Hey bounty hunters! GitHub updates its bug bounty program to improve how the company partners with the security research community. This update is designed to reduce ambiguity, prioritize the areas of highest risk, and improve the speed and quality of security outcomes. github.blog/security/nex...

Next chapter: Restructuring GitHub's bug bounty program

GitHub is making some significant changes to its bug bounty program, shifting its focus to give researchers a better experience.

github.blog

Are you in Krakow for EuroPython? Join Sylwia Budzynska for “Introduction to security research. Find a CVE with CodeQL” to learn how to look for vulnerabilities in code and query for them with CodeQL. 📆 Tuesday, 14th July ⏰ 13:45 📌 Kraków, Poland ep2026.europython.eu/session/intr...

Introduction to security research. Find a CVE with CodeQL.

Learn how to find security vulnerabilities at Introduction to security research. Find a CVE with CodeQL tutorial

ep2026.europython.eu

6 GitHub security settings every maintainer should enable this week. These won't make your project unhackable. Nothing will. What they do is close the easy doors... the ones attackers try first. Free, fast, and worth the few minutes it takes. 🔗 github.blog/security/6-s...

6 security settings every GitHub maintainer should enable this week

These six free settings will not make your project unhackable. Nothing will. What they will do is close the easy doors.

github.blog

What happens when you hand an AI agent its own tools, memory, and a path to production? Your job is to find the cracks before an attacker does. Play now: gh.io/scg Free. Open source. Get started in 2 minutes right from your browser.

Attending BSides Vilnius? Don't miss 📌 @yarlob.bsky.social 's session "LLM-assisted vulnerability hunting: hype vs. reality" to hear about the practical experience of using LLM for finding vulnerabilities in OSS such as Signal or 7-Zip! 📅 June 4, 16:45 EEST 📍 Vilnius, Lithuania 👉 bsidesvilnius.lt

BSides Vilnius 2026 — Security Theater | Cybersecurity Conference in Lithuania

BSides Vilnius 2026 — community-driven cybersecurity conference in Lithuania. Workshops, talks, and CTF on 3–4 June at Kablys. Join the infosec community.

bsidesvilnius.lt

Who's at DevTalks? Join @jkcso.bsky.social and discover practical ways to use AI for security through 12 GitHub Copilot demos from secure coding, to informed supply chain decisions, and secure SDLC. 📅 June 4, 14:00 EEST 📍 Bucharest, Romania 👉 www.devtalks.ro

DevTalks Romania

The largest expo conference for software developers and IT professionals in Romania, gathering over 8000 participants from all over the world.

devtalks.ro

Attending AI DevCon? Join Joseph Katsioloudes and discover practical ways to use AI for security through 12 GitHub Copilot demos from secure coding, to informed supply chain decisions, and secure SDLC. 📅 June 1, 10:00 AM BST 📍 London, UK & Virtual 👉 tessl.io/speaker/jose...

Proof of Concept for GHSL-2026-140 (CVE-2026-48095) in 7-Zip <= 26.00. A crafted archive shrinks a 256 MB buffer into 1 byte, overwrites a function pointer with file content, and redirects execution. Full weaponization needs an ASLR bypass. Fixed in 26.01. securitylab.github.com/advisories/G...

On 25th April at 10AM, join @blazingwind.bsky.social for the workshop "Introduction to security research. Find a CVE with CodeQL" at the Linux Session organized by Akademickie Stowarzyszenie Informatyczne in Wroclaw, Poland! Check out more information on the conference's website: linuksowa.pl

20. Sesja Linuksowa | Wrocław, Polska

Sesja Linuksowa to największa w Polsce konferencja poświęcona Wolnemu Oprogramowaniu oraz najnowszym trendom w systemach z rodziny GNU/Linux.

linuksowa.pl

Building with AI? 🤖 Then you won’t want to miss tomorrow’s @devoxx.fr workshop with @xcorail.bsky.social and @jkcso.bsky.social — all about how to build robust AI-powered applications. Shall we play a Game? LLM Security in Practice m.devoxx.com/events/devox... 📍 Paris 142 🗓️ April 22, 10.30am CET

Catch Shelby Cunningham on stage at CVE/FIRST VulnCon 2026 in Scottsdale, Arizona, at her panel “Supply Chains and Malware Campaigns: Is CVE the Right Way to Name the Game?”. Date: April 16, 2026 | 1:15–2:15 PM MST (UTC-7) Learn more: www.first.org/conference/v...

Program Agenda / CVE Program & FIRST VulnCon 2026

Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026

first.org

AI agents that execute commands, browse the web, and coordinate with other agents are everywhere. But how do you know they're safe? We let you find out by hacking one yourself. Free, hands-on, and you can get started in under 2 minutes! Learn more in our latest blog. github.blog/security/hac...

Hack the AI agent: Build agentic AI security skills with the GitHub Secure Code Game

Learn to find and exploit real-world agentic AI vulnerabilities through five progressive challenges in this free, open source game that over 10,000 developers have already used to sharpen their securi...

github.blog

Who’s at VulnCon? Join Sophia Sanles-Luksetich and Zachary Goldman at CVE/FIRST VulnCon 2026 in Scottsdale, Arizona. Learn more 🧵

Program Agenda / CVE Program & FIRST VulnCon 2026

Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026

first.org

A zero-permission Android app could read every photo, video, voice note, and document in your Signal chats. Downloaded Signal apk directly from Signal.org? You were vulnerable. securitylab.github.com/advisories/G...

