Researching and Remediating RCEs via GitHub Actions - Bar Kaduri, Roi Nisimi - ASW #355
Pull requests are a core part of collaboration, whether in open or closed source. GitHub has documented some of the security consequences of misconfiguring how PRs can trigger actions. But what happens when repo owners don't read the docs? Bar Kaduri and Roi Nisimi walk through their experience i...
Researching and Remediating RCEs via GitHub Actions - Bar Kaduri, Roi Nisimi - ASW #355
Pull requests are a core part of collaboration, whether in open or closed source. GitHub has documented some of the security consequences of misconfiguring how PRs can trigger actions. But what happens when repo owners don't read the docs? Bar Kaduri and Roi Nisimi walk through their experience i...
Researching and Remediating RCEs via GitHub Actions - Bar Kaduri, Roi Nisimi - ASW #355
Pull requests are a core part of collaboration, whether in open or closed source. GitHub has documented some of the security consequences of misconfiguring how PRs can trigger actions. But what happens when repo owners don't read the docs? Bar Kaduri and Roi Nisimi walk through their experience i...
Researching and Remediating RCEs via GitHub Actions - Bar Kaduri, Roi Nisimi - ASW #355
Pull requests are a core part of collaboration, whether in open or closed source. GitHub has documented some of the security consequences of misconfiguring how PRs can trigger actions. But what happens when repo owners don't read the docs? Bar Kaduri and Roi Nisimi walk through their experience i...
April 17, 2024 - Cyber Briefing
👉 What's trending in cybersecurity today?
🚨 #CyberAlerts
Cisco Issues Global Alert on Brute-Force Attacks Targeting VPN and SSH Services
Source: Cisco Talos
Command-Line Interface Vulnerability Exposes AWS and Google Cloud Credentials
Source: Roi Nisimi via Orca Security
Secret Key Reco...
Securing the Apps Everyone Is Building with Roi Nisimi and Yonatan Levi
What happens when your marketing team, your sales team, and the person down the hall can all ship a full app from a single prompt? And what is that app quietly connected to? In this episode, Ron sits down with Roi Nisimi, Principal Security Researcher, and Yonatan Levi, AI Security Researcher, of...
40k apps; 40 days; 1 public key
App generators can ship a working app in an afternoon, and many of them build on the same backend-as-a-service: Supabase. That shared foundation means one misconfiguration can repeat across thousands of deployments.
Ari Marzuk, Lead Security Researcher at Salesforce, and Roi Nisimi, Principal Se...
