With @ostifofficial.bsky.social and @sovereign.tech we audited @symfony.com YAML, the library bundled in that PHP framework that all your friends probably run somewhere in their stack. If that's true, please update and read the attached blogpost to find out if you're affected! Links ⏬

Our external security audit with @shielder.com @ostifofficial.bsky.social and @cncf.io is out! 3 CVEs were found, all of which have been addressed in v0.51.1. Thank you to everyone involved inspektor-gadget.io/blog/2026/04...

Results from the First Inspektor Gadget Security Audit | Inspektor Gadget

Inspektor Gadget completed its first independent security audit, conducted by Shielder and coordinated by OSTIF. The audit found three vulnerabilities — all now fixed — plus six hardening recommendati...

inspektor-gadget.io

Can a hostile container sneak past your eBPF tracing? Sometimes, yes. With @ostifofficial.bsky.social & @cncf.io we audited Inspektor Gadget - 3 vulns (fixed), 6 hardenings, 6 bypasses (io_uring, openat2, jumbo frames…). Work by ndaprela & @suidpit.sh👏 🔗 www.shielder.com/blog/2026/04...

Shielder - Inspektor Gadget Security Audit

Security audit of Inspektor Gadget, an eBPF-based observability framework for Linux and Kubernetes. Sponsored by the CNCF (Cloud Native Computing Foundation), facilitated by Open Source Technology Imp...

shielder.com

#KubeCon EU starts today and guess what? Our very own @suidpit.sh will be on stage with a panel about the @kubernetes.io Security Audit we performed during 2025 with the support of @ostifofficial.bsky.social! 🗓️ March 25 - 16:45 CET 📍 Hall 8 | Room F

Attending @1ns0mn1h4ck.bsky.social? Meet @not4nhacker.bsky.social @luk3ros.bsky.social and Severus from our AppSec and Red teams! They are eager to discuss about breaking complex authentication implementations and relaying all the things to DA!

Presenting our 2025 annual report! In our report, you’ll see that OSTIF's story and mission are intertwined. OSTIF will continue to fight for open source infrastructure and the privacy rights of users for as many decades as you’ll let us. Our statement and report link: ostif.org/2025-annual-...

Love breaking things just to see how they work? 🐛🔨 ​A @shielder.com delegation is on the ground at @fosdem.org, and we're looking for fellow hackers and security researchers. ​If you are passionate about securing the Open Source world, we definitely need to talk!

Happy New Year, Hackers! 🎆 We’re looking forward to a 2026 full of crazy exploits, instant patches, and - most importantly - YOU, the amazing human beings behind the screens.

Bootloaders acting weird? 🐛 If you are at #39c3, catch @shielder.com's own @thezero.org to geek out over bootloader oddities and low-level vulnerabilities.

Want to learn more about our approach into auditing complex libraries and writing cool exploits? 🗓️: Dec 02 🕗: 20:00 CET RSVP: luma.com/ostif-meetup...

OSTIF Meetups · Events Calendar

View and subscribe to events from OSTIF Meetups on Luma.

luma.com

@ostifofficial.bsky.social · 8mo ago

@shielder.com security researchers Davide and Pietro will be presenting on their audit of OpenEXR next Tuesday, 13:00 CST. Join to hear about how a team at the top of their game is auditing high-value targets used in a billion dollar industry. RSVP here: luma.com/ir16fuig

Attending #theSAS25? Meet @paupu.bsky.social for his PAM pwnage talk! It won't be recorded and it might *wink wink* contain a cool drop you don't want to miss 👀

paupu@paupu.bsky.social · 9mo ago

Ready for #theSAScon25 in Khao Lak 🇹🇭 🌴 Ping me if u wanna say hi!

👋🏿 Hackers! Are you a Red Teaming Wizard 🧙🏿 looking for a new challenge? @shielder.com is hiring a Red Teaming Lead to join our crew! More info ⬇️ (share appreciated) #hiring #redteaming romhack.io/job-opportun...

RomHack - Job opportunities

Check for RomHack sponsor's job opportunities

romhack.io

In partnership with @aswf.io, OSTIF and @shielder.com worked on audits of MaterialX and OpenEXR. Our deepest gratitude for this opportunity to work with incredible maintainers and cool projects such as these- read about them at our blogs: ostif.org/materialx-au..., ostif.org/openexr-audi...

🚨 New Open Source Audit Alert! 🚨 Shielder, with @ostifofficial.bsky.social & ASWF audited OpenEXR and MaterialX: 🔍 11 issues found (1 critical, 3 still to be published) ✔️ Most fixed, others planned 🗣️ ndaprela @smaury.bsky.social @suidpit.bsky.social @thezero.org Full details in the blog post ⬇️🧵

Last week Apple released MacOS 13.4 which contains a fix for a vulnerability @suidpit.bsky.social exploited to escape the Sandbox. Update now and stay tuned for the technical details! Ref: support.apple.com/en-us/122373

In Lausanne for @1ns0mn1h4ck.bsky.social? Don’t miss the chance to meet our very own @not4nhacker.bsky.social! If you're into cursed OAuth hacking techniques or breaking mobile apps, find a comfy spot -- you might be there for a while!

