Shay Berkovich
@sshaybbc
Followers
163
Following
894
Media
13
Statuses
113
Or extend their PAT revocation API to cover other token types:
docs.github.com
Use the REST API to revoke credentials that you have found exposed on GitHub or elsewhere.
0
0
0
With #shaihulud2 refuses to die with the long tale of infections (117 new compromised machines in the last 72 hours, most of them form @Cursor IDE), all @github has to do is disable the gho_ tokens of the super-spreaders (last 2 active spreaders are Cpreet and moh-abed).
1
0
1
🪱sharing more on sha1-hulud w/@sshaybbc * 2 packages == ~60% of infections * 400k unique secrets in truffleSecrets.jsons, only 2.5% verified, & the majority of those short lived JWTs for GitHub Actions! * 3/4 of impacted workloads were CI/CD, 1/4 were users 🔗below
1
4
11
Second part of our research on secret leaks In AI.
🤖 65% of Forbes AI 50 companies leaked secrets on GitHub. @sshaybbc revealed how AI speed without security = leaks waiting to happen. Full Wiz Research report 👉 https://t.co/kmamDrkIo3
0
2
3
Re- #Shai_Hulud attack - its disturbing to see the evolution of the attacker. Comparing to #s1ngularity attack, new elements added: - Worm-able nature of the exploit - Better automation of the secret scan - Bundling of the secrets for exfiltration with tojson(secrets)
1
1
5
More from me on s1ngularity, the Nx supply chain attack. We @wiz_io took advantage of the break in attacker activity to break down: * overall impact * efficacy of the AI usage (not great!) * TTPs and investigation breadcrumbs we've seen to date * our work to notify victims
1
9
39
😱Imagine waking up to see all your private github repositories were published publicly ... That's what happened overnight for >400 users/orgs and >5000 repositories s1ngularity (the Nx supply chain attack) continues to bear fruit for attackers. Rotate ASAP!
3
15
79
In light of recent GitHub Actions incidents (Ultralytics, tj-actions...), I wrote up a practical guide to hardening for @wiz_io Covers permissions, secrets, 3rd-party Actions, ++ Use it to avoid learning these lessons the hard way: https://t.co/vpokCyGmYz
wiz.io
Build resilient GitHub Actions workflows with insights from real attacks, missteps to avoid, and security tips GitHub’s docs don’t fully cover.
2
23
58
🔍IT'S HERE: #ExfilCola, our cloud IR security CTF challenge!🥤 Your mission: - Investigate the cloud environment logs - Research the compromised machines - Secure the files and save the day ⏰ The Cloud Hunting Games are live >> https://t.co/MaTZeY0DpM
3
16
47
Re #IngressNightmare - until yesterday, there have been only one Critical and 12 Highs in K8s according to official CVE feed[ https://t.co/gEBSokNjPa] (since 2017). Its 2 and 15 now. This is big.
0
1
7
😺 Cat's out of the bag We've updated our blog post on the `tj-actions` / `reviewdog` incident to disclose the target. We also have new details on the root cause of the `reviewdog` element. h/t @sshaybbc for a ton of leg work here
1
23
59
Check this out before #KubeCon - we analyzed a huge amount of clusters to get some interesting security stats, like the adoption of the new EKS authentication mode. Hint - its low. Details inside 👇
Fresh off the shelf: Our Kubernetes security report 2025 is here! 🔍 Back in January, our teaser blog covered key K8s trends, but slow adoption of new security features remains a concern.
0
1
4
As Rami McCarthy pointed out in our blog ( https://t.co/wGKuFZmvZN), we believe reviewdog/actions-setup@v1 might have been (one of ?) the culprits behind the original tj-action compromise. We reported our findings to reviewdog maintainers yesterday (GHSA-qmg3-hpqr-gqvc).
wiz.io
A supply chain attack on tj-actions/changed-files leaked secrets. Wiz Research found another attack on reviewdog/actions-setup, possibly causing the compromise.
0
1
3
tj-actions - saga continues... 🍿 Based on our analysis, here's the current map of compromised actions:
1
7
15
🔥 You can now add TruffleHog to Burp Suite! 🌐 Install it directly from the BApp Store 🔍Scan web traffic for live, verified credentials—active & exploitable Because secrets don’t just leak in code… 😬 Big Thanks to @PortSwigger ! 🙌 🔗 https://t.co/1fZKNgJUKC
3
62
231
Most frequent languages in private vs public GitHub repos (Java - the most common compiled language - is only 8th):
0
0
0
Some interesting stats inside. Here are couple teasers - GitHub Apps permission scopes (second and third are dangerous scopes):
🔍 What did we learn from 100K+ code repos? Our latest research uncovers critical trends shaping the future of code and cloud security. We've pinpointed the vulnerabilities, misconfigurations, and risks that directly impact production — and they're hard to ignore.
1
2
6
Thrilled to finally share this—one of the coolest container escapes I’ve seen! 🔥 https://t.co/tXRRmJhMke A subtle logic bug that lets you break out to the host on ANY NVIDIA GPU-supported container 🤯 Can’t believe we had to sit on the technical details for so long! Incredible
A couple of months ago, we at @wiz_io discovered a container escape vulnerability in the NVIDIA Container Toolkit, which impacts many cloud and AI SaaS providers. We're finally able to share the technical details. https://t.co/ADU0puZsN6
1
10
47
🚨 Supply chain attack alert: The curious case of #Ultralytics. A #GitHub Action compromise led to the release of malicious versions (8.3.41, 8.3.42) of the popular Ultralytics Python package, embedding a cryptominer into systems via PyPI.
1
5
7