Shay Berkovich @sshaybbc

Threat Research at WIZ Israel Joined March 2016

Tweets

125
Followers

167
Following

221
Likes

978

Shay Berkovich @sshaybbc

a month ago

@ramimacisabird Love the presentation, its crucial to catch the link between the waves.

0 0 1 20 0

View Details

🫂"hugs from TeamPCP." We're now 47 days and three rounds deep into the Checkmarx incident -- and this time TeamPCP left a message for victims in `~/hugs_from_teamPCP.txt` Things appear mitigated, but waiting to see if rotation was a bit more atomic this time 🤞

2 4 39 3K 8

View Details

Shay Berkovich @sshaybbc

2 months ago

List of most popular/active public repos on GitHub - April edition: - @openclaw hype is over? - @Microsoft GenAI tutorials are back to the first place - April normalized to AI models and established learning resources

0 0 2 38 0

View Details

Amitai Cohen @AmitaiCo

2 months ago

Preliminary exploit detections for Copy Fail (CVE-2026-31431) based on our tests (these work best in combination): 1. "NET: Registered PF_ALG protocol family" in kern.log & syslog 2. curl for "copy[.]fail/exp" (if attacker is lazy) 3. su record without invoking user in auth.log

0 3 5 489 0

View Details

Shay Berkovich @sshaybbc

2 months ago

Did somebody manage to use it as a container escape from a non-priv container?

Xint @xint_official

2 months ago

Patch your Linux boxes! Copy.Fail is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms. Found by the teams at @theori_io and @xint_official More

23 362 982 250K 457

0 0 0 64 0

View Details

Rami McCarthy @ramimacisabird

2 months ago

Fork commits keep showing up in supply chain attacks (tj-actions, reviewdog, TeamPCP). But, I keep seeing incorrect explanations in incident threads/blogs So I built a microsite to cut through the confusion 🔗in🧵

2 9 27 3K 15

View Details

Shay Berkovich @sshaybbc

3 months ago

Another interesting point - the first non-AI repo is only 6th place.

0 0 0 37 0

View Details

Shay Berkovich @sshaybbc

3 months ago

Monthly list of most popular/active public repos on GitHub: - @openclaw keeps the first place (although its half pace comparing to February) - Rise of the personal claude skills and harnesses over official anthropics/skills - karpathy/autoresearch - fast-breaker

3 1 3 636 3

View Details

Shay Berkovich @sshaybbc

3 months ago

Turns out # of forks is a great metric of repo popularity. Here is the most popular/forked repos of Feb 2026. Of course, #OpenClaw is leading the pack:

0 1 7 139 1

View Details

Shay Berkovich @sshaybbc

5 months ago

@blackroomsec Any feedback is welcome, please DM or slack! Planning additional updates meanwhile.

1 0 1 15 0

View Details

Shay Berkovich @sshaybbc

5 months ago

@GrahamHelton3 This is great research @GrahamHelton3 . Couldn't find it in the blog - is the command execution possible with node/proxy:list or node/proxy:watch?

1 0 2 2K 0

View Details

Wiz @wiz_io

6 months ago

UPDATE: Shai-Hulud 2.0 has a long tail, and it may have led to $7M in crypto theft. Earlier today, our update laid out how sha1-hulud may have caused the Trust Wallet incident. Trust Wallet just announced the same conclusion 📷Read our analysis >> wiz.io/blog/snipping-…

0 7 31 2K 7

View Details

Shay Berkovich @sshaybbc

6 months ago

Or extend their PAT revocation API to cover other token types: docs.github.com/en/rest/creden…

0 0 0 29 0

View Details

Shay Berkovich @sshaybbc

6 months ago

With #shaihulud2 refuses to die with the long tale of infections (117 new compromised machines in the last 72 hours, most of them form @Cursor IDE), all @github has to do is disable the gho_ tokens of the super-spreaders (last 2 active spreaders are Cpreet and moh-abed).

1 0 1 95 0

View Details

Rami McCarthy @ramimacisabird

7 months ago

🪱sharing more on sha1-hulud w/@sshaybbc * 2 packages == ~60% of infections * 400k unique secrets in truffleSecrets.jsons, only 2.5% verified, & the majority of those short lived JWTs for GitHub Actions! * 3/4 of impacted workloads were CI/CD, 1/4 were users 🔗below

1 5 11 1K 1

View Details

Shay Berkovich @sshaybbc

7 months ago

Second part of our research on secret leaks In AI.

Wiz @wiz_io

7 months ago

🤖 65% of Forbes AI 50 companies leaked secrets on GitHub. @sshaybbc revealed how AI speed without security = leaks waiting to happen. Full Wiz Research report 👉 wiz.io/blog/forbes-ai…

0 3 5 1K 2

0 2 3 360 0

View Details

Shay Berkovich @sshaybbc

8 months ago

@brankopetric00 I would advise to go with EKS pod identity rather than IRSA.

0 0 0 41 0

View Details

Shay Berkovich @sshaybbc

9 months ago

@adnanthekhan At the end we need an attribution to stop this crazy attack sequence, I'd love to see more publications around the actor behaviour and to see GH doing more.

0 1 1 169 0

View Details

Shay Berkovich @sshaybbc

9 months ago

@adnanthekhan No cloud impact so far, but the abuse of the cloud access is an incremental evolution step that this actor seems to demonstrate with every attack. Given the likely pool of cloud creds they have now I won't be surprised...