Michael Stepankin (@artsploit.com)

Michael Stepankin

@artsploit.com

Security Researcher at GitHub Security Lab, ex Portswigger. https://artsploit.blogspot.com/

214 followers 49 following1 post

Michael Stepankin reposted

GitHub Security Lab

@securitylab.github.com

25 Aug 2025

What if attackers could hijack your coding agent through a simple GitHub issue? Prompt injections are a real and growing threat for VS Code Copilot Agent. Learn how these attacks work and how you can defend your environment. Read the full research: github.blog/security/vul...

github.blogSafeguarding VS Code against prompt injectionsSee how to reduce the risks of an indirect prompt injection, such as the exposure of confidential files or the execution of code without the user's consent.

Michael Stepankin

@artsploit.com

22 Jan 2025

Last year, I committed to uncovering critical vulnerabilities in Maven repositories. Now it’s time to share the findings: RCE in Sonatype Nexus, Cache Poisoning in JFrog Artifactory, and more! github.blog/security/vul...

Michael Stepankin reposted

ϻг_ϻε

@steven.srcincite.io

26 Nov 2024

I just wrote a new blog post! This is how I (ab)used a jailed file write bug in Tomcat/Spring. Enjoy! Remote Code Execution with Spring Properties :: srcincite.io/blog/2024/11...

srcincite.ioRemote Code Execution with Spring PropertiesRecently a past student came to me with a very interesting unauthenticated vulnerability in a Spring application that they were having a hard time exploiting...

Michael Stepankin reposted

James Kettle

@jameskettle.com

15 Nov 2024

How's your day going?

You are up to date.