Safeguard on social

CVE-2026-114625, a SQL injection in on-prem Arista VeloCloud Orchestrator, was added to CISA's Known Exploited Vulnerabilities catalog on 23 October. Three checks today: 1) do you run it on-prem (Hosted and Dedicated are already patched by Arista)? 2) is your build 5.2.3.18, 6.1.3.10, 6.4.2.12 or later? 3) is the web portal limited to admin networks, and have you reviewed the logs? Full write-up: https://na2.hubs.ly/H08CCbV0

CVE-2026-114625, a SQL injection in on-prem Arista VeloCloud Orchestrator, went into CISA's Known Exploited Vulnerabilities catalog on 23 October. Arista says it is known to be actively exploited, and that any authenticated user, down to the Enterprise Read Only role, can act as the local superuser operator. Three checks to run today: 1. Do you run your own orchestrator? Arista has already patched Hosted and Dedicated VCO. The work is for on-prem installs. 2. Is your build fixed? The fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12, and later. Builds that fixed the earlier VCO flaws sit inside the affected ranges. 3. Who can reach the portal? Limit the web portal to admin networks, block the two source IP addresses in Arista's advisory, and review web access logs for the patterns it lists. Safeguard does not scan the appliance itself, so this starts as an inventory question: do you know which orchestrator versions you run, and who owns them? Full write-up with the version table and Arista's indicators: https://lnkd.in/grm4cDGH Sources: CISA KEV entry added 23 October 2026 (federal due date 26 October); Arista Security Advisory 0199. #VeloCloud #CISAKEV #NetworkSecurity #VulnerabilityManagement

CVE-2026-114625, a SQL injection in on-prem Arista VeloCloud Orchestrator, was added to CISA's Known Exploited Vulnerabilities catalog on 23 October. Three checks today: is it on-prem, is the build 5.2.3.18, 6.1.3.10, 6.4.2.12 or later, and is the web portal limited to admin networks with logs reviewed. Link in bio: http://safeguard.sh/resources/blog/arista-velocloud-orchestrator-cve-2026-114625-exploited #VeloCloud #CISAKEV #NetworkSecurity

CVE-2026-114625, SQL injection in on-prem Arista VeloCloud Orchestrator, is in CISA KEV (23 Oct). Today: 1) on-prem, not Hosted? 2) build at 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later? 3) portal limited to admin networks, logs reviewed? https://t.co/thMtrqRtBN https://t.co/Iz791ryy2K

A person holds about four things in mind at once. Some AI models now hold a million tokens, word for word. So the worry becomes memory. That is the wrong worry. A model has no hard line between instructions and data. Your system prompt, your request, a retrieved web page and a tool result all arrive as tokens in one channel, and any of them can steer what an agent does next. That is prompt injection. A bigger window just gives it more room. What helps is structural, not clever prompting. Know every source that writes into an agent's context and who controls it. Then keep the agent's tools narrow: an agent that reads untrusted content should not send email or push code without a person approving it. We wrote the long version, with the research behind each point (Cowan on working memory, the "lost in the middle" results, OWASP's LLM01) and where Safeguard's AI-BOM discovery, MCP Guardrail and AI Gateway fit. Link in the first comment. #AISecurity #PromptInjection #LLMSecurity #AppSec

You can hold about four things in mind at once. Some AI models hold a million tokens, word for word, with no hard line between your instructions and a stranger's web page. That's how a tool result or a web page ends up steering an AI agent. Guard what reaches the context, and keep the agent's tools narrow. Full post on http://safeguard.sh (link in bio). #AISecurity #PromptInjection #AIAgents #LLM #CyberSecurity #AppSec #MachineLearning #SecurityEngineering

