Name: Forked and Owned: Taking Over GitHub Repositories via a single Pull Request
Start: 2026-04-24T11:00:00+0200
End: 2026-04-24T11:45:00+0200

It is an annual, community-driven information security conference held in Prague. The event provides a platform for cybersecurity professionals, enthusiasts, and researchers to share knowledge, exchange ideas, and discuss the latest trends in the field. It’s a unique opportunity to connect with like-minded individuals, expand professional networks, and stay informed about the ever-evolving cybersecurity landscape.
More info at www.bsidesprg.cz

Forked and Owned: Taking Over GitHub Repositories via a single Pull Request

Friday April 24, 2026 11:00 - 11:45 CEST

Lucerna Cinema - MAIN

GitHub Actions is broken. Attackers can now enjoy an RCE-as-a-service vector that can lead to significant downstream effects. In this talk, you will learn how I managed to compromise the repositories of Google, Microsoft and other Fortune-100 companies, simply by creating a pull request from a fork.

Speakers

Ari Marzuk

Senior Security Researcher, Microsoft

Ari Marzuk (also known as MaccariTA) is a Senior AI Security Researcher at Microsoft with nearly a decade of cybersecurity experience. He previously worked for Salesforce, NSO Group and the Israeli Military Intelligence. In 2025, Ari published "IDEsaster" revealing 25 new CVEs in... Read More →

Roi Nisimi

Orca Security

Roi Nisimi is a Principal Security Researcher at Orca Security with over a decade of experience in vulnerability research and offensive cybersecurity. He honed his skills during six years of service in the Intelligence Corps of the IDF, where he achieved the rank of Lieutenant before... Read More →

Friday April 24, 2026 11:00 - 11:45 CEST
Lucerna Cinema - MAIN Vodičkova 704 /36/110 00, 110 00 Nové Město

talk

Security BSides Prague 2026

Ari Marzuk

Roi Nisimi

Attendees (75)

Get help with the event

Security BSides Prague 2026

Ari Marzuk

Roi Nisimi

Attendees (75)

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event