Ship happens- and that's why security audits are an important part of security efforts. We facilitated work on #Karmada thanks to support from the @cncf.io and with auditing performed by @shielder.com. You can now sea the impact of an audit for yourself at ostif.org/karmada-audi...

🚨 New Open Source Audit Alert! 🚨 Shielder, with @ostifofficial.bsky.social & @cncf.io, audited karmada-io: 🔍 6 issues found (1 high, 1 medium, 2 low, 2 info) ✔️ Most fixed, others planned. 🗣️ to @suidpit.bsky.social and @thezero.org Full details in the blog post! www.shielder.com/blog/2025/01...

The best infosec swag in town. @shielder.com

Attending #TheSASCon2024 in the beautiful Bali🏝️? Make sure not to miss @suidpit.bsky.social's talk about his novel research on the macOS 🍎 sandbox and how to bypass it. 🗓️ Wednesday, October 23 - 15:10

For the weekend, we gift you with not one, but TWO ways to escalate `sudo iptables` (+ a couple other boring preconditions) into a r00t shell - read how @smaury.bsky.social and @suidpit.bsky.social managed to climb your friendly neighborhood 🔥wall! www.shielder.com/blog/2024/09...

Shielder - A Journey From `sudo iptables` To Local Privilege Escalation

In this post, we demonstrate two techniques allowing a low privileged user to escalate their privileges to root in case they can run iptables and/or iptables-save as

shielder.com

Our very own @suidpit.bsky.social will present his novel #macOS research at #TheSAS2024 - if you want to learn more about the macOS sandbox and how to escape it make sure to be in Bali 🏝️ from Oct 22 to Oct 25! Learn more here: thesascon.com

During a recent engagement Mindless hacked his way through Vtiger CRM which led to discover a privilege escalation and a SQL injection. Learn more in the dedicated advisories: - CVE-2024-42994 #sqli www.shielder.com/advisories/v... - CVE-2024-42995 #privesc www.shielder.com/advisories/v...

Back in December 2023 our researchers @thezero.org @suidpit.bsky.social and Mindless performed an audit sponsored by AWS and facilitated by OSTIF on boost. It resulted in 7 findings and 15 new fuzzers. The report is now public, check the details here: www.shielder.com/blog/2024/05...

Shielder - Boost Security Audit

Boost Security Audit, sponsored by Amazon Web Services (AWS), facilitated by Open Source Technology Improvement Fund (OSTIF) and performed by Shielder.

shielder.com

In early 2023 we (@thezero.org & @smaury.bsky.social) collaborated with SecureDrop to start designing and prototyping the #E2EE messaging protocol for a future version of SecureDrop. 📄 blog post: securedrop.org/news/introdu... 💻 poc code: github.com/freedomofpre...

Introducing SecureDrop Protocol

This blog post is a part of a series about our research toward the next generation of the SecureDrop whistleblowing …

securedrop.org

Exciting news! We've just released a new blog post on mobile app security, where @suidpit.bsky.social and @thezero.org used their intent-fu to discover vulnerabilities (CVE-2024-26131, CVE-2024-26132) in Element, a @matrix.org client for Android. #writeup #CVE www.shielder.com/blog/2024/04...

Shielder - Element Android CVE-2024-26131, CVE-2024-26132 - Never Take Intents From Strangers

A writeup about two intent-based Android vulnerabilities CVE-2024-26131 and CVE-2024-26132 in Element (Matrix).

shielder.com

We recently partnered with the Open Source Technology Improvement Fund (OSTIF) to perform a security audit sponsored by AWS on Bref. The audit resulted in 5 findings promptly addresses by @mnapoli.bsky.social. The report is now public, check the details here: www.shielder.com/blog/2024/03...

Shielder - Bref Security Audit

Bref Security Audit, sponsored by Amazon Web Services (AWS), facilitated by Open Source Technology Improvement Fund (OSTIF) and performed by Shielder.

shielder.com

Hey hackers - attending #Nullcon? Pop to say hi and talk about AppSec and VR! You can find @smaury.bsky.social @thezero.org @suidpit.bsky.social around 🖖🏿

During a recent Red Team Assessment @thezero.org and @smaury.bsky.social discovered a vulnerability in PostgreSQL's #PgAdmin which in the worst case allows unauthenticated attackers to run arbitrary server-side code. Check out the #RCE advisory and patch now! www.shielder.com/advisories/p...

Shielder - pgAdmin (<=8.3) Path Traversal in Session Handling Leads to Unsafe Deserialization and Remote Code Execution (RCE)

pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing user's session in the session handling code. If the server is running on Windows, an unauthenticated attacker can load ...

shielder.com

Hey hackers! Are you attending @fosdem.bsky.social? If you want to talk about open-source software and hardware security make sure to hit up @smaury.bsky.social and @thezero.org!