Hey! I'm Calvin Figuereo-Supraner, a security engineer at Snap. I lead Snap's security incident response program. Email me at mail@calvin.page....
The other day, I googled "wipr github" to see if there was an open-source GitHub repository for the popular macOS app Wipr 2 . Instead, I saw a search result for a phishing page hosted on GitHub. The phishing page belongs to the Wipr-2-Download-App GitHub organization (defanged below): hxxps[://]github[.]com/Wipr-2-Download-App The Wipr-2-Download-App organization has one public repository, named…
A few months ago, I found and reported a CVE in Go's google.golang.org/protobuf module, versions The nvd.nist.gov National Vulnerability Database has an entry for my CVE: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the…