Latest GitHub news

GitHub Actions being actively abused to mine cryptocurrency on GitHub servers

GitHub Actions has been abused by attackers to mine cryptocurrency using GitHub's servers, automatically.The particular attack adds malicious GitHub Actions code to repositories forked from legitimate ones, and further creates a Pull Request for the original repository maintainers to merge the code back, to alter the original code.
- Ax Sharma
- April 03, 2021
- 05:49 AM
- 2
GitHub Arctic Vault likely contains leaked MedData patient records

GitHub Arctic Code Vault has likely inadvertently captured sensitive patient medical records from multiple healthcare facilities. The private data was leaked on GitHub repositories last year that are now part of a collection of open-source contributions bound to last a 1,000 years.
- Ax Sharma
- April 02, 2021
- 04:26 AM
- 0
PHP's Git server hacked to add backdoors to PHP source code

In the latest software supply chain attack, the official PHP Git repository was hacked and tampered with. Yesterday, two malicious commits were pushed to the php-src Git repository maintained by the PHP team on their git.php.net server. The threat actors had signed off on these commits as if they were made by known PHP developers.
- Ax Sharma
- March 29, 2021
- 03:32 AM
- 1
Microsoft's Azure SDK site tricked into listing fake package

A security researcher was able to add a counterfeit test package to the official list of Microsoft Azure SDK latest releases. The simple trick if abused by an attacker can give off the impression that their malicious package is part of the Azure SDK suite.
- Ax Sharma
- March 17, 2021
- 04:01 AM
- 0
GitHub fixes bug causing users to log into other accounts

Last night, GitHub automatically logged out many users and invalidated their sessions to protect user accounts against a potentially serious security vulnerability. Earlier this month GitHub had received a report of anomalous behavior from an external party.
- Ax Sharma
- March 09, 2021
- 04:16 AM
- 0
Here's how a researcher broke into Microsoft VS Code's GitHub

This month a researcher was awarded a bug bounty award of an undisclosed amount after he broke into the official GitHub repository of Microsoft Visual Studio Code. A vulnerability in VS Code's issue management function and a lack of authentication checks enabled the researcher to obtain push access, and write to the repository.
- Ax Sharma
- January 27, 2021
- 05:05 AM
- 0
GitHub-hosted malware calculates Cobalt Strike payload from Imgur pic

A new strand of malware uses Word files with macros to download a PowerShell script from GitHub. This PowerShell script further downloads a legitimate image file from image hosting service Imgur to decode a Cobalt Strike script.
- Ax Sharma
- December 28, 2020
- 06:57 AM
- 0
Gitpaste-12 worm botnet returns with 30+ vulnerability exploits

Recently discovered Gitpaste-12 worm that spreads via GitHub and also hosts malicious payload on Pastebin, has returned with over 30 vulnerability exploits, according to researchers at Juniper Labs.
- Ax Sharma
- December 19, 2020
- 01:01 PM
- 0
GitHub reinstates YouTube-dl, promises to overhaul DMCA reviews

GitHub has announced today that YouTube-dl's repository was reinstated after reversing a Digital Millennium Copyright Act (DMCA) takedown from last month.
- Sergiu Gatlan
- November 16, 2020
- 11:53 AM
- 0
Reverse shell botnet Gitpaste-12 spreads via GitHub and Pastebin

A newly discovered worm and botnet named Gitpaste-12 lives on GitHub and also uses Pastebin to host malicious code. The advanced malware comes equipped with reverse shell and crypto mining capabilities.
- Ax Sharma
- November 06, 2020
- 04:22 AM
- 0
GitHub breaks site layout after forgetting to renew certificate

This morning, GitHub's