Are We Ready For The Next Cyber Security Crisis Like Log4Shell?

on YouTube ↗47m

" summary

A live demo shows a malicious Gson package and a crafted npm release cause a reverse shell during Maven and npm installs, giving interactive access to a VPS and illustrating how dependency confusion becomes a foothold that can escalate (SQLi → Postgres superuser → container root → Kubernetes cluster). The talk cites 49 transitive deps for a Spring Boot Hello World, 13% of Maven downloads still vulnerable to Log4Shell, and 300,000 suspicious Hugging Face models, then recommends SBOM (CycloneDX), Trivy and OWASP Def-Scanner, Maven Enforcer and npm ignore-scripts.

AI-written summary · about

" chapters (18)

1. 0:00Introduction to the next cybersecurity crisis
2. 1:08The danger of blindly copying commands from the internet
3. 3:36Live demo of a supply chain attack with Maven
4. 7:35What is a supply chain attack and why it matters
5. 10:20Types of supply chain attacks explained
6. 13:11Dependency confusion and its real-world impact
7. 17:20AI era risks and prompt injection threats
8. 20:52Model vulnerabilities in AI systems
9. 21:57From SQL injection to full system takeover
10. 23:20Critical recommendations to secure dependencies today
11. 27:34Essential security practices for teams
12. 30:24Dependency scanning and SBOM generation
13. 34:20Hardened images and base image security
14. 37:29Advanced tools for real-time package security
15. 39:54How SBOMs can prevent Log4Shell-like crises
16. 43:48People, processes, and governance in security
17. 44:52Shift-left security and post-production defenses
18. 45:56The importance of keeping dependencies updated

" related talks

• 47mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?Soroosh Khodami · Devoxx France 2026
• 46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?Soroosh Khodami · Voxxed Days Ticino 2026
• 46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?Soroosh Khodami · Voxxed Days Thessaloniki 2025
• 46mAre We Ready For The Next Cyber Security Crisis Like Log4Shell?Soroosh Khodami · Voxxed Days Zurich 2026
• 27mStrangerDanger: Finding Security Vulnerabilities Before They Find YouLiran Tal · ReactiveConf 2019
• 29mThink Like an Attacker: Why Your npm install Is a Hacker's DreamSudhanshu Dasgupta · DevConf.IN 2026
• 24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · JSConf Budapest 2019
• 50mStranger Danger: Your Java Attack Surface Just Got BiggerBrian Vermeer · Voxxed Days Cluj 2023