GHSL-2026-102: Unauthorized exfiltration of decrypted attachments in Signal through Intent redirection

Versions >= v6.38.0 and < v8.4.2 of the website flavor of Signal for Android (distributed at https://signal.org/android/apk) allows another installed app without any permissions to exfiltrate decrypte...

securitylab.github.com

Hidden feature in Signal? Not for attackers! An attacker with no admin privileges can delete any message in a group!

Here are our March bug bounty stats! 🐛 380 bounty reports submitted 👩‍💻 260 hackers participated in our program 💰 Awarded $94,637 in bounties Found a vulnerability? Submit it here: t.co/HG2AqybW0p

Reviewed advisories hit a four-year low, malware advisories surged, and CNA publishing grew—here’s what changed and what it means for your triage and response. Read Jonathan Evans's A year of open source vulnerability trends: CVEs, advisories, and malware github.blog/security/sup...

A year of open source vulnerability trends: CVEs, advisories, and malware

Reviewed advisories hit a four-year low, malware advisories surged, and CNA publishing grew—here’s what changed.

github.blog

Software supply chain attacks are on the rise. Learn how open source contributors can use what GitHub Actions is building to help protect projects and the broader software community. github.blog/news-insight...

What's coming to our GitHub Actions 2026 security roadmap

A look at GitHub Actions’ 2026 roadmap, outlining how secure defaults, policy controls, and CI/CD observability harden the software supply chain end to end.

github.blog

Dear open source community, read our communication on CanisterWorm, learn what GitHub does to protect the community and what you can do to secure your supply chain www.linkedin.com/pulse/commun...

Communication on CanisterWorm

Dear open source community, On March 20th GitHub learned of a new supply chain attack through public disclosure by socket.dev dubbed CanisterWorm that affects more than 64 unique npm packages.

linkedin.com

Sign in with ANY password: How we used AI to break into a popular chat application, and other high-impact vulnerabilities. Read "How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework" github.blog/security/how...

How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework

GitHub Security Lab Taskflow Agent is very effective at finding Auth Bypasses, IDORs, Token Leaks, and other high-impact vulnerabilities.

github.blog

Hello hackers! Here are our February bug bounty stats! 🐛 200 bounty reports submitted 👩‍💻 144 hackers participated in our program 💰 Awarded $48,589 in bounties Found a vulnerability? Submit it here: t.co/HG2AqybW0p

If you're at #DeveloperWeek and you care about open source security, there is a session you must attend. We have been contributing to secure open source for 6 years and @xcorail.bsky.social will share with you the lessons learned from this journey! How GitHub Secures Open Source, PRO stage, 1pm.

Here are our January bug bounty stats! 🐛 182 bounty reports submitted 👩‍💻 112 hackers participated in our program 💰 Awarded $76,269 in bounties Found a vulnerability? Submit it here: t.co/HG2AqybW0p.

Learn how we triage security alerts in GitHub Actions and JavaScript projects with the new GitHub Security Lab Taskflow Agent, and leverage LLM to focus on the exploitable vulnerabilities. github.blog/security/ai-...

AI-supported vulnerability triage with the GitHub Security Lab Taskflow Agent

Learn how we are using the newly released GitHub Security Lab Taskflow Agent to triage categories of vulnerabilities.

github.blog

Excited to share our open source agentic framework for security research, a collaborative framework that lets the community share AI "taskflows”! Read @kevinbackhouse.bsky.social 's blog post for details and a demo. Join us in strengthening open-source security! github.blog/security/com...

Community-powered security with AI: an open source framework for security research

Announcing GitHub Security Lab Taskflow Agent, an open source and collaborative framework for security research with AI.

github.blog

We wrapped up 2025 on a high note—here are the bug bounty stats for December! ✅ 151 bounty reports submitted 👥110 hackers participated in our program 💰Awarded $48,367 in bounties Found a vulnerability? Submit it here: bounty.github.com.

Learn why some vulnerabilities resist to fuzzing and persist in long-enrolled OSS-Fuzz projects, and how you can find them! github.blog/security/vul...

In just 17 minutes, @yarlob.bsky.social shares his knowledge about securing GitHub Actions, drawing from hands-on experience uncovering hundreds of real-world vulnerabilities. The talk wraps up with FREE tools to automate GitHub Actions security you can start using TODAY. gh.io/secure-githu...

Resources

Securing open source software, together.

gh.io

GitHub Security Lab discovered a critical vulnerability in WooCommerce. We’d like to thank WooCommerce/Automattic for their incredibly quick response and fix of the vulnerability. If you are using WooCommerce, please update. For more info see: developer.woocommerce.com/2025/12/22/s...

Store API Vulnerability Patched in WooCommerce 8.1+ - What You Need To Know

A critical vulnerability in WooCommerce 8.1+ has been patched. We strongly recommend updating immediately.

developer.woocommerce.com

Hello Hackers! Here are our November bug bounty stats! 🐛146 bounty reports submitted 👩‍💻102 hackers participated in our program 💰Awarded $93,068 in bounties Found a vulnerability? Submit it here: bounty.github.com