OWASP Global AppSec Lisbon 2024

Why did an individual, not-security-related person discover the XZ attack on such an important upstream open-source project such as the XZ Utils?




Four years after the SolarWinds attack, we still see confusion when it comes to Vulnerabilities, Zero-Days & just intentional Malware. So let’s talk about it!




In this session, we will highlight the differences between those various Open-Source threats.

We will shine a spotlight on a critical yet often overlooked area: compromised 3rd party libraries and CI/CD attacks. 




We'll showcase real-world examples, differentiate vulnerabilities from attacks (spoiler alert - Log4J is not an attack), and attach the risks to frameworks like NIST SSDF, OWASP PSCF, and SLSA.