Researching and Remediating RCEs via GitHub Actions – Bar Kaduri, Roi Nisimi – ASW #355
Pull requests are a core part of collaboration, whether in open or closed source. GitHub has documented some of the security consequences of misconfiguring how PRs can trigger actions. But what happens when repo owners don't read the docs? Bar Kaduri and Roi Nisimi walk through their experience in reading docs, finding vulns, demonstrating exploits, and working with repo owners to improve their security. Their work highlights the challenges in maintaining good security guidance, figuring out secure defaults, and how so many orgs still struggle with triaging external security reports -- something that's becoming even more challenging when orgs are being flooded with low-quality reports from LLMs.
Segment Resources:
Bar Kaduri is the Cloud Security Threat Research team leader at Orca Security. With a background encompassing malware analysis and cybersecurity roles in private enterprises and the military, coupled with a BSc in Computer Science and Biology, Bar brings extensive expertise to Orca Security’s Research Pod. This involves analyzing large datasets to fuel innovation and bolster public cloud security. As the Research Team Leader, Bar leads Orca Security’s efforts in providing innovative solutions to address and find emerging threats.
Roi’s character was shaped by a deep sense of family, both at home and during his military service. Educated in the values of integrity and excellence and mentored by leading professionals, he developed a strong foundation for a career defined by curiosity and precision.
As a member of the Israeli Defense Forces intelligence corps, Roi served in two of its top elite technological units, 81 and 8200. This experience proved transformative, offering the opportunity to bring some of the most ambitious ideas in offensive cybersecurity and vulnerability research to life. He contributed to a range of complex projects, both in and out of uniform, including work tied to national security.
A graduate of the Silan training program and a former officer in the Israeli Military, Roi approaches research with a singular focus: to question and understand the “why.” Beyond his professional work, he maintains a broad set of interests spanning finance, sports, veganism, and climate change.
Mike Shema
- PhantomRaven: NPM Malware Hidden in Invisible Dependencies | Koi Blog
- AIxCC curl details | daniel.haxx.se
- An 18-Year-Old Codebase Left Smart Buildings Wide Open
Check out the presentation in December if you'll be at BlackHat Europe 2025.
- The cryptography behind electronic passports
- Octoverse: A new developer joins GitHub every second as AI leads TypeScript to #1
- FYI: A New Course on Secure AI/ML-Driven Software Development
