Secure your agentic development
New York, NY
Joined January 2019
- Tweets420
- Following463
- Followers7.3K
- Likes232
Pinned Tweet
We sat down with Adam Jordan (@XYLAMIC), Distinguished Engineer & Head of Secure, Sustainable Software at Shell, to talk about how Shellโฆ
๐ค Enables autonomy to deliver secure software
๐ช Defines strong security controls and automation
๐ Measures and articulates #AppSec success
Watch the full interview with @idanplotnik ๐
apiiro.com/resource/adam-jorโฆ
๐จ Shai-Hulud is still stealing.
Apiiro Research found worm files in 110 public @github repos, committed by trusted CI bots. Opening an infected repo in @claudeai or VS Code can trigger the stealer.
The coding agent is the new perimeter.
Read ๐
apiiro.com/blog/shai-hulud-lโฆ
๐จ PHP2Shell: Find affected apps. Prioritize risk. Generate dynamic patch. AutoFix with context.
@Apiiro Guardian Agent connects to your WAF via MCP/CLI to generate dynamic patches with context from your Software Graph while fixes roll out.
Read ๐ apiiro.com/blog/php2shell-phโฆ
๐ฃ AI builds phishing kits. @huggingface hosts them. And we call it ๐๐๐ด๐ด๐ถ๐ป๐ด๐ฃ๐ต๐ถ๐๐ต.
We analyzed 182,093 DeepSite projects and found:
๐ด 57 explicit phishing requests
๐ค 18 pages wired to send creds out
๐ซ 0 refusals across those requests
Read๐
apiiro.com/blog/huggingphishโฆ
Apiiro retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
๐จ ๐ ๐ฎ๐น๐๐ฎ๐ฟ๐ฒ hiding in a photo. Inside an npm package.
Apiiro uncovered ๐๐ฎ๐ฟ๐ธ๐ฟ๐ผ๐ผ๐บ: 19 dotenv look-alikes concealing PowerShell commands in a JPEG. ๐ธ distributed through fake @github exploit repos.
๐ Full research ๐
apiiro.com/blog/darkroom-npmโฆ
๐จ Waiting for more details on the @opencode breach.
One thing is becoming crystal clear: ๐๐ผ๐ฑ๐ถ๐ป๐ด ๐ฎ๐ด๐ฒ๐ป๐๐ ๐ฎ๐ฟ๐ฒ ๐๐ต๐ฒ ๐ป๐ฒ๐ ๐ฝ๐ฒ๐ฟ๐ถ๐บ๐ฒ๐๐ฒ๐ฟ.
๐
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
Developers are no longer writing code. AI agents are.
๐ The @AnthropicAI Claude Compliance API is now integrated into the Apiiro Software Graph.
See which agent acted, what it installed, what code it generated and what it executed, in real time.
apiiro.com/demo
Apiiro joins the @chainguard_dev Athena coalition ๐ก๏ธ
AI finds zero-days faster than teams can patch. The bottleneck is fixing without breaking code.
Guardian Agent turns a shared finding into a tested Autofix.
โก Free for open source maintainers
tinyurl.com/ytvrn8jh
๐จ One pastebin edit. A 1,000-Repo Malware Network.
We uncovered CheatSheet: 1,000+ malicious @GitHub & @gitlab repos posing as game cheats to deliver password and crypto stealers.
๐ Read the full research: apiiro.com/blog/cheatsheet-fโฆ
๐ Apiiro is a ๐๐ฒ๐ฎ๐ฑ๐ฒ๐ฟ in the first-ever 2026 @Gartner_inc Magic Quadrantโข for Software Supply Chain Security.
Coding agents are the new perimeter.
๐ก๏ธ Guardian Agent: Prevent. AutoFix. Protect. Across all coding agents.
๐ apiiro.com/blog/apiiro-namedโฆ
Apiiro Security Research uncovered ๐๐ฉ๐-๐ฎ๐ฌ๐ฎ๐ฒ-๐ด๐ฎ๐ฐ๐ฑ๐ฒ, a critical vulnerability (๐๐ฉ๐ฆ๐ฆ ๐ญ๐ฌ.๐ฌ) in argocd-mcp, the MCP server connecting AI coding agents to @argoproj
๐จ Exposed HTTP servers could enable unauthorized deployments. Read ๐
apiiro.com/blog/cve-2026-824โฆ
๐จ ๐ญ๐ณ,๐ฒ๐ญ๐ฌ ๐๐ถ๐๐๐๐ฏ ๐ฟ๐ฒ๐ฝ๐ผ๐ ๐๐ฒ๐ฟ๐๐ถ๐ป๐ด ๐บ๐ฎ๐น๐๐ฎ๐ฟ๐ฒ. About 14,000 re-pushed in 34 hours.
