GitHub Security Lab

https://infosec.exchange/@GitHubSecurityLab

https://securitylab.github.com/

Verification: https://raw.githubusercontent.com/github/securitylab/main/mastodon/verifications.html

Public Key

npub1p3vejjq7hv2xzyaep8fslldw5murgn8lfahyegp5ev8t7d9few2qqur8jg

NIP-05 Address

githubsecuritylab_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsqckvefq0tk9rpzwusn5c0lkh2d7p5fnl57mjv5q6vkr4lxj5uh9qprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyf8wumn8ghj7mmxve3ksctfdch8qatz958e2r

Publishing to

relay.momostr.pink

offchain.pub

relay.snort.social

Author Public Key

npub1p3vejjq7hv2xzyaep8fslldw5murgn8lfahyegp5ev8t7d9few2qqur8jg

Show more details

Last Notes

2026-05-27 17:31:29 UTC

Proof of Concept for GHSL-2026-140 (CVE-2026-48095) in 7-Zip <= 26.00. A crafted archive shrinks a 256 MB buffer into 1 byte, overwrites a function pointer with file content, and redirects execution. Full weaponization needs an ASLR bypass. Fixed in 26.01. Read more at https://securitylab.github.com/advisories/GHSL-2026-140_7-Zip/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/647/726/654/108/998/original/58f55c0a4db3bb17.mp4

2025-12-30 08:58:30 UTC

Learn why some vulnerabilities resist to fuzzing and persist in long-enrolled OSS-Fuzz projects, and how you can find them!
https://github.blog/security/vulnerability-research/bugs-that-survive-the-heat-of-continuous-fuzzing/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/807/671/946/648/986/original/e6b97148503fd187.png

2025-07-02 00:24:11 UTC

Here are our June bug bounty stats!
✅ 120 bounty reports submitted
👥 103 hackers participated in our program
💰 Awarded $43,651 in bounties
Found a vulnerability? Submit it here: https://bounty.github.com

2025-03-24 17:48:34 UTC

Open source maintainers, did you receive your first vulnerability report? Don't panic! Handling vulnerability reports doesn’t have to be stressful. Read on to find out how you can tackle security issues efficiently and confidently with the right tools and approach. https://github.blog/security/vulnerability-research/a-maintainers-guide-to-vulnerability-disclosure-github-tools-to-make-it-simple/