ZeroPath

Black Hat 2026: The Supply-Chain Trust Series by Dr. Arun Lakhotia explores Microsoft, ReversingLabs, NetRise, Chainguard, ActiveState, Magnitude & ZeroPath. Read the series: https://ow.ly/uZjk50ZAH1R

Last day to stop by booth #7908 at Black Hat USA! How many false positives can you catch in 90 seconds? 🤔

#ready SkillBit (formerly MetaCTF) x ZeroPath

Heading to Vegas with everyone else this week. If you want to catch us, here’s a list of where team SkillBit (formerly MetaCTF) will be. Hit me up if you want to say hello outside of our events! 🙌 🦉 🔶 Tuesday x SkillBit at Black Hat booth #5551 with The Ginger Hacker Initiative 🔶 Tuesday x Dinner with SkillBit (small group) 🔶 Wednesday x Roman and I at CISO Games 🔶 Wednesday x SkillBit at Black Hat booth #5551 with The Ginger Hacker Initiative 🔶 Wednesday x Race into Black Hat with SkillBit and ZeroPath at F1 Arcade 🔶 Wednesday x Dinner with SkillBit (small group) 🔶 Thursday x Attack / Defense CTF with US Cyber Games at HyperX Arena Las Vegas 🔶 Thursday x Hacking on the Higher Roller CTF hosted by us 🙂 🔶 Thursday x SkillBit at Black Hat booth #5551 with The Ginger Hacker Initiative 🔶 Friday x Roman‘s workshop on web security at Noob Village 🔶 Friday / Sat / Sun x CTF at Noob Village 🔶 Friday / Sat / Sun x CTF at Red Team Village 🔶 Friday / Sat / Sun x CTF at Blue Team Village Whew...with Hacker Summer Camp, back to school, and two of our kids’ birthdays, it’s going to be a busy August! 🙂 See y’all this week!

Software supply chain attackers are increasingly turning their sights on how to abuse security tools in the development pipeline. I talked to ZeroPath's Raphael Karger for this piece in Dark Reading previewing his session next week at Black Hat USA. He'll show how simply feeding malicious repositories into security scanners can potentially give attackers a pivot into their customers' build environments. This is no academic exercise. The research was inspired by an attack his firm repelled from its own systems. Karger will drop a new tool to help orgs audit their security scanners for weakness to this attack path. https://lnkd.in/ekXHzw_g

The tools we trusted to find vulnerabilities are now an attack surface. On July 29, Dark Reading reported on research from ZeroPath in which Raphael Karger's team tested 20 AppSec scanning vendors and found five with exploitable weaknesses including cloud credentials, production database access, and developer tokens that an attacker could use to turn a scanner into a supply chain foothold. This is a different attack model from the Trivy and KICS compromises where attackers breached the development environment itself. In this case, an attacker only needs to feed a scanner a malicious repository. When the scanner processes untrusted content without proper isolation, which many do, it becomes the attacker's proxy inside the pipeline. There is no breach and no stolen credentials, only a carefully crafted codebase and the assumption that scanners operate in read-only mode. At Black Hat next week, Karger will release Build Canaries as an open source tool with 349 validated payloads and a taxonomy of repository ingestion execution surfaces. It gives security teams a way to ask their AppSec vendors the same question they ask of any build tool: can you be turned against me? The uncomfortable truth is that AppSec is a hyper-competitive market where vendors often prioritize feature velocity over isolation architecture and the customer who trusts the scanner's output is rarely aware of the boundary between reading and executing. You can outsource the scanning but you cannot outsource the liability for what runs inside it. When was the last time you audited the tools that audit your code? https://lnkd.in/gQ4eWQWR

Impossible task for the week: go find the 3 real bugs in this pile of 10,000 alerts 🏹