iiinova — where your digital self keeps evolving

Reposted by Kev

GitHub Security Lab @securitylab.github.com · 02/09/2025

Georg Semmler, the maintainer of github.com/diesel-rs/di... and one of the recent participants in the GitHub Secure Open Source Fund, has written a tool called cargo-safe-publish that helps protect against supply chain attacks in the Rust Cargo ecosystem. Read more: blog.weiznich.de/blog/cargo-s...

blog.weiznich.de

Introducing cargo safe-publish

About ways to publish unexpected code to crates.io

021

Reposted by Kev

Ryan O'Horo @ryanohoro.com · 27/08/2025

VXUG dropped the news that a DEFCON talk was AI generated nonsense and so was the code put on github for it. Some attendees noticed it was off, but this talk was presented, passed review. The github issues are rolling in.

vx-underground
@vxunderground

Lots of frustration in the malware analysis
and reverse engineering community.

It's been discovered a DEFCON talk,
presentation, and the
code which coincided
withit, was AI slop. The talk itself had
hallucinated terminology which (apparently)
noone at DEFCON noticed.

Bad.

De-Virtualizing the Dragon

Automated Unpacking and Deobfuscation of
Nested
VM-Based Protectors

DEFCON 33 - August 9, 2025

Dr. Agostino 'van1sh' Panico
Security Researcher

van1sh@securitybsides.it|
@van1sh_bsidesit
"Democratizing Malware Analysis"

Github issue

poppopjmp /VMDragonSlayer
Public
<> Code
.
Issues
6
...
Add OSHA compliance #8
New issue

62513

Reposted by Kev

GitHub Security Lab @securitylab.github.com · 04/07/2025

New vuln from the GitHub Security Lab 🔍 Antonio + Kev team up to uncover CVE-2025-53367 — an out-of-bounds write in DjVuLibre that could lead to code execution on Linux desktops. Found via fuzzing. 🧠 Read the announcement: github.blog/security/vul...

github.blog

CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre

DjVuLibre has a vulnerability that could enable an attacker to gain code execution on a Linux Desktop system when the user tries to open a crafted document.

041

Reposted by Kev

Peter Stöckli @ulldma.bsky.social · 13/03/2025

In this demonstration I show the impact of CVE-2025-25291/CVE-2025-25292, an authentication bypass in ruby-saml used by high profile OSS projects such as GitLab. My team coordinated with both the ruby-saml maintainer and GitLab to get this vulnerability fixed and patches are available at gh.io/glfx

1223

Reposted by Kev

Peter Stöckli @ulldma.bsky.social · 12/03/2025

If you're using ruby-saml or omniauth-saml for SAML authentication make sure to update these libraries as fast as possible! Fixes for two critical authentication bypass vulnerabilities were published today (CVE-2025-25291 + CVE-2025-25292). github.blog/security/sig...

github.blog

Critical authentication bypass vulnerabilities were discovered in ruby-saml up to version 1.17.0. See how they were uncovered.

11110

Reposted by Kev

GitHub Security Lab @securitylab.github.com · 12/03/2025

In this blog post, we detail newly discovered authentication bypass vulnerabilities in the ruby-saml library used for single sign-on (SSO) via SAML on the service provider (application) side. github.blog/security/sig...

github.blog

Critical authentication bypass vulnerabilities were discovered in ruby-saml up to version 1.17.0. See how they were uncovered.

076

Reposted by Kev

Michael Stepankin @artsploit.com · 22/01/2025

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! github.blog/security/vul...

12916