Exploiting a critical supply chain attack on PyTorch - discovery, exploitation, and submission process

Four months ago, I exploited a critical CI/CD vulnerability in PyTorch, one of the world’s leading ML platforms. Used by titans like Google, Meta, Boeing, and Lockheed Martin, PyTorch is a major target for hackers and nation-states alike.
The details around discovery and exploitation are pretty long, but I released a full walkthrough here: https://johnstawinski.com/2024/01/11/playing-with-fire-how-we-executed-a-critical-supply-chain-attack-on-pytorch/.

Hopefully attacks like these can convince the greater security community to take CI/CD and supply chain security seriously - in my experience, this is a …

attack attacks boeing critical cybersecurity discovery exploitation exploited exploiting google hackers lockheed lockheed martin major meta nation nation-states platforms process pytorch states submission supply supply chain supply chain attack target vulnerability world