Show Notes
Wiz researcher Sagi Tzadik joins us to break down how a single semicolon led to a critical Remote Code Execution (RCE) vulnerability in GitHub.
For two years, Sagi sat on a lead. Reverse engineering GitHub's microservices manually was too tedious to justify the time. Then, AI agents arrived. By hooking Claude directly into his reverse engineering software, he condensed months of grueling binary analysis into 48 hours. The result? A critical bug in how GitHub handles git push options that exposed both SaaS and Enterprise environments. We get into the weeds on how different microservices interpreting the same input differently creates massive attack surfaces, and why security by obscurity is officially dead in the age of AI.
What's Inside: - How combining Claude with the IDA MCP server dramatically sped up the reverse engineering process - The technical anatomy of the GitHub semicolon vulnerability. - Why microservice communication breakdowns lead to critical RCEs. - The massive difference in impact between GitHub.com and GitHub Enterprise Server. - Why Enterprise users need to patch their instances immediately.
Resources: - Learn more about the findings at: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
More from Crying Out Cloud
🚨 How AI just broke PHP (and 70% of the internet).On this episode of Crying Out Cloud, Amitai Cohen sits down with Sagi Tzadik (Wiz Research) and Thai Duong (Calif) to unpack a massive PHP RCE vulnerability discovered entirely by AI agents.This isn't just another zero-day story. It's a look at the terrifying new reality of "agentic exploit development." What used to take human researchers months of tedious lab setups and debugging to weaponize a memory corruption bug took AI agents a couple of weeks, working while the researchers slept.What's Inside:- How an AI model looking for a Drupal bug accidentally found a foundational PHP flaw from 2004.- Why AI scaling exploit development across multiple software versions changes the threat landscape.- The massive logistical challenge of coordinating a patch for 70% of the web alongside distros, WAFs, and cloud providers.- How defenders can use these same AI agents to scale detection engineering.
On this episode of Crying Out Cloud, Eden Koby Naftali & Amitai Cohen sit down with John Hultquist, Chief Analyst at Google Threat Intelligence Group (ex-Mandiant, ex-FireEye, founder of CYBERWARCON & SLEUTHCON). Drawing on over two decades of tracking state-sponsored adversaries like Sandworm, John cuts through the hype to explain what modern threat intelligence actually does: it keeps CISOs from burning millions of dollars on the wrong technology, spots adversary shifts before static IOCs exist, and bridges the gap between raw binary reverse-engineering and executive decision-making. In this episode, John unpacks how threat actors are weaponizing AI and bypassing commercial costs entirely and traces the real shift underway: adversaries embedding adversarial prompt-injection payloads inside malware to shut down automated SOC scanners. What's Inside: 1. The economics of illicit AI: Underground access vs. hijacked enterprise compute 2. Malware poison pills designed to neutralize automated LLM triage 3. Why firmware and ICS layers are becoming primary targets for disruption 4. Behavioral detection models when living-off-the-land means zero usable IOCs 5. Lessons from tracking Sandworm and convincing leadership to act before the lights go out
AI is changing the security landscape, but are we automating the wrong things? On this episode of Crying Out Cloud, Eden Koby Naftali & Amitai Cohen sit down with Daniel Miessler to unpack why most companies are completely unprepared for the AI revolution. Daniel drops some heavy truths about what happens when we automate the "boring" parts of security, and why attackers are currently winning the AI arms race.
On this episode of Crying Out Cloud, Eden Koby Naftali & Amitai Cohen sit down to unpack the wildest cloud security news of the month: from AI chatbots going rogue to massive supply chain battles. What's Inside: - The WP2Shell vulnerability and why 60% of WordPress instances were at risk - GitHub's aggressive mitigations to combat TeamPCP's supply chain attacks - Why 20-year-old vulnerabilities like SquidBleed are suddenly being unearthed by AI - The Klue hack and the hidden dangers of over-privileged AI agents in Salesforce - How attackers bypassed Meta's security using VPNs, deepfakes, and a gullible AI support bot
AI-Powered Malware and the Future of Threat Hunting