Latest GitHub news

Millions of GitHub repos likely vulnerable to RepoJacking, researchers say

Millions of GitHub repositories may be vulnerable to dependency repository hijacking, also known as "RepoJacking," which could help attackers deploy supply chain attacks impacting a large number of users.
- Bill Toulas
- June 22, 2023
- 11:45 AM
- 0
Fake zero-day PoC exploits on GitHub push Windows, Linux malware

Hackers are impersonating cybersecurity researchers on Twitter and GitHub to publish fake proof-of-concept exploits for zero-day vulnerabilities that infect Windows and Linux with malware.
- Bill Toulas
- June 14, 2023
- 06:00 AM
- 1
GitHub reveals reason behind last week’s string of outages

GitHub's Chief Security Officer and SVP of Engineering shared more details today on a string of outages that hit the code hosting platform last week.
- Sergiu Gatlan
- May 16, 2023
- 03:26 PM
- 0
Open-source Cobalt Strike port 'Geacon' used in macOS attacks

Geacon, a Go-based implementation of the beacon from the widely abused penetration testing suite Cobalt Strike, is being used more and more to target macOS devices.
- Bill Toulas
- May 16, 2023
- 08:10 AM
- 2
GitHub now can auto-block token and API key leaks for all repos

GitHub is now automatically blocking the leak of sensitive information like API keys and access tokens for all public code repositories.
- Sergiu Gatlan
- May 09, 2023
- 05:42 PM
- 0
Researcher hijacks popular Packagist PHP packages to get a job

A researcher hijacked over a dozen Packagist packages—with some having been installed hundreds of millions of times over the course of their lifetime. The researcher reached out to BleepingComputer stating that by hijacking these packages he hopes to get a job. And, he seems pretty confident that this would work.
- Ax Sharma
- May 03, 2023
- 11:30 AM
- 1
GitHub now allows enabling private vulnerability reporting at scale

GitHub announced that private vulnerability reporting is now generally available and can be enabled at scale, on all repositories belonging to an organization.
- Sergiu Gatlan
- April 22, 2023
- 12:18 PM
- 0
Twitter takes down source code leaked online, hunts for downloaders

Twitter has taken down internal source code for its platform and tools that was leaked on GitHub for months. Now it's using a subpoena to search for those who leaked and downloaded its code.
- Bill Toulas
- March 27, 2023
- 10:55 AM
- 3
GitHub.com rotates its exposed private SSH key

GitHub has rotated its private SSH key for GitHub.com after the secret was was accidentally published in a public GitHub repository. The software development and version control service says, the private RSA key was only "briefly" exposed, but that it took action out of "an abundance of caution."
- Ax Sharma
- March 24, 2023
- 04:33 AM
- 0
GitHub makes 2FA mandatory next week for active developers

GitHub will start requiring active developers to enable two-factor authentication (2FA) on their accounts beginning next week, on March 13.
- Sergiu Gatlan
- March 09, 2023
- 12:00 PM
- 0
GitHub’s secret scanning alerts now available for all public repos

GitHub has announced that its secret scanning alerts service is now generally available to all public repositories and can be enabled to detect leaked secrets across an entire publishing history.
- Bill Toulas
- March 01, 2023
- 12:33 PM
- 0
GitHub Copilot update stops AI model from revealing secrets

GitHub has updated the AI model of Copilot, a programming assistant that generates real-time source code and function recommendations in Visual Studio, and says it's now safer and more powerful.
- Bill Toulas
- February 15, 2023
- 04:03 PM
- 0
GitHub revokes code signing certificates stolen in repo hack

GitHub says that unknown attackers have stolen encrypted code-signing certificates for its Desktop and Atom applications after gaining access to some of its development and release planning repositories.
- Sergiu Gatlan
- January 30, 2023
- 01:27 PM
- 0
Hackers can use GitHub Codespaces to host and deliver malware

GitHub Codespaces, a cloud-hosted integrated development environment (IDE), has a port forwarding feature that malicious actors can abuse to host and distribute malware to unaware developers.
- Bill Toulas
- January 17, 2023
- 02:53 PM
- 0
GitHub makes it easier to scan your code for vulnerabilities

GitHub introduced a new option to set up code scanning for a repository known as "default setup," designed to help developers configure it automatically with just a few clicks.
- Sergiu Gatlan
- January 09, 2023
- 02:27 PM
- 0
Hackers use CAPTCHA bypass to make 20K GitHub accounts in a month

South African threat actors known as 'Automated Libra' has been improving its techniques to make a profit by using cloud platform resources for cryptocurrency mining.
- Bill Toulas
- January 05, 2023
- 09:00 AM
- 1
Slack's private GitHub code repositories stolen over holidays

Slack suffered a security incident over the holidays affecting some of its private GitHub code repositories.
- Ax Sharma
- January 05, 2023
- 03:50 AM
- 0
Okta's source code stolen after GitHub repositories hacked

In a 'confidential' email notification sent by Okta and seen by BleepingComputer, the company states that attackers gained access to its GitHub repositories this month and stole the company's source code.
- Ax Sharma
- December 21, 2022
- 01:15 AM
- 1
GitHub to require all users to enable 2FA by the end of 2023

GitHub will require all users who contribute code on the platform to enable two-factor authentication (2FA) as an additional protection measure on their accounts by the end of 2023.
- Bill Toulas
- December 15, 2022
- 03:16 PM
- 4
GitHub rolls out free secret scanning for all public repositories

GitHub is rolling out support for the free scanning of exposed secrets (such as credentials and auth tokens) to all public repositories on its code hosting platform.
- Sergiu Gatlan
- December 15, 2022
- 02:09 PM
- 0