OWASP Top Ten 2025 and AI Vulnerability Scoring System; CMMC Rollout for Defense Contractors; JLR Attack Slowed UK GDP Growth

The OWASP Top Ten List is an excellent resource and should be shared with development teams everywhere. However, this should only be one step in encouraging development teams to build security in by design and by default. Development teams need proper training, resourcing, and tools to enable them to develop secure code. The Top Ten List is an important resource for them but should not be relied upon on its own to be the answer to developing secure code.

Had to read that twice: OWASP is unveiling a new scoring system for agentic AI, which includes an AIVSS score which is intended to take the place of the CVSS score when looking at flaws in agentic AI. In the top 10, SSRF, formerly #10, is now combined with #1. Security Logging and Monitoring Failures is now Logging & Alerting Failures. Now at #10, we have a new item Mishandling of Exceptional Conditions, which covers improper error handling, logical errors, failing open and other related scenarios relating to abnormal conditions that systems may encounter. Anybody else looking for a sed-a-give?

Interesting that they are moving away from specific bugs (aka SQL Injection) to generic bug classes. It’s the right move but it will put into question scanners (or tests) that include coverage for the OWASP Top 10. For example, to include all “injection bugs” could be a very long list of bugs to test for in it of itself. What is also interesting is that something I’ve been yelling at for years is now front and center. As the industry moved towards Microservices and APIs, we took all the opinionated frameworks that demanded safety and threw them out the window. Now with Microservices much of this you must do “yourself,” which has shown up as things like Broken Authentication logic.

OWASP has taught us (including me) a lot about application security. Our web applications are much better than they might have been without their effort. We owe them a debt. That said, our systems have become more complex faster than they have become better. Even if risk has not grown faster than use, uses, and users, it is clearly approaching existential levels.

CMMC 2.0 is here. If you're a Defense contractor, make sure that you're already implementing needed controls, regardless of perceived gaps; this marks the beginning of the first phase of a three-year implementation plan. Phase 1 allows self-attestation of compliance for CMMC Level 1 & 2. Phase 2 starts November 2026, and requires a certified third party assessor organization (C3PAO). Phase 3 begins November 2027, and requires certification from the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). Note that you can move to the external assessors sooner than those phases require, and you're going to need to make sure you're implementing needed controls, policies and processes. Allow more time than you think you need — you don't want to be caught unprepared and lose contracts.

What we have now, best characterized by shoddy software, may be "mature," but it is not effective or efficient. It leaves us with existential risk. Effective and efficient cybersecurity requires both quality components and organizational culture. Hopefully this program will move us in that direction. However, it may well be that cybersecurity will never be better than it is now, the absolute worst that we can get away with.

The fact that a single cyberattack measurably affected the UK’s GDP underlines how deeply our economies now rely on digital resilience. While business continuity and incident response planning have long been viewed as technical exercises, this case shows their wider economic significance. Cybersecurity can no longer be treated as an internal IT issue, it’s now a critical component of national economic stability, and organisations now need to revisit their upstream and downstream supply chain dependencies, resilience plans, and recovery objectives. The ripple effect from JLR’s shutdown should be a wakeup call for every organisation to treat digital resilience as a core business priority, but sadly many will most likely hit the snooze button.

Usually having the title of Number One in anything is a good thing; that's not the case when it comes to experiencing a cyber event. This incident will become a case study in graduate level business classes taught throughout the world. Alas, it was likely preventable, with appropriate management oversight of the cybersecurity program.

Turns out the Automotive Industry is important to countries. Yes, JLR is a massively important supply chain in the UK. The fact that it took this long to turn things on is alarming. There will be a lot of fallout from this incident.

The JLR attack is thought to be the first case where a cyberattack caused material economic and fiscal harm to the UK. When calculating impact, make sure to include third-party impacts, like suppliers where a significant part of their business depends on your viability. Your recovery may be dependent on their viability; make sure that is part of your planning.

Of course it did. No economy can absorb the impact of such a massive management failure. We cannot continue to run our economy with an information infrastructure built with duct tape, glue, and baling wire.

It seems like we just went through this doesn't it? I am putting a reminder on my calendar to check/restart browsers weekly, likely a Monday thing — start the week off fresh. There is some debate as to whether the flaws categorized as medium are really critical; at this point the time spent debating the criticality versus just rolling out an updated browser isn't worth it: just do it. Where you're managing browsers, you may want to shorten the max interval users can defer the browser update. These days 48 hours is really too long. Don't forget to track updates on all your platforms, not just Win/Mac.

GOOG and other browser vendors have made it oh so simple to install updates. Make it a habit to restart your browser on a daily basis. It takes less than a minute, and the security geeks will love you for it.

We cannot patch our way to necessary quality. Browser quality has only gotten worse since the ambitious claims that were made for Chrome security when it was introduced. Browser security is an over-constrained problem. We need to invest more in purpose-built clients and less in maintaining browsers. We need to be asking why mobiles are so much more secure than personal computers? Think process-to-process isolation. Even though cross application communication has increased in mobiles, we do not see the same degree of application to application corruption that we see in personal computers. Patching is at best a tactic in a weak strategy.

Unicode is about more than funny domain names. Look-alike characters, variant selectors, and type direction are issues that are not understood by most developers and affect any modern Unicode-capable application and programming language.

If this article is kind of confusing to you, OpenVSX is the Eclipse IDE marketplace. If you use VSCode you will be familiar with extensions that can be malicious. Same thing, different marketplace. It works because it's easy.

Koi's blog includes IoCs for the November campaign; grab them and go hunting. The GitHub campaign seems to currently be limited to JavaScript projects. Alert developers about Unicode misuse, particularly invisible Private Use Area characters. Note that many IDEs are not showing these hidden characters, so extra diligence is required. Attackers are leveraging harvested credentials, both developer and CI tokens. Consider rotating tokens and MFA.

CBO offers an alternative to information provided by OMB and other agencies in the Executive branch. Given the government shutdown, they and any other budget related agency are likely under an increased level attack. The question is: are furloughs or other budget cuts a factor in the success of the attack? Consider how you'd respond to attacks in a similar situation; while you may not face a furlough, have you considered a strike or other scenarios where staff wasn't available, versus having to work from alternate locations?

Not much in the way of details only acknowledgment of the hack. As part of the legislative branch of government, let’s hope they understand the importance in issuing an After Action Report on the security incident.

The lessons here should be clear: disable inactive accounts immediately, limit access to only what's required, encrypt sensitive data, and do a full investigation of any breach. Verify that you have these all covered, as well as MFA, EDR and monitoring. Where you have gaps, initiate a trackable project with a vetted timeline that staff is accountable for, to ensure resolution.

"…Illuminate failed to implement reasonable data security practices designed to protect students’ personal information." There’s that ‘reasonable’ word used in a settlement agreement again. The Center for Internet Security has published “A Guide to Defining Reasonable Cybersecurity” that specifies what an organization must do to meet the standard of reasonable cybersecurity. It also shows how a set of controls can be implemented in a manner that gives users the ability to assess whether reasonable cybersecurity measures were taken. Use it and don’t be a victim.

https://www.cisecurity.org/insights/white-papers/reasonable-cybersecurity-guide