GitHub Security Lab
@securitylab.github.com
Securing open source software, together
Pinned
This is great research and a great write-up, but I'm a little (pleasantly) surpr... | Hacker News
news.ycombinator.com
Why does GitHub Security Lab do research like Man Yue Mo’s recent work on bypassing MTE on the Pixel 8? This question was asked on Hacker News and we think it’s worth a short thread.
news.ycombinator.com/item?id=3975...
news.ycombinator.com/item?id=3975...
AI-powered fuzzing is here. GitHub Security Lab’s Fuzzing Taskflow automates harness creation, coverage improvement, crash triage, and vulnerability reporting for open source projects.
Read github.blog/security/app...
Read github.blog/security/app...
AI-powered fuzzing with the GitHub Security Lab Taskflow Agent
In this blog post, I explain how to use the new fuzzing taskflow based on the GitHub Security Lab Taskflow Agent AI framework.
github.blog
September 24, 2026 at 8:53 PM
AI-powered fuzzing is here. GitHub Security Lab’s Fuzzing Taskflow automates harness creation, coverage improvement, crash triage, and vulnerability reporting for open source projects.
Read github.blog/security/app...
Read github.blog/security/app...
Open source maintainers, if you could secure your open source GitHub repo in less than 60 seconds, would you do it?
🚀 Introducing gh secure
One command. Free. No security expertise required.
gh.io/gh-secure
🚀 Introducing gh secure
One command. Free. No security expertise required.
gh.io/gh-secure
GitHub - GitHubSecurityLab/gh-secure: A GitHub CLI extension to enable security features on repositories following best practices from GitHub Security Lab.
A GitHub CLI extension to enable security features on repositories following best practices from GitHub Security Lab. - GitHubSecurityLab/gh-secure
gh.io
September 21, 2026 at 5:10 PM
Open source maintainers, if you could secure your open source GitHub repo in less than 60 seconds, would you do it?
🚀 Introducing gh secure
One command. Free. No security expertise required.
gh.io/gh-secure
🚀 Introducing gh secure
One command. Free. No security expertise required.
gh.io/gh-secure
Here are the GitHub August bug bounty stats!
🐛 497 bounty reports submitted
👥 222 hackers participated in our program
💰 Awarded $104,402 in bounties
Found a vulnerability? Submit it here: bounty.github.com
🐛 497 bounty reports submitted
👥 222 hackers participated in our program
💰 Awarded $104,402 in bounties
Found a vulnerability? Submit it here: bounty.github.com
GitHub Security
Bug Bounty Program
bounty.github.com
September 4, 2026 at 8:02 PM
Here are the GitHub August bug bounty stats!
🐛 497 bounty reports submitted
👥 222 hackers participated in our program
💰 Awarded $104,402 in bounties
Found a vulnerability? Submit it here: bounty.github.com
🐛 497 bounty reports submitted
👥 222 hackers participated in our program
💰 Awarded $104,402 in bounties
Found a vulnerability? Submit it here: bounty.github.com
“Peter ignored me, so I was like, how else can I get his attention? Security.” 🔐
Sometimes the best path into open source is finding where your security expertise can help—and being ready to keep learning.
Meet the maintainers building and securing OpenClaw: gh.io/openclaw-interview
Sometimes the best path into open source is finding where your security expertise can help—and being ready to keep learning.
Meet the maintainers building and securing OpenClaw: gh.io/openclaw-interview
OpenClaw went viral. Meet the maintainers building and securing it.
OpenClaw is the fastest-growing project in GitHub history. Some of its maintainers share what they learned in the project's first six months.
gh.io
August 27, 2026 at 8:30 PM
“Peter ignored me, so I was like, how else can I get his attention? Security.” 🔐
Sometimes the best path into open source is finding where your security expertise can help—and being ready to keep learning.
Meet the maintainers building and securing OpenClaw: gh.io/openclaw-interview
Sometimes the best path into open source is finding where your security expertise can help—and being ready to keep learning.
Meet the maintainers building and securing OpenClaw: gh.io/openclaw-interview
"AI security is not evolving in isolation. It is becoming part of the broader practice of building secure software. As that shift continues, maintainers will need practical education, trusted communities, and expert support that can evolve with them."
github.blog/open-source/...
github.blog/open-source/...
What 50 open source projects taught us about security in the AI era
See how the projects in the GitHub Secure Open Source Fund combined AI-assisted workflows, maintainer expertise, and more to improve project security.
github.blog
August 13, 2026 at 4:33 PM
"AI security is not evolving in isolation. It is becoming part of the broader practice of building secure software. As that shift continues, maintainers will need practical education, trusted communities, and expert support that can evolve with them."
github.blog/open-source/...
github.blog/open-source/...
