Securing the git push pipeline: Responding to a critical remote code execution vulnerability
How we validated, fixed, and investigated a critical vulnerability in under two hours, and confirmed no exploitation.
Learn more
CVE
Security Supply chain security 
A year of open source vulnerability trends: CVEs, advisories, and malware
Reviewed advisories hit a four-year low, malware advisories surged, and CNA publishing grew—here’s what changed and what it means for your triage and response.
Learn moreSecurity 
How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework
GitHub Security Lab Taskflow Agent is very effective at finding Auth Bypasses, IDORs, Token Leaks, and other high-impact vulnerabilities.
Learn moreVulnerability research 
CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre
DjVuLibre has a vulnerability that could enable an attacker to gain code execution on a Linux Desktop system when the user tries to open a crafted document.
Learn moreSecurity 
What is the GitHub advisory database, and how does it help you secure dependencies?
Use these insights to automate software security (where possible) to keep your projects safe.
Learn moreVulnerability research 
How to request a change to a CVE record
Learn how to identify which CVE Numbering Authority is responsible for the record, how to contact them, and what to include with your suggestion.
Learn moreSupply chain security 
Open source supply chain security explained: The essential role of CVEs
Vulnerability data has grown in volume and complexity over the past decade, but open source and programs like the Github Security Lab have helped supply chain security keep pace.
Learn moreCompany 
Fuzzing sockets: Apache HTTP, Part 3: Results
In this third and last part, I’ll share the results of my research on Apache HTTP server, and I’ll show some of the vulnerabilities that I’ve found.
Learn moreVulnerability research 
Getting root on Ubuntu through wishful thinking
How to exploit a double-free vulnerability in Ubuntu’s accountsservice (CVE-2021-3939)
Learn more
