If you're interested in the inner workings of unsafe deserialization in Ruby I got you covered with a blog post that explains in detail how a concrete gadget chain works:

https://github.blog/2024-06-20-execute-commands-by-sending-json-learn-how-unsafe-deserialization-vulnerabilities-work-in-ruby-projects/)

From JSON to command execution!

I've also created a repository containing proof of concept exploits that work up to Ruby 3.3 for Oj (JSON), Ox (XML) and Psych (YAML):
https://github.com/GitHubSecurityLab/ruby-unsafe-deserialization

... what matters most to us is our fix rate. When looking at the tens of thousands of reports in the GitHub Advisory Database, on average, 80% are fixed by maintainers. However, the fix rate for vulnerabilities the Security Lab reported is much higher: 96% of our reports end up with a fix.

https://github.blog/2023-09-21-the-github-security-labs-journey-to-disclosing-500-cves-in-open-source-projects/

#CodeQL zero to hero part 2: getting started with CodeQL

https://github.blog/2023-06-15-codeql-zero-to-hero-part-2-getting-started-with-codeql/

Part 1 is here:
https://github.blog/2023-03-31-codeql-zero-to-hero-part-1-the-fundamentals-of-static-analysis-for-vulnerability-research/

I made a thing... or two. GitHub Actions permissions Monitor and Advisor: #GitHubActions #security

https://github.com/GitHubSecurityLab/actions-permissions

Are you interested in learning CodeQL and you're at Nullcon Berlin?
Come to the CodeQL workshop this afternoon!
Simon (@intrigus) and I will give you an introduction into CodeQL and demonstrate a real world use case using data flow analysis and taint tracking:

https://nullcon.net/berlin-2023/identify-vulnerabilities-using-CodeQL

Please setup your laptop using these instructions:
https://gh.io/nc-2023-setup