A person holds about four things in mind at once. Some AI models now hold a million tokens, word for word. So the worry becomes memory. That is the wrong worry. A model has no hard line between instructions and data. Your system prompt, your request, a retrieved web page and a tool result all arrive as tokens in one channel, and any of them can steer what an agent does next. That is prompt injection. A bigger window just gives it more room. What helps is structural, not clever prompting. Know every source that writes into an agent's context and who controls it. Then keep the agent's tools narrow: an agent that reads untrusted content should not send email or push code without a person approving it. We wrote the long version, with the research behind each point (Cowan on working memory, the "lost in the middle" results, OWASP's LLM01) and where Safeguard's AI-BOM discovery, MCP Guardrail and AI Gateway fit. Link in the first comment. {{facebook_mention(387724268017738|#AISecurity)}} {{facebook_mention(5788320984513346|#PromptInjection)}} {{facebook_mention(6864217526962732|#LLMSecurity)}} {{facebook_mention(126104680913617|#appsec)}} https://na2.hubs.ly/H08C0640

Your brain holds about four chunks at once. Some AI models hold a million tokens, word for word, and instructions and data share one channel. Full post: https://na2.hubs.ly/H08C05j0 In 40 seconds: why anything in an LLM's context window can steer an agent (prompt injection, indirect prompt injection through retrieved pages, tool results and MCP servers), and the two controls that matter most: know what feeds the context, and narrow what each agent is allowed to do. Sources cited in the post include Cowan (2001) on working memory, Liu et al. (2023) "Lost in the Middle", and the OWASP Top 10 for LLM Applications (LLM01: prompt injection). #Shorts #AISecurity #PromptInjection #LLM

People hold about four chunks in working memory. Some models hold a million tokens, word for word. The risk isn't memory. Instructions and data share one channel, so a web page or a tool result sitting in context can steer an agent. https://t.co/rIpuBNjrur

Your first big customer sends over the security review. One line on it decides the deal: SOC 2 Type II report. For a five person startup, the tooling alone is a real line item. Established compliance automation starts around $4,000 to $15,000 a year. Ours is $1,699 a year, flat, for startups under 10 people. That is the lowest credible SOC 2 Type II automation price for a team that size. What it covers: Controls, evidence and tests sit in one place in Safeguard. Tests and evidence collection run on a schedule, so evidence builds up while you ship instead of in a scramble before the audit window. The same plan also covers your application security and your software supply chain. One subscription, not a compliance tool plus a separate security tool. Two things to be plain about. Audit fees are separate. The CPA firm's attestation is not part of the $1,699. If you want help there, we can coordinate the audit with an independent, accredited auditor, quoted per engagement. The rate is for startups under 10 people. Past that, standard pricing applies. Pricing is public: https://lnkd.in/giUMQeAJ #SOC2 #StartupSecurity #Compliance #AppSec

Your first big customer just asked for a SOC 2 Type II report. Established compliance tools start around $4,000 to $15,000 a year. For startups under 10 people, Safeguard's SOC 2 Type II automation is $1,699 a year, flat. The same plan covers your app and supply chain security. Audit fees are separate. Pricing: http://safeguard.sh/pricing (link in bio) #SOC2 #SOC2TypeII #StartupLife #Founders #SaaS #Compliance #CyberSecurity #AppSec

Your first big customer asks for a SOC 2 Type II report. Established compliance tools start around $4,000 to $15,000 a year. For startups under 10 people, Safeguard's SOC 2 Type II automation is $1,699 a year, flat, and the same plan covers application and supply chain security. Audit fees are separate. The rate applies to startups under 10 people. Pricing: https://na2.hubs.ly/H08C02j0 #SOC2 #Startups #Compliance

Your first big customer sends over the security review. One line on it decides the deal: SOC 2 Type II report. For a five person startup, the tooling alone is a real line item. Established compliance automation starts around $4,000 to $15,000 a year. Ours is $1,699 a year, flat, for startups under 10 people. That is the lowest credible SOC 2 Type II automation price for a team that size. What it covers: Controls, evidence and tests sit in one place in Safeguard. Tests and evidence collection run on a schedule, so evidence builds up while you ship instead of in a scramble before the audit window. The same plan also covers your application security and your software supply chain. One subscription, not a compliance tool plus a separate security tool. Two things to be plain about. Audit fees are separate. The CPA firm's attestation is not part of the $1,699. If you want help there, we can coordinate the audit with an independent, accredited auditor, quoted per engagement. The rate is for startups under 10 people. Past that, standard pricing applies. Pricing is public: https://na2.hubs.ly/H08C01l0 {{facebook_mention(370570193052123|#SOC2)}} {{facebook_mention(663661833668814|#StartupSecurity)}} {{facebook_mention(150837038412761|#compliance)}} {{facebook_mention(126104680913617|#appsec)}}

