We’re launching a series of office hours for open source maintainers! Do you need advice to secure your project’s code? Grab some time to chat with our team. Spots are limited and run until end of April github.co/36GvaIC
Pinned Tweet
Follow
Click to Follow GHSecurityLab
GitHub Security Lab
@GHSecurityLab
GitHub Security Lab’s mission is to inspire and enable the community to secure the open source software we all depend on.
securitylab.github.comJoined October 2019
GitHub Security Lab’s Tweets
Had some fun with OGNL sandboxes last year. Read how I bypassed Atlassian Confluence and Struts ones in my latest blog post
1
72
170
GHSL-2022-132_GHSL-2022-133: Server-Side Request Forgery (SSRF) and Path Injection in Metersphere - CVE-2022-23544, CVE-2022-23512
8
23
It turns out that the first "all Google" phone includes a non-Google bug. Join on his journey through reporting the bug, and the exploit used to gain arbitrary kernel code execution and root on a Pixel 6 from an Android app.
14
42
GHSL-2022-054: Use-after-free (UAF) in the Arm Mali Kernel driver - CVE-2022-38181
11
31
GHSL-2022-074: Arithmetic overflow in sysstat - CVE-2022-39377
1
7
GHSL-2023-004: Arbitrary file upload and download in act - CVE-2023-22726
2
11
If you are attending tomorrow, make sure to catch presenting with about the work done in to help security researchers with open source vulnerability disclosure ✨
Read the full guide here: github.com/ossf/oss-vulne
4
9
This Wednesday, we are at in Oslo, Norway! Join to discover Security as Code (SaC) and the latest initiatives we pursue to secure open source.
4
14
Quote Tweet
Tomorrow doors open for #CyberThreat22
We hope you enjoy all that #CyberThreat22 and #London 
has to offer
Registration starts at 08:00 – 10:00 | Chablis Suite | Novotel London West
sans.org/u/1mfN
Follow #CyberThreat22 for live social updates during the event
has to offer
Registration starts at 08:00 – 10:00 | Chablis Suite | Novotel London West
sans.org/u/1mfN
Follow #CyberThreat22 for live social updates during the event
4
9
In software development, we often neglect security, but it's vital. That’s why we’re highlighting Metasploit -- the world’s most used penetration testing framework.
We'll chat with on twitch.tv/github on Jan 13 at 1 pm ET.
RSVP: tinyurl.com/osfriday
read image description
ALT
8
15
Sponsor Alert! 🙌We are excited to Welcome as Workshop Sponsor at #NullconBerlin
😎Meet folks #securing the #opensource & network with incredible #infosec minds
Go grab your tickets👉bit.ly/3Tq3Em2
#NullconDE2023 #GreenCon #Conference #Cybersecurity
4
8
Woah, the end of the year is upon us. One of the funner activities I participated in this year was a panel with the and teams about fixing vulnerability reporting in open source. Re-watch the session here:
1
3
16
Show this thread
3
25
91
GHSL-2021-1009: URL access filters bypass in Alpine - CVE-2022-23553
3
18
GHSL-2021-1010: Authentication bypass in Alpine - CVE-2022-23554
6
31
GHSL-2022-061: Bearer token disclosure in ghinstallation - CVE-2022-39304
2
8
GHSL-2022-112_GHSL-2022-115: Remote denial of service in Linux kernel WILC1000 wireless driver - CVE-2022-47518, CVE-2022-47519, CVE-2022-47520, CVE-2022-47521
1
8
Collaboration is the name of the game! Let's provide OWASP with feedback through this survey so that we can improve the user experience for all.
6
13
GHSL-2022-070_GHSL-2022-072: SQL injection in Arches - CVE-2022-41892
4
15
GHSL-2022-028: Copy/paste cross-site scripting (XSS) in codex-team
1
5
GHSL-2022-130: Out-of-bounds (OOB) read in openrazer - CVE-2022-23467
5
GHSL-2022-068: Remote Code Execution (RCE) in PDFMake - CVE-2022-46161
2
5
24
The CTF will be jeopardy-style with challenges from all major categories such as crypto, pwn, reversing, web, misc and more exotic ones like #CodeQL as well.
If you ever wanted to try CodeQL, this is your excuse for spending time on it :P
Prizes:
1st: $500
2nd: $300
3rd: $200
1
4
9
Show this thread
Thanks to and for helping us by reporting a serious security vulnerability.
We take security very seriously and managed to patch the issue within one hour. You can find more details about the vulnerability in the quoted article.
Quote Tweet
GHSL-2022-069: Remote Code Execution (RCE) in CircuitVerse - CVE-2022-36038 securitylab.github.com/advisories/GHS
9
18
(1/2) Very happy that my JWT query has been highlighted by from the at #githubuniverse as an example for community-driven security contributions.
See intrigus.org/research/2022/ for the high-quality and slightly longer version!
1
13
18
Show this thread
And to celebrate CodeQL for Ruby, we launched a special and limited program as part of our CodeQL bounty program, with up to $2000 bonus for high quality submissions. Secure open source and get rewarded. Check it out:
3
4
Show this thread
ICYMI GitHub announced the general availability of #CodeQL for Ruby 🎉 The RCE and DoS that disclosed today in Ruby open source projects were found thanks to CodeQL: securitylab.github.com/advisories GHSL-2022-073, GHSL-2022-067 and GHSL-2022-063.
1
4
12
Show this thread
GHSL-2022-073: Denial of Service (DoS) in Fat Free CRM - CVE-2022-39281
1
1
4
GHSL-2022-069: Remote Code Execution (RCE) in CircuitVerse - CVE-2022-36038
1
8
GHSL-2022-067: Remote Code Execution (RCE) in Fluentd - CVE-2022-39379
1
3
GHSL-2022-063: Remote Code Execution (RCE) in Arvados Workbench - CVE-2022-36006
1
2
We are proud to sponsor #GreHack22. Tomorrow, and will run a CodeQL workshop where you can learn the basics of CodeQL through real-world examples! "Can't Grep This!" grehack.fr/2022/workshops
Quote Tweet
Hey folks!
The #GreHack22 sponsors week continues.
Today we would like to thank our 32 bits sponsors @Synacktiv, @RandoriSec and @GHSecurityLab!
10
How to enable it:
1
5
12
Show this thread
This Tuesday, we are at #OSMC in Nuremberg, Germany! Join us to learn more about Security as Code (SaC) and the latest initiatives we pursue to secure open source.
Quote Tweet
In his #OSMC talk @jkcso from @GHSecurityLab will review lessons learned from #DevOps to implement a thriving #DevSecOps culture.
Check it out for more:
osmc.de/talks/a-mainta
1
2
8
is on the Main Stage talking about how GitHub uses GitHub to build GitHub, joined by our very own of covering security and CodeQL! #GitHubUniverse
2
5
26
With CodeQL for Ruby out of Beta, we are including it as part of the supported languages for our CodeQL Bug Bounty program. To celebrate, Ruby submissions will be awarded special bonuses. Learn more 🔗 securitylab.github.com/bounties/
6
10
In 5', join us virtually or in person (Garden stage) at #GitHubUniverse for a fireside chat between and . Register at
2
5