Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. “Using… Continue reading
Tag: GitHub
AI coding agents asked to share screenshots of code changes for review have put internal company images in public GitHub repositories, security company Glow said. Its researchers found… Continue reading
Hacker news
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Ravie LakshmananSep 25, 2026Malware / Supply Chain Attack Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after… Continue reading
An attacker copied about 170 of CrowdSec’s private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The… Continue reading
Ravie LakshmananSep 18, 2026Malware / Cyber Espionage The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of… Continue reading
After successfully taking down the Yuzu and Ryujinx Switch emulators back in 2024, Nintendo has had to deal with an increasing number of clones popping up. This week,… Continue reading
Swati KhandelwalAug 17, 2026Vulnerability / Artificial Intelligence Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake’s public snowflakedb/snowflake-connector-net repository that it said could be… Continue reading
Swati KhandelwalAug 07, 2026Artificial Intelligence / Vulnerability A GitHub issue opened by an account with no repository privileges was enough to execute code on the CI runners behind… Continue reading
Hacker news
Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
Swati KhandelwalAug 04, 2026AI Security / DevSecOps Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub… Continue reading
Ravie LakshmananJul 27, 2026Software Supply Chain / DevSecOps GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a… Continue reading
