Thursday , June 5 2025
owasp

OWASP discloses data breach caused by wiki misconfiguration

The nonprofit OWASP warned its members about a possible data breach that could have affected anyone who was a member of the organization from 2006 to 2014.

The foundation released a statement on Friday, saying they found old resumes on an old Wiki server in late February.

CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed

IBM has issued a security advisory for vulnerabilities in its QRadar Suite Software and Cloud Pak for Security platforms. These...
Read More
CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed

ALERT
Thousands of IP addresses compromised nationwide: CIRT warn

As Bangladesh prepares for the extended Eid-ul-Adha holidays, the BGD e-GOV Computer Incident Response Team (CIRT) has issued an urgent...
Read More
ALERT  Thousands of IP addresses compromised nationwide: CIRT warn

New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

In March 2025, the Threatfabric mobile Threat Intelligence team identified Crocodilus, a new Android banking Trojan designed for device takeover....
Read More
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Qualcomm has issued security patches for three zero-day vulnerabilities in the Adreno GPU driver, affecting many chipsets that are being...
Read More
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Critical RCE Flaw Patched in Roundcube Webmail

Roundcube Webmail has fixed a critical security flaw that could enable remote code execution after authentication. Disclosed by security researcher...
Read More
Critical RCE Flaw Patched in Roundcube Webmail

Hacker claim Leak of Deloitte Source Code & GitHub Credentials

A hacker known as "303" claim to breach the company's systems and leaked sensitive internal data on a dark web...
Read More
Hacker claim Leak of Deloitte Source Code & GitHub Credentials

CISA Issued Guidance for SIEM and SOAR Implementation

CISA and ACSC issued new guidance this week on how to procure, implement, and maintain SIEM and SOAR platforms. SIEM...
Read More
CISA Issued Guidance for SIEM and SOAR Implementation

Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

The Qualys Threat Research Unit (TRU) found two local information-disclosure vulnerabilities in Apport and systemd-coredump. Both issues are race-condition vulnerabilities....
Read More
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

Australia enacts mandatory ransomware payment reporting

New ransomware payment reporting rules take effect in Australia yesterday (May 30) for all organisations with an annual turnover of...
Read More
Australia enacts mandatory ransomware payment reporting

Why Govt Demands Foreign CCTV Firms to Submit Source Code?

Global makers of surveillance gear have clashed with Indian regulators in recent weeks over contentious new security rules that require...
Read More
Why Govt Demands Foreign CCTV Firms to Submit Source Code?

The organization calls itself the “world’s largest non-profit organization concerned with software security” and has more than 250 chapters around the world with tens of thousands of members.

The OWASP Foundation’s Executive Director, Andrew van der Stock, said around 1,000 resumes were on the server, but he wasn’t sure if there were any duplicates.

Van der Stock believes that only OWASP staff have accessed the server, and it was archived by the Wayback Machine in 2023 but not re-indexed.

“Unfortunately, the log retention policy on the small VPS [Virtual Private Server] it was hosted upon only means we have limited logs, so we don’t think it was widely accessed, but as the misconfiguration dates back to at least 2019 when the VPS was first stood up, we simply don’t know, and as the file system is small, any old data would have been long overwritten even if forensics was possible,” he said.

Van der Stock explained that it was difficult to find the directory with the resumes because it was not indexed separately from the organization’s Wiki installation.

“So in all likelihood, considering that we only just got our first support tickets about it means that it wasn’t widely accessed prior to February 2024,” he said.

OWASP has advised that anyone who was a member between 2006 and 2014 and had submitted a resume should assume their information was compromised.
The organization collected the data during a membership process where applicants had to show connections to the OWASP community. They no longer ask for resumes and use cloud-based security practices to protect member information.

OWASP has addressed the issue by disabling directory browsing, reviewing the web server and MediaWiki configuration for other security problems, completely removing the resumes from the wiki site, and clearing the CloudFlare cache to prevent further access.

“Lastly, we have requested that the information be removed from the Web Archive,” the organization said.

OWASP had to make this issue public because many people who could be affected are no longer members and it’s hard to contact them.

According to OWASP, affected individuals don’t need to do anything because the information has been removed from the internet. However, they should be cautious of possible scam attempts if any of the resume information is still valid.

“We recognize the significance of this breach, especially considering the OWASP Foundation’s emphasis on cybersecurity. We apologize to those affected by the breach and are committed to ensuring that this does not happen again,” the notice said.

“We are reviewing our data retention policies and will be implementing additional security measures to prevent future breaches.”

 

Check Also

mobile

Bank server compromised using customer’s mobile, steal ₹11 crore

Cyber fraudsters hacked the Himachal Pradesh State Cooperative Bank’s server using a customer’s mobile phone. …

Leave a Reply

Your email address will not be published. Required fields are marked *