Slides from a talk which details GitHub Actions supply chain attacks, demonstrating forensic investigation methodology using public GitHub data. Covers user analysis, attack patterns, payload recovery, deleted evidence reconstruction, and pivoting techniques for threat intelligence without private feeds.   #attack   #ci/cd   #supply-chain   #monitor

A post explaining how to encrypt files with passkeys, using the WebAuthn prf extension and the TypeScript age implementation.   #build

This article details a GitLab vulnerability (CVE-2025-5819) where merge request pipelines could obtain ID tokens with identical 'sub' claims as protected branches, enabling potential privilege escalation through OIDC authentication.   #ci/cd   #attack

This white paper examines the risks and attack vectors inherent in hybrid multi-cloud infrastructures, and analyzes various attack paths observed by Mandiant in real-world multi-cloud scenarios.   #iam

SCOM suffers from similar insecure default configurations as its SCCM counterpart, enabling attackers to escalate privileges, harvest credentials, and ultimately compromise the entire management group and its monitored infrastructure.   #attack   #monitor

LLM security testing framework for detecting prompt injection, jailbreaks, and adversarial attacks. See also the companion blog post.

Sandboxed devcontainer for running Claude Code in bypass mode safely. Built for security audits and untrusted code review.

A CLI tool for managing DigitalOcean droplets with automated setup, SSH configuration, and lifecycle management.

Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows.

Curated, community-vetted Claude Code plugin marketplace.

That helpful “Summarize with AI” button? It might be secretly manipulating what your AI recommends. Microsoft security researchers have discovered a growing trend of AI memory poisoning attacks used for promotional purposes, a technique they called "AI Recommendation Poisoning".

A practical security guide to OpenClaw: first principles, real attack vectors, skill supply-chain risks, and safe experimentation playbooks.

A practical workflow for threat modeling agentic AI systems: use a five-zone navigation lens to trace attack paths, formalize them as attack trees, and map to OWASP's threat taxonomy and playbooks.

Feb 25 - Mar 04, 2026 | Goa, India

Feb 25-27, 2026 | London, United Kingdom