Episode 322 - Megalodon, Staged Package Publishing, AI Powered Honeypots

Impossibile aggiungere al carrello

Puoi avere soltanto 50 titoli nel carrello per il checkout.

Riprova più tardi

Rimozione dalla Lista desideri non riuscita.

Riprova più tardi

Non è stato possibile aggiungere il titolo alla Libreria

Per favore riprova

Non è stato possibile seguire il Podcast

Per favore riprova

Esecuzione del comando Non seguire più non riuscita

Episode 322 - Megalodon, Staged Package Publishing, AI Powered Honeypots

Ascolta gratuitamente

Vedi i dettagli del titolo

Offerte di stagione | 0,99 €/mese per i primi 3 mesi

A seguire 9,99 €/mese – si applicano condizioni. Puoi disdire mensilmente.

A proposito di questo titolo

In episode 322, the co-hosts examine critical vulnerabilities, changing security standards, and adaptive defense mechanisms. They deep dive into the recent "Megalodon" breach, identifying it as a direct poisoned pipeline execution attack. Rather than exposing a flaw inside GitHub itself , researchers at Hudson Rock traced the root cause to credentials stolen from developer desktops via infostealer malware, which allowed attackers to push base64-encoded payloads into GitHub Actions workflow YAML files. To counter these types of automated supply chain threats, the hosts praise NPM's newly released "staged publishing" pipeline, which mandates two-factor authentication from human maintainers before releasing packages pushed by automated CI/CD workflows. Shifting to framework flaws, they highlight a catastrophic, vanilla SQL injection flaw discovered in GoCMS during active exploitation. Finally, the duo reviews the emergence of AI-powered honeypots highlighted Talos Intelligence. They conclude that turning the tables on attackers by utilizing LLM-driven "hall of mirrors" environments to impersonate real systems represents an innovative, under-explored AppSec strategy designed to drain attacker resources and trigger high token costs.

Ancora nessuna recensione