🔐 Attending USENIX in Baltimore? Join Zach Steindler tomorrow for:
Supply Chain Attacks on Open Source: What’s Happening, What Can We Do Today, and What’s Next
📅 August 13, 2026
🕟 4:30 PM
📍 Baltimore, MD
#USENIX #OpenSourceSecurity #SupplyChainSecurity
Supply Chain Attacks on Open Source: What’s Happening, What Can We Do Today, and What’s Next
📅 August 13, 2026
🕟 4:30 PM
📍 Baltimore, MD
#USENIX #OpenSourceSecurity #SupplyChainSecurity
August 12, 2026 at 7:47 PM
🔐 Attending USENIX in Baltimore? Join Zach Steindler tomorrow for:
Supply Chain Attacks on Open Source: What’s Happening, What Can We Do Today, and What’s Next
📅 August 13, 2026
🕟 4:30 PM
📍 Baltimore, MD
#USENIX #OpenSourceSecurity #SupplyChainSecurity
Supply Chain Attacks on Open Source: What’s Happening, What Can We Do Today, and What’s Next
📅 August 13, 2026
🕟 4:30 PM
📍 Baltimore, MD
#USENIX #OpenSourceSecurity #SupplyChainSecurity
Hello Security researchers!
Here are GitHub's July bug bounty stats! 💪
🐛 530 bounty reports submitted
👥 284 hackers participated in our program
💰 Awarded $267,652 in bounties
Found a vulnerability? Submit it here: bounty.github.com
Heading to DefCon? Come find us: x.com/GitHubSecuri...
Here are GitHub's July bug bounty stats! 💪
🐛 530 bounty reports submitted
👥 284 hackers participated in our program
💰 Awarded $267,652 in bounties
Found a vulnerability? Submit it here: bounty.github.com
Heading to DefCon? Come find us: x.com/GitHubSecuri...
GitHub Security
Bug Bounty Program
bounty.github.com
August 6, 2026 at 10:12 PM
Hello Security researchers!
Here are GitHub's July bug bounty stats! 💪
🐛 530 bounty reports submitted
👥 284 hackers participated in our program
💰 Awarded $267,652 in bounties
Found a vulnerability? Submit it here: bounty.github.com
Heading to DefCon? Come find us: x.com/GitHubSecuri...
Here are GitHub's July bug bounty stats! 💪
🐛 530 bounty reports submitted
👥 284 hackers participated in our program
💰 Awarded $267,652 in bounties
Found a vulnerability? Submit it here: bounty.github.com
Heading to DefCon? Come find us: x.com/GitHubSecuri...
Hey bounty hunters! GitHub updates its bug bounty program to improve how the company partners with the security research community. This update is designed to reduce ambiguity, prioritize the areas of highest risk, and improve the speed and quality of security outcomes.
github.blog/security/nex...
github.blog/security/nex...
Next chapter: Restructuring GitHub's bug bounty program
GitHub is making some significant changes to its bug bounty program, shifting its focus to give researchers a better experience.
github.blog
July 22, 2026 at 5:17 PM
Hey bounty hunters! GitHub updates its bug bounty program to improve how the company partners with the security research community. This update is designed to reduce ambiguity, prioritize the areas of highest risk, and improve the speed and quality of security outcomes.
github.blog/security/nex...
github.blog/security/nex...
Are you in Krakow for EuroPython? Join Sylwia Budzynska for “Introduction to security research. Find a CVE with CodeQL” to learn how to look for vulnerabilities in code and query for them with CodeQL.
📆 Tuesday, 14th July
⏰ 13:45
📌 Kraków, Poland
ep2026.europython.eu/session/intr...
📆 Tuesday, 14th July
⏰ 13:45
📌 Kraków, Poland
ep2026.europython.eu/session/intr...
Introduction to security research. Find a CVE with CodeQL.
Learn how to find security vulnerabilities at Introduction to security research. Find a CVE with CodeQL tutorial
ep2026.europython.eu
July 10, 2026 at 5:59 PM
Are you in Krakow for EuroPython? Join Sylwia Budzynska for “Introduction to security research. Find a CVE with CodeQL” to learn how to look for vulnerabilities in code and query for them with CodeQL.
📆 Tuesday, 14th July
⏰ 13:45
📌 Kraków, Poland
ep2026.europython.eu/session/intr...
📆 Tuesday, 14th July
⏰ 13:45
📌 Kraków, Poland
ep2026.europython.eu/session/intr...
