Risky Business #837 -- GitHub Actions footgun claims TanStack
MentionsGitHub
Runs 1:05:15. Streams from dts.podtrac.com only when you press play.
On this week’s show Patrick Gray, Adam Boileau and James Wilson discuss the week’s cybersecurity news. They cover: Mini Shai-Hulud and the TanStack compromise using Github Actions Instructure pays Canvas elearning platform data extortionists More Linux privilege escalation 0days! CISA helping critical infrastructure operators rearchitect their networks so they work offline This week’s episode is sponsored by email security platform Sublime Security. Bobby Filar chats with Patrick about how agentic AI is being evaluated by buyers in a marketplace that’s experiencing “AI fatigue”.
Show notes from Risky Business.
Explained
The technology and terms in this story. Learn more
- TechnologyGitHub ActionsGitHub's automation that builds, tests and releases code, often with access to secrets.
- AttackPrivilege escalationGoing from limited access to more powerful access, such as from a normal user to administrator.
- TechnologyAI agentAn AI model that acts on its own: it plans steps, uses tools and takes actions, not just answers.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.