SOC 2 Type II automation for startups under 10 people: $1,699 a year, flat. Established tools start around $4,000 to $15,000. Same plan covers your app and supply chain security. Audit fees are separate. https://t.co/MuSxHZZb9p https://t.co/93coQlJxxz

Safeguard's partner program is open worldwide. 30% margin in year one. 35% on deals registered with us. Four ways to partner: resell with margin, white-label under your own brand, co-sell on shared accounts, or offer managed services. Link in bio: http://safeguard.sh/company/partners #PartnerProgram #MSSP #Cybersecurity #Channel

Safeguard's partner program is open worldwide. Partners get a 30% margin in year one, and 35% on deals registered with us. Four ways to partner: resell with margin, white-label under your own brand, co-sell on shared accounts, or offer managed services. It suits partners with in-market credibility and technical depth. Details and how to apply: https://na2.hubs.ly/H08CC740

Safeguard's partner program is open worldwide. Partners get a 30% margin in year one, and 35% on deals registered with us. Four ways to work with us: 1. Resell with margin. Local resellers and distributors sell in their own currency and language, with in-region support. 2. White-label. Run Safeguard under your own brand and own the customer. We power detection, remediation and evidence underneath. 3. Co-sell. Deal registration, named account alignment and joint pursuit support. 4. Managed services. MSSPs and managed security teams offer Safeguard as part of a broader service. It suits partners with in-market credibility and technical depth. Program details and how to apply: https://lnkd.in/gyQpJXK8 #PartnerProgram #MSSP #Cybersecurity #ChannelPartners

A Zero Day has no CVE, so there's nothing for a feed to match. The answer is a loop: detect, decide, fix, source a safe component, verify, prevent. Your people set the rules. The full guide is on the Safeguard blog. #appsec #cybersecurity #zeroday #devsecops #softwaresupplychain #vulnerabilitymanagement #opensource #infosec

A Zero Day has no CVE, no advisory and usually no fix, so a scanner that only matches public feeds has nothing to match. This Short walks the loop that handles it: detect, decide, fix, source a safe component, verify, prevent. Full guide: https://na2.hubs.ly/H08B-RX0 Covered: SAST and SCA for detection, reachability analysis with EPSS and KEV for prioritization, policy gates, automated remediation as a tested pull request, a safe version from Gold Open Source (free, no login), rescan to verify, and prevention in the IDE, at install time and in the CI gate. Autonomous remediation in Safeguard ships switched off until an admin turns it on. #Shorts #AppSec #ZeroDay

A Zero Day has no CVE. So a scanner that only matches public feeds has nothing to match. There is no advisory and usually no fix. CISA's KEV catalog can't list it either, because KEV needs a CVE ID first. Waiting on the feed is the one plan that cannot work here. What works is a loop that does its own hand offs, with no ticket queue in the middle: Detect: known and novel flaws, in your code and in your dependencies. Decide: rank by what your application actually calls, then apply policy. Fix: a tested pull request, not a ticket. Source: move to a safe version of the component. Verify: rescan the merged commit. If the finding is still there, it isn't fixed. Prevent: stop that class of flaw in the IDE, at install time and in CI. People stay in charge. They decide which classes of fix may run without review and who can grant an exception, and for how long. Autonomy is earned one class of fix at a time. Suggest only first. Then pull requests that open automatically and a person merges. Then your own repository rules for the safest class. In Safeguard, autonomous remediation ships switched off until an admin turns it on. The full guide maps the loop to NIST SSDF and includes a decision table and a 30/60/90 day rollout. https://na2.hubs.ly/H08B-RW0 {{facebook_mention(126104680913617|#appsec)}} {{facebook_mention(779364722076485|#SoftwareSupplyChain)}} {{facebook_mention(382387348541671|#VulnerabilityManagement)}} {{facebook_mention(622676334446997|#DevSecOps)}}