacker News