GitHub Security Lab

news.ycombinator.comThis is great research and a great write-up, but I'm a little (pleasantly) surpr... | Hacker News

6 Feb 2025

Why does GitHub Security Lab do research like Man Yue Mo’s recent work on bypassing MTE on the Pixel 8? This question was asked on Hacker News and we think it’s worth a short thread. news.ycombinator.com/item?id=3975...

githubuniverse.comGitHub UniverseGitHub's global developer event is back. Join the world's fair of software.

The hackers are taking the stage at GitHub Universe 2026 🛡️ Maintainers: these sessions bring practical lessons for securing the open source projects you build and depend on. Come learn, connect, and take ideas home to your community. githubuniverse.com

View full thread

"Drowning in AI-generated vulnerability reports? Here's how to stay afloat.” Grab a paddle and join the two Kevins @kevinbackhouse.bsky.social as they navigate the creek. You'll practice handling security reports and learn best practices and techniques for triaging low value or invalid reports.

“Disrupting supply chain attacks: A threat framework for GitHub Actions” — Steve Glass and Greg Ose share an in-depth look at supply chain attacks across the Actions ecosystem and what we shipped to disrupt them. If you maintain open source or CI/CD pipelines, this is one to add to your agenda.

githubuniverse.comGitHub UniverseGitHub's global developer event is back. Join the world's fair of software.

“How GitHub secures open source” — join @anti.computer and @xcorail.bsky.social for seven years of lessons from GitHub Security Lab: make security simple to adopt, build it with community, and understand what AI means for open source. Take ideas straight back to your project.

“Your CI has full internet access. GitHub Actions firewall changes that.” Join Zach Steindler for a demo of outbound request visibility and allowlists—and practical ways to limit what your workflows can reach.

anthropic.comAn opt-in vulnerability-finding service for open-source softwareWe’re launching OSS Scanner, an opt-in vulnerability scanner for the open-source ecosystem informed by our experience using Claude to find vulnerabilities during Project Glasswing. Projects that join ...

Open-source security is a team sport, and we’re thrilled to see Anthropic join the defense team with OSS Scanner. Like with Google’s OSS-Fuzz and GitHub’s CodeQL and autofix, we hope more companies will invest in free services for the ecosystem we all depend on. www.anthropic.com/research/lau...

threatcon1.orgTHREATCON1 AgendaJoin us at THREATCON1, where cybersecurity leaders unite October 5-7, 2026, to enhance safety across the digital landscape.

Hey, #THREATCON1 attendees! 👋🏾 Catch Shelby Cunningham from the Security Lab on Wednesday, Oct. 7 at 11 AM for a candid panel on coordinated vulnerability disclosure—from AI-driven discovery and research collisions to vendor silence and when to publish a PoC. See you there! www.threatcon1.org/agenda

bounty.github.comGitHub SecurityBug Bounty Program

Here are the September GitHub bug bounty stats! ✅ 454 bounty reports submitted 👥 203 hackers participated in our program 💰 Awarded $56,472 in bounties Found a vulnerability? Submit it here: bounty.github.com

GitHub Security Lab reposted

GitHub

@github.com

Just one command can help you stop leaking secrets into your public code. Give your repositories essential security hygiene with gh-secure from the GitHub Security Lab. ✅ Install and use it in the Copilot app, Copilot CLI, or GitHub CLI. https://gh.io/gh-secure

github.blogHow we found 24 Android vulnerabilities using our open source AI security agentA look at the targeted AI taskflows behind these findings, the bugs they uncovered, and how to run the same open-source agent on your own app.

How can AI help uncover real-world mobile security flaws? GitHub Security Lab used its open-source AI security agent to find and report 24 Android vulnerabilities—including issues affecting user privacy and account security. Read the research: github.blog/security/how...

github.blogAI-powered fuzzing with the GitHub Security Lab Taskflow AgentIn this blog post, I explain how to use the new fuzzing taskflow based on the GitHub Security Lab Taskflow Agent AI framework.

AI-powered fuzzing is here. GitHub Security Lab’s Fuzzing Taskflow automates harness creation, coverage improvement, crash triage, and vulnerability reporting for open source projects. Read github.blog/security/app...

gh.ioGitHub - GitHubSecurityLab/gh-secure: A GitHub CLI extension to enable security features on repositories following best practices from GitHub Security Lab.A GitHub CLI extension to enable security features on repositories following best practices from GitHub Security Lab. - GitHubSecurityLab/gh-secure

Open source maintainers, if you could secure your open source GitHub repo in less than 60 seconds, would you do it? 🚀 Introducing gh secure One command. Free. No security expertise required. gh.io/gh-secure

View full thread

Even the best open source repos face the following risks: 🚨 Malware pushed to your branches 📣 Unfixed vulnerabilities disclosed to the public 🔓 Leaked credentials 📦 Vulnerable dependencies 🐛 Security bugs in your code Mitigate all of these risks with gh secure in less than 60 seconds.

Raise your repository’s security baseline now with this tool from the GitHub Security Lab: gh extension install GitHubSecurityLab/gh-secure gh secure --yes

github.blog6 security settings every GitHub maintainer should enable this weekThese six free settings will not make your project unhackable. Nothing will. What they will do is close the easy doors.

We recently wrote a guidance about the 6 security settings every GitHub maintainer should enable: github.blog/security/6-s... That was so early 2026! Now use the free gh.io/gh-secure and get it done.

bounty.github.comGitHub SecurityBug Bounty Program

4 Sept

Here are the GitHub August bug bounty stats! 🐛 497 bounty reports submitted 👥 222 hackers participated in our program 💰 Awarded $104,402 in bounties Found a vulnerability? Submit it here: bounty.github.com

gh.ioOpenClaw went viral. Meet the maintainers building and securing it.OpenClaw is the fastest-growing project in GitHub history. Some of its maintainers share what they learned in the project's first six months.

27 Aug

“Peter ignored me, so I was like, how else can I get his attention? Security.” 🔐 Sometimes the best path into open source is finding where your security expertise can help—and being ready to keep learning. Meet the maintainers building and securing OpenClaw: gh.io/openclaw-interview

github.blogWhat 50 open source projects taught us about security in the AI eraSee how the projects in the GitHub Secure Open Source Fund combined AI-assisted workflows, maintainer expertise, and more to improve project security.

13 Aug

"AI security is not evolving in isolation. It is becoming part of the broader practice of building secure software. As that shift continues, maintainers will need practical education, trusted communities, and expert support that can evolve with them." github.blog/open-source/...

12 Aug

🔐 Attending USENIX in Baltimore? Join Zach Steindler tomorrow for: Supply Chain Attacks on Open Source: What’s Happening, What Can We Do Today, and What’s Next 📅 August 13, 2026 🕟 4:30 PM 📍 Baltimore, MD #USENIX #OpenSourceSecurity #SupplyChainSecurity

bounty.github.comGitHub SecurityBug Bounty Program

6 Aug

Hello Security researchers! Here are GitHub's July bug bounty stats! 💪 🐛 530 bounty reports submitted 👥 284 hackers participated in our program 💰 Awarded $267,652 in bounties Found a vulnerability? Submit it here: bounty.github.com Heading to DefCon? Come find us: x.com/GitHubSecuri...

github.blogNext chapter: Restructuring GitHub's bug bounty programGitHub is making some significant changes to its bug bounty program, shifting its focus to give researchers a better experience.

22 July

Hey bounty hunters! GitHub updates its bug bounty program to improve how the company partners with the security research community. This update is designed to reduce ambiguity, prioritize the areas of highest risk, and improve the speed and quality of security outcomes. github.blog/security/nex...

ep2026.europython.euIntroduction to security research. Find a CVE with CodeQL.Learn how to find security vulnerabilities at Introduction to security research. Find a CVE with CodeQL tutorial

10 July

Are you in Krakow for EuroPython? Join Sylwia Budzynska for “Introduction to security research. Find a CVE with CodeQL” to learn how to look for vulnerabilities in code and query for them with CodeQL. 📆 Tuesday, 14th July ⏰ 13:45 📌 Kraków, Poland ep2026.europython.eu/session/intr...

10 July

The workshop is intended for developers interested in security, open source maintainers and security researchers.

github.blog6 security settings every GitHub maintainer should enable this weekThese six free settings will not make your project unhackable. Nothing will. What they will do is close the easy doors.

1 July

6 GitHub security settings every maintainer should enable this week. These won't make your project unhackable. Nothing will. What they do is close the easy doors... the ones attackers try first. Free, fast, and worth the few minutes it takes. 🔗 github.blog/security/6-s...

24 June

What happens when you hand an AI agent its own tools, memory, and a path to production? Your job is to find the cracks before an attacker does. Play now: gh.io/scg Free. Open source. Get started in 2 minutes right from your browser.

bsidesvilnius.ltBSides Vilnius 2026 — Security Theater | Cybersecurity Conference in LithuaniaBSides Vilnius 2026 — community-driven cybersecurity conference in Lithuania. Workshops, talks, and CTF on 3–4 June at Kablys. Join the infosec community.

3 June

Attending BSides Vilnius? Don't miss 📌 @yarlob.bsky.social 's session "LLM-assisted vulnerability hunting: hype vs. reality" to hear about the practical experience of using LLM for finding vulnerabilities in OSS such as Signal or 7-Zip! 📅 June 4, 16:45 EEST 📍 Vilnius, Lithuania 👉 bsidesvilnius.lt

devtalks.roDevTalks RomaniaThe largest expo conference for software developers and IT professionals in Romania, gathering over 8000 participants from all over the world.

3 June

Who's at DevTalks? Join @jkcso.bsky.social and discover practical ways to use AI for security through 12 GitHub Copilot demos from secure coding, to informed supply chain decisions, and secure SDLC. 📅 June 4, 14:00 EEST 📍 Bucharest, Romania 👉 www.devtalks.ro

29 May

Attending AI DevCon? Join Joseph Katsioloudes and discover practical ways to use AI for security through 12 GitHub Copilot demos from secure coding, to informed supply chain decisions, and secure SDLC. 📅 June 1, 10:00 AM BST 📍 London, UK & Virtual 👉 tessl.io/speaker/jose...

27 May

Proof of Concept for GHSL-2026-140 (CVE-2026-48095) in 7-Zip <= 26.00. A crafted archive shrinks a 256 MB buffer into 1 byte, overwrites a function pointer with file content, and redirects execution. Full weaponization needs an ASLR bypass. Fixed in 26.01. securitylab.github.com/advisories/G...

linuksowa.pl20. Sesja Linuksowa | Wrocław, PolskaSesja Linuksowa to największa w Polsce konferencja poświęcona Wolnemu Oprogramowaniu oraz najnowszym trendom w systemach z rodziny GNU/Linux.

24 Apr

On 25th April at 10AM, join @blazingwind.bsky.social for the workshop "Introduction to security research. Find a CVE with CodeQL" at the Linux Session organized by Akademickie Stowarzyszenie Informatyczne in Wroclaw, Poland! Check out more information on the conference's website: linuksowa.pl

24 Apr

You will learn security research and static analysis fundamentals when looking for vulnerabilities in software. Using an example CVE we’ll walk through how we could find the CVE, how CodeQL would detect it, and write a CodeQL query to find similar variants of the vulnerability at scale.

m.devoxx.comDevoxx Mobile CompanionYour ultimate companion for Devoxx conferences worldwide. Browse talks, speakers, schedules, and manage your personalized conference experience.

21 Apr

Building with AI? 🤖 Then you won’t want to miss tomorrow’s @devoxx.fr workshop with @xcorail.bsky.social and @jkcso.bsky.social — all about how to build robust AI-powered applications. Shall we play a Game? LLM Security in Practice m.devoxx.com/events/devox... 📍 Paris 142 🗓️ April 22, 10.30am CET

first.orgProgram Agenda / CVE Program & FIRST VulnCon 2026Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026

15 Apr

Catch Shelby Cunningham on stage at CVE/FIRST VulnCon 2026 in Scottsdale, Arizona, at her panel “Supply Chains and Malware Campaigns: Is CVE the Right Way to Name the Game?”. Date: April 16, 2026 | 1:15–2:15 PM MST (UTC-7) Learn more: www.first.org/conference/v...

github.blogHack the AI agent: Build agentic AI security skills with the GitHub Secure Code GameLearn to find and exploit real-world agentic AI vulnerabilities through five progressive challenges in this free, open source game that over 10,000 developers have already used to sharpen their securi...

AI agents that execute commands, browse the web, and coordinate with other agents are everywhere. But how do you know they're safe? We let you find out by hacking one yourself. Free, hands-on, and you can get started in under 2 minutes! Learn more in our latest blog. github.blog/security/hac...

first.orgProgram Agenda / CVE Program & FIRST VulnCon 2026Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026

Who’s at VulnCon? Join Sophia Sanles-Luksetich and Zachary Goldman at CVE/FIRST VulnCon 2026 in Scottsdale, Arizona. Learn more 🧵

first.orgProgram Agenda / CVE Program & FIRST VulnCon 2026Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026

Date: April 15, 2026 | 11:35 AM–12:05 PM MST (UTC-7) Learn more: www.first.org/conference/v...

