Researching and Remediating RCEs via GitHub Actions - Bar Kaduri, Roi Nisimi - ASW #355
4 November 2025 - 1 hour 8 minsPull requests are a core part of collaboration, whether in open or closed source. GitHub has documented some of the security consequences of misconfiguring how PRs can trigger actions. But what happens when repo owners don't read the docs? Bar Kaduri and Roi Nisimi walk through their experience in reading docs, finding vulns, demonstrating exploits, and working with repo owners to improve their security. Their work highlights the challenges in maintaining good security guidance, figuring out secure defaults, and how so many orgs still struggle with triaging external security reports -- something that's becoming even more challenging when orgs are being flooded with low-quality reports from L...
Series Episodes
Can employees safely use AI agents? AI pentesting agent liabilities, and the news - Rob Allen - ESW #473
1 hour 39 mins
24 August Finished
Surveillance, Murder Hornets, Portmantau, TrueCONF, Siemens, N-Able and More - SWN #609
41 mins
21 August Finished
Preventing a Breakout as AI Agent Threats Is One of Three Top CISO Concerns - Rob Allen - BSW #461
53 mins
19 August Finished
Secrets, Red Agent, GitHub, evoooo1bot, DecryptAds, Copilot, Aaran Leyland, and More - SWN #608
39 mins
18 August Finished
Augmenting Threat Intel Analysis with Agents - Chris Wallis, Sai Kiran Uppu, Ramin Farassat - ASW #396
1 hour 9 mins
18 August Finished