We verified repos distributing SmartLoader in the FakeGit campaign.
The mechanism: keep the repo & change where its download button points. We call it ๐ฅ๐ฒ๐ฃ๐ผ๐ถ๐ป๐๐ถ๐ป๐ด.
Full report ๐
apiiro.com/blog/never-deleteโฆ
๐ Introducing SHINE, Apiiro's new integrations program! ๐
SHINE is a direct reflection of our goal to ๐ฌ๐๐๐ฆ๐ฅ๐๐ฌ๐ฌ๐ฅ๐ฒ connect across our customersโ stack, providing a ๐ก๐จ๐ฅ๐ข๐ฌ๐ญ๐ข๐ and ๐ข๐ง๐ญ๐๐ซ๐๐จ๐ง๐ง๐๐๐ญ๐๐ view across every facet of their applications, software supply chains, risks, and changes over time. SHINE also reflects our vendor-๐ง๐๐ฎ๐ญ๐ซ๐๐ฅ commitment to integrate with any and all security tools and processes and to ๐๐ง๐ซ๐ข๐๐ก findings with our deep code-to-runtime context.
Weโre thrilled to unveil SHINE with our anchor partnersโ@Mend_io, @Checkmarx, @jfrog, and @Bugcrowdโ and several dozens of integrations.
Read the full announcement on our blog: apiiro.com/blog/introducing-โฆ
New regulations are upping the pressure on AppSec teams. ๐๏ธ
๐คฟ Dive into our @CyberSecDive article to learn how #ASPM can lighten the load for AppSec teams and stay ahead of the risk and compliance curve. apii.ro/4beCZBA
Our new prioritization funnel makes it clear just how powerful Apiiroโs context is, enriching application security findings with key risk factors such as:
๐ฅ High business impact
๐ Deployed or internet-facing
๐ Used in code (our answer to reachability)
โ In applicative vs. test code
๐คฌ Has a high EPSS score or known exploit in CISA KEV
By understanding how likely a security finding is to be a real risk and its potential impact on your business, you can zero in on what matters most.
apiiro.com/blog/contextual-aโฆ
Curious to see how a unified AppSec approach removes friction for devs and fills the gaps left behind by vulnerability-focused and siloed security tools? This @SANSInstitute webcast does just that while offering a first look at Apiiroโs #ASPM platform.
๐ฌ Watch the on-demand recording of this in-depth conversation between @idanplotnik, Co-Founder and CEO at @ApiiroSecurity, and SANS Certified Instructor Matt Bromiley to get a look at how Apiiroโs deep ASPM platform helps you:
๐ Get complete and continuous application and software supply chain visibility
๐ข Prioritize security findings across your tools and Apiiroโs in-built solutions based on risk with deep code analysis and runtime context
๐ Accelerate the remediation of application risks and prevent risks earlier in the dev lifecycle
apiiro.com/resource/sans-webโฆ
We teamed up with @SANSInstitute , a trusted advisor in the security space for over 35 years, to give the market a First Look at application security posture management (#ASPM)!
The report, authored by SANS Certified Instructor Matt Bromiley, covers current AppSec challenges and the need for ASPM and provides an in-depth look at Apiiroโs platform and its differentiators.
โApiiroโs ASPM is a completely open platform but also includes native security capabilities that help provide fast time to value to bolster existing efforts or fill security coverage gaps, including secrets security, API security testing, sensitive data exposure prevention, and SCM and CI/CD pipeline security.โ
Get your copy to see how Apiiro provides a unified platform for measuring and reducing application risk ๐
apiiro.com/resource/sans-repโฆ
Learn how Apiiro has enabled @cloudera toโฆ
๐ฆ Deeply understand their application security posture and consolidate their AppSec tools
โ๏ธ Reduce their AppSec backlog and save time fixing risks with deep code-to-cloud context
๐งโ๐ป Proactively automate security feedback to empower developers to see the issues before they are released
Read the full case study: apiiro.com/resource/clouderaโฆ