first.orgProgram Agenda / CVE Program & FIRST VulnCon 2026Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026

Who’s at VulnCon? Join Sophia Sanles-Luksetich and Zachary Goldman at CVE/FIRST VulnCon 2026 in Scottsdale, Arizona. Learn more 🧵

first.orgProgram Agenda / CVE Program & FIRST VulnCon 2026Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026

Their talk, “Flipping the Criticality Funnel: A Practical Path to Real Prioritization”, covers how GitHub built a unified risk-scoring model that combines CVSS, EPSS, KEV, and asset context to cut through alert noise and drive remediation where it matters most.

securitylab.github.comGHSL-2026-102: Unauthorized exfiltration of decrypted attachments in Signal through Intent redirectionVersions >= v6.38.0 and < v8.4.2 of the website flavor of Signal for Android (distributed at https://signal.org/android/apk) allows another installed app without any permissions to exfiltrate decrypte...

3 Apr

A zero-permission Android app could read every photo, video, voice note, and document in your Signal chats. Downloaded Signal apk directly from Signal.org? You were vulnerable. securitylab.github.com/advisories/G...

Hidden feature in Signal? Not for attackers! An attacker with no admin privileges can delete any message in a group!

securitylab.github.com/advisories/G...

securitylab.github.comGHSL-2026-095: Unauthorized message deletion in Signal for iOSSignal for iOS v8.2 is affected by a vulnerability where an attacker can exploit an improper authorization check within the Admin Delete message handler, leading to unauthorized message deletion.

securitylab.github.com/advisories/G...

securitylab.github.comGHSL-2026-082: Unauthorized message deletion in Signal for AndroidSignal for Android versions >= v8.1.0 and < v8.3.0 are affected by a vulnerability where an attacker can exploit improperly validated group context within the Admin Delete message handler, leading to ...

t.cohttps://bounty.github.com

Here are our March bug bounty stats! 🐛 380 bounty reports submitted 👩‍💻 260 hackers participated in our program 💰 Awarded $94,637 in bounties Found a vulnerability? Submit it here: t.co/HG2AqybW0p

github.blogA year of open source vulnerability trends: CVEs, advisories, and malwareReviewed advisories hit a four-year low, malware advisories surged, and CNA publishing grew—here’s what changed.

27 Mar

Reviewed advisories hit a four-year low, malware advisories surged, and CNA publishing grew—here’s what changed and what it means for your triage and response. Read Jonathan Evans's A year of open source vulnerability trends: CVEs, advisories, and malware github.blog/security/sup...

github.blogWhat's coming to our GitHub Actions 2026 security roadmapA look at GitHub Actions’ 2026 roadmap, outlining how secure defaults, policy controls, and CI/CD observability harden the software supply chain end to end.

26 Mar

Software supply chain attacks are on the rise. Learn how open source contributors can use what GitHub Actions is building to help protect projects and the broader software community. github.blog/news-insight...

linkedin.comCommunication on CanisterWormDear open source community, On March 20th GitHub learned of a new supply chain attack through public disclosure by socket.dev dubbed CanisterWorm that affects more than 64 unique npm packages.

23 Mar

Dear open source community, read our communication on CanisterWorm, learn what GitHub does to protect the community and what you can do to secure your supply chain www.linkedin.com/pulse/commun...

github.blogHow to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered frameworkGitHub Security Lab Taskflow Agent is very effective at finding Auth Bypasses, IDORs, Token Leaks, and other high-impact vulnerabilities.

6 Mar

Sign in with ANY password: How we used AI to break into a popular chat application, and other high-impact vulnerabilities. Read "How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework" github.blog/security/how...

t.cohttps://bounty.github.com

6 Mar

Hello hackers! Here are our February bug bounty stats! 🐛 200 bounty reports submitted 👩‍💻 144 hackers participated in our program 💰 Awarded $48,589 in bounties Found a vulnerability? Submit it here: t.co/HG2AqybW0p

19 Feb

If you're at #DeveloperWeek and you care about open source security, there is a session you must attend. We have been contributing to secure open source for 6 years and @xcorail.bsky.social will share with you the lessons learned from this journey! How GitHub Secures Open Source, PRO stage, 1pm.

t.cohttps://bounty.github.com

9 Feb

Here are our January bug bounty stats! 🐛 182 bounty reports submitted 👩‍💻 112 hackers participated in our program 💰 Awarded $76,269 in bounties Found a vulnerability? Submit it here: t.co/HG2AqybW0p.