6 GitHub security settings every maintainer should enable this week. These won't make your project unhackable. Nothing will. What they do is close the easy doors... the ones attackers try first. Free, fast, and worth the few minutes it takes.
🔗 github.blog/security/6-s...
🔗 github.blog/security/6-s...
6 security settings every GitHub maintainer should enable this week
These six free settings will not make your project unhackable. Nothing will. What they will do is close the easy doors.
github.blog
July 1, 2026 at 9:32 PM
6 GitHub security settings every maintainer should enable this week. These won't make your project unhackable. Nothing will. What they do is close the easy doors... the ones attackers try first. Free, fast, and worth the few minutes it takes.
🔗 github.blog/security/6-s...
🔗 github.blog/security/6-s...
What happens when you hand an AI agent its own tools, memory, and a path to production?
Your job is to find the cracks before an attacker does.
Play now: gh.io/scg
Free. Open source. Get started in 2 minutes right from your browser.
Your job is to find the cracks before an attacker does.
Play now: gh.io/scg
Free. Open source. Get started in 2 minutes right from your browser.
June 24, 2026 at 5:28 PM
What happens when you hand an AI agent its own tools, memory, and a path to production?
Your job is to find the cracks before an attacker does.
Play now: gh.io/scg
Free. Open source. Get started in 2 minutes right from your browser.
Your job is to find the cracks before an attacker does.
Play now: gh.io/scg
Free. Open source. Get started in 2 minutes right from your browser.
Attending BSides Vilnius? Don't miss 📌 @yarlob.bsky.social 's session "LLM-assisted vulnerability hunting: hype vs. reality" to hear about the practical experience of using LLM for finding vulnerabilities in OSS such as Signal or 7-Zip!
📅 June 4, 16:45 EEST
📍 Vilnius, Lithuania
👉 bsidesvilnius.lt
📅 June 4, 16:45 EEST
📍 Vilnius, Lithuania
👉 bsidesvilnius.lt
BSides Vilnius 2026 — Security Theater | Cybersecurity Conference in Lithuania
BSides Vilnius 2026 — community-driven cybersecurity conference in Lithuania. Workshops, talks, and CTF on 3–4 June at Kablys. Join the infosec community.
bsidesvilnius.lt
June 3, 2026 at 6:26 PM
Attending BSides Vilnius? Don't miss 📌 @yarlob.bsky.social 's session "LLM-assisted vulnerability hunting: hype vs. reality" to hear about the practical experience of using LLM for finding vulnerabilities in OSS such as Signal or 7-Zip!
📅 June 4, 16:45 EEST
📍 Vilnius, Lithuania
👉 bsidesvilnius.lt
📅 June 4, 16:45 EEST
📍 Vilnius, Lithuania
👉 bsidesvilnius.lt
Who's at DevTalks? Join @jkcso.bsky.social and discover practical ways to use AI for security through 12 GitHub Copilot demos from secure coding, to informed supply chain decisions, and secure SDLC.
📅 June 4, 14:00 EEST
📍 Bucharest, Romania
👉 www.devtalks.ro
📅 June 4, 14:00 EEST
📍 Bucharest, Romania
👉 www.devtalks.ro
DevTalks Romania
The largest expo conference for software developers and IT professionals in Romania, gathering over 8000 participants from all over the world.
www.devtalks.ro
June 3, 2026 at 6:21 PM
Who's at DevTalks? Join @jkcso.bsky.social and discover practical ways to use AI for security through 12 GitHub Copilot demos from secure coding, to informed supply chain decisions, and secure SDLC.
📅 June 4, 14:00 EEST
📍 Bucharest, Romania
👉 www.devtalks.ro
📅 June 4, 14:00 EEST
📍 Bucharest, Romania
👉 www.devtalks.ro
Attending AI DevCon? Join Joseph Katsioloudes and discover practical ways to use AI for security through 12 GitHub Copilot demos from secure coding, to informed supply chain decisions, and secure SDLC.
📅 June 1, 10:00 AM BST
📍 London, UK & Virtual
👉 tessl.io/speaker/jose...
📅 June 1, 10:00 AM BST
📍 London, UK & Virtual
👉 tessl.io/speaker/jose...
May 29, 2026 at 11:25 PM
Attending AI DevCon? Join Joseph Katsioloudes and discover practical ways to use AI for security through 12 GitHub Copilot demos from secure coding, to informed supply chain decisions, and secure SDLC.
📅 June 1, 10:00 AM BST
📍 London, UK & Virtual
👉 tessl.io/speaker/jose...
📅 June 1, 10:00 AM BST
📍 London, UK & Virtual
👉 tessl.io/speaker/jose...
Proof of Concept for GHSL-2026-140 (CVE-2026-48095) in 7-Zip <= 26.00. A crafted archive shrinks a 256 MB buffer into 1 byte, overwrites a function pointer with file content, and redirects execution. Full weaponization needs an ASLR bypass. Fixed in 26.01. securitylab.github.com/advisories/G...
May 27, 2026 at 5:22 PM
Proof of Concept for GHSL-2026-140 (CVE-2026-48095) in 7-Zip <= 26.00. A crafted archive shrinks a 256 MB buffer into 1 byte, overwrites a function pointer with file content, and redirects execution. Full weaponization needs an ASLR bypass. Fixed in 26.01. securitylab.github.com/advisories/G...
On 25th April at 10AM, join @blazingwind.bsky.social for the workshop "Introduction to security research. Find a CVE with CodeQL" at the Linux Session organized by Akademickie Stowarzyszenie Informatyczne in Wroclaw, Poland!
Check out more information on the conference's website: linuksowa.pl
Check out more information on the conference's website: linuksowa.pl
20. Sesja Linuksowa | Wrocław, Polska
Sesja Linuksowa to największa w Polsce konferencja poświęcona Wolnemu Oprogramowaniu oraz najnowszym trendom w systemach z rodziny GNU/Linux.
linuksowa.pl
April 24, 2026 at 9:20 AM
On 25th April at 10AM, join @blazingwind.bsky.social for the workshop "Introduction to security research. Find a CVE with CodeQL" at the Linux Session organized by Akademickie Stowarzyszenie Informatyczne in Wroclaw, Poland!
Check out more information on the conference's website: linuksowa.pl
Check out more information on the conference's website: linuksowa.pl
Building with AI? 🤖
Then you won’t want to miss tomorrow’s @devoxx.fr workshop with @xcorail.bsky.social and @jkcso.bsky.social — all about how to build robust AI-powered applications.
Shall we play a Game? LLM Security in Practice
m.devoxx.com/events/devox...
📍 Paris 142
🗓️ April 22, 10.30am CET
Then you won’t want to miss tomorrow’s @devoxx.fr workshop with @xcorail.bsky.social and @jkcso.bsky.social — all about how to build robust AI-powered applications.
Shall we play a Game? LLM Security in Practice
m.devoxx.com/events/devox...
📍 Paris 142
🗓️ April 22, 10.30am CET
Devoxx Mobile Companion
Your ultimate companion for Devoxx conferences worldwide. Browse talks, speakers, schedules, and manage your personalized conference experience.
m.devoxx.com
April 21, 2026 at 4:57 PM
Building with AI? 🤖
Then you won’t want to miss tomorrow’s @devoxx.fr workshop with @xcorail.bsky.social and @jkcso.bsky.social — all about how to build robust AI-powered applications.
Shall we play a Game? LLM Security in Practice
m.devoxx.com/events/devox...
📍 Paris 142
🗓️ April 22, 10.30am CET
Then you won’t want to miss tomorrow’s @devoxx.fr workshop with @xcorail.bsky.social and @jkcso.bsky.social — all about how to build robust AI-powered applications.
Shall we play a Game? LLM Security in Practice
m.devoxx.com/events/devox...
📍 Paris 142
🗓️ April 22, 10.30am CET
Catch Shelby Cunningham on stage at CVE/FIRST VulnCon 2026 in Scottsdale, Arizona, at her panel “Supply Chains and Malware Campaigns: Is CVE the Right Way to Name the Game?”.
Date: April 16, 2026 | 1:15–2:15 PM MST (UTC-7)
Learn more: www.first.org/conference/v...
Date: April 16, 2026 | 1:15–2:15 PM MST (UTC-7)
Learn more: www.first.org/conference/v...
Program Agenda / CVE Program & FIRST VulnCon 2026
Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026
www.first.org
April 15, 2026 at 3:51 PM
Catch Shelby Cunningham on stage at CVE/FIRST VulnCon 2026 in Scottsdale, Arizona, at her panel “Supply Chains and Malware Campaigns: Is CVE the Right Way to Name the Game?”.
Date: April 16, 2026 | 1:15–2:15 PM MST (UTC-7)
Learn more: www.first.org/conference/v...
Date: April 16, 2026 | 1:15–2:15 PM MST (UTC-7)
Learn more: www.first.org/conference/v...
AI agents that execute commands, browse the web, and coordinate with other agents are everywhere. But how do you know they're safe? We let you find out by hacking one yourself. Free, hands-on, and you can get started in under 2 minutes! Learn more in our latest blog. github.blog/security/hac...
