ZARZA We are Zarza, the prestigious firm behind major projects in information technology.
Listen "[bounty] GitHub to GitLab RCE and a new PHP Supply Chain Attack"
Episode Synopsis
This week we look at a insecure deserialization (GitLab), argument injection (Packagist), and insecure string interpolation (Apache Commons Text)
Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/159.html
[00:00:00] Introduction
[00:01:01] New reward system to accelerate learning and growth on Detectify
[00:04:33] RCE via github import
[00:11:27] Securing Developer Tools: A New Supply Chain Attack on PHP
[00:17:32] FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive [CVE-2022-40684]
[00:23:08] Apache Commons Text Interpolation leading to potential RCE [CVE-2022-42889]
Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/159.html
[00:00:00] Introduction
[00:01:01] New reward system to accelerate learning and growth on Detectify
[00:04:33] RCE via github import
[00:11:27] Securing Developer Tools: A New Supply Chain Attack on PHP
[00:17:32] FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive [CVE-2022-40684]
[00:23:08] Apache Commons Text Interpolation leading to potential RCE [CVE-2022-42889]
More episodes of the podcast Day[0]
Exploiting VS Code with Control Characters
12/05/2025
Pulling Gemini Secrets and Windows HVPT
16/04/2025
ESP32 Backdoor Drama and SAML Auth Bypasses
17/03/2025
In God we trust