👨‍💻 GitHub Actions Security Pt 1: Attacks & Defenses

Part one of a two-part series on GitHub Actions security, covering the core threat model, common misconfigurations, and real-world attack examples.

https://www.wiz.io/blog/github-actions-security-threat-model-and-defenses

#github

🔐 Passkeys are Your New Best Friend

A lightweight intro to passkeys from Google.

https://bughunters.google.com/blog/passkeys-are-your-new-best-friend

#iam

🤖 How Amazon uses agentic AI for vulnerability detection at global scale

Amazon's RuleForge is a multi-agent AI system that auto-generates CVE detection rules from exploit PoC code. It uses parallel generation (via Amazon Bedrock/Fargate), a separate judge model (reducing false positives by 67%), and multistage validation, achieving 336% faster rule production than manual workflows while keeping humans in the final approval loop.

https://www.amazon.science/blog/how-amazon-uses-agentic-ai-for-vulnerability-detection-at-global-scale

#AI

🌩 My Claude Code Setup (2026 Edition)

A walkthrough of my Claude Code setup across a multi-project monorepo: global settings, safety guardrails, a context/plan/code workflow, subagents and plugins, and the StarCraft-themed customisations that make the terminal feel like mine.

https://blog.marcolancini.it/2026/blog-my-claude-code-setup

#ClaudeCode

🤖 magika

Fast and accurate AI powered file content types detection.

https://github.com/google/magika

#AI

🤖 redai

AI-driven vulnerability discovery and live validation.

https://github.com/kpolley/redai

#AI

👨‍💻 GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Wiz Research discovered CVE-2026-3854 (CVSS 8.7): an unsanitized semicolon injection in GitHub's X-Stat internal header allows any authenticated user to override security fields via git push -o, achieving RCE on GitHub com and full GHES server compromise.

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

#github

🤖 OpenShell

OpenShell is the safe, private runtime for autonomous AI agents.

https://github.com/NVIDIA/OpenShell

#AI

🖥 Proof, Not Promises: Evaluating Code Scanner Efficacy

How Block built benchmrk, a harness for measuring SAST scanner efficacy against ground truth you control.

https://engineering.block.xyz/blog/proof-not-promises-evaluating-code-scanner-efficacy

#SAST

🤖 LeakyLM: AI Assistants Are Leaking Your Conversations

Research disclosing that ChatGPT, Claude, Grok, and Perplexity embed third-party trackers (Meta, Google, TikTok) that leak conversation URLs, email hashes, and user identifiers, often bypassing cookie consent. via client-side pixels and server-side forwarding.

https://leakylm.github.io

#AI

🤖 The (In)security Landscape of AI-Powered GitHub Actions (Part 2/2)

Wiz researchers analysed popular AI GitHub Actions (Anthropic, OpenAI, Google) and found: bot permission-check bypasses enabling untrusted external apps to trigger AI workflows, novel credential-file exfiltration vectors unrecognised by LLMs as sensitive, and widespread misconfigurations in repos with 200,000+ combined stars.

https://www.wiz.io/blog/github-actions-security-ai-powered-actions-vulnerabilities

#AI