Hack the AI agent: Build agentic AI security skills with the GitHub Secure Code Game
Learn to find and exploit real-world agentic AI vulnerabilities through five progressive challenges in this free, open source game that over 10,000 developers have already used to sharpen their securi...
github.blog
April 14, 2026 at 8:32 PM
AI agents that execute commands, browse the web, and coordinate with other agents are everywhere. But how do you know they're safe? We let you find out by hacking one yourself. Free, hands-on, and you can get started in under 2 minutes! Learn more in our latest blog. github.blog/security/hac...
Who’s at VulnCon? Join Sophia Sanles-Luksetich and Zachary Goldman at CVE/FIRST VulnCon 2026 in Scottsdale, Arizona.
Learn more 🧵
Learn more 🧵
Program Agenda / CVE Program & FIRST VulnCon 2026
Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026
www.first.org
April 14, 2026 at 6:55 AM
Who’s at VulnCon? Join Sophia Sanles-Luksetich and Zachary Goldman at CVE/FIRST VulnCon 2026 in Scottsdale, Arizona.
Learn more 🧵
Learn more 🧵
A zero-permission Android app could read every photo, video, voice note, and document in your Signal chats. Downloaded Signal apk directly from Signal.org? You were vulnerable. securitylab.github.com/advisories/G...
GHSL-2026-102: Unauthorized exfiltration of decrypted attachments in Signal through Intent redirection
Versions >= v6.38.0 and < v8.4.2 of the website flavor of Signal for Android (distributed at https://signal.org/android/apk) allows another installed app without any permissions to exfiltrate decrypte...
securitylab.github.com
April 3, 2026 at 8:01 PM
A zero-permission Android app could read every photo, video, voice note, and document in your Signal chats. Downloaded Signal apk directly from Signal.org? You were vulnerable. securitylab.github.com/advisories/G...
Hidden feature in Signal? Not for attackers!
An attacker with no admin privileges can delete any message in a group!
An attacker with no admin privileges can delete any message in a group!
April 2, 2026 at 6:12 PM
Hidden feature in Signal? Not for attackers!
An attacker with no admin privileges can delete any message in a group!
An attacker with no admin privileges can delete any message in a group!
Here are our March bug bounty stats!
🐛 380 bounty reports submitted
👩💻 260 hackers participated in our program
💰 Awarded $94,637 in bounties
Found a vulnerability? Submit it here: t.co/HG2AqybW0p
🐛 380 bounty reports submitted
👩💻 260 hackers participated in our program
💰 Awarded $94,637 in bounties
Found a vulnerability? Submit it here: t.co/HG2AqybW0p
https://bounty.github.com
t.co
April 2, 2026 at 5:44 PM
Here are our March bug bounty stats!
🐛 380 bounty reports submitted
👩💻 260 hackers participated in our program
💰 Awarded $94,637 in bounties
Found a vulnerability? Submit it here: t.co/HG2AqybW0p
🐛 380 bounty reports submitted
👩💻 260 hackers participated in our program
💰 Awarded $94,637 in bounties
Found a vulnerability? Submit it here: t.co/HG2AqybW0p
Reviewed advisories hit a four-year low, malware advisories surged, and CNA publishing grew—here’s what changed and what it means for your triage and response. Read Jonathan Evans's A year of open source vulnerability trends: CVEs, advisories, and malware
github.blog/security/sup...
github.blog/security/sup...
A year of open source vulnerability trends: CVEs, advisories, and malware
Reviewed advisories hit a four-year low, malware advisories surged, and CNA publishing grew—here’s what changed.
github.blog
March 27, 2026 at 10:28 PM
Reviewed advisories hit a four-year low, malware advisories surged, and CNA publishing grew—here’s what changed and what it means for your triage and response. Read Jonathan Evans's A year of open source vulnerability trends: CVEs, advisories, and malware
github.blog/security/sup...
github.blog/security/sup...
Software supply chain attacks are on the rise. Learn how open source contributors can use what GitHub Actions is building to help protect projects and the broader software community.
github.blog/news-insight...
github.blog/news-insight...
What's coming to our GitHub Actions 2026 security roadmap
A look at GitHub Actions’ 2026 roadmap, outlining how secure defaults, policy controls, and CI/CD observability harden the software supply chain end to end.
github.blog
March 26, 2026 at 5:07 PM
Software supply chain attacks are on the rise. Learn how open source contributors can use what GitHub Actions is building to help protect projects and the broader software community.
github.blog/news-insight...
github.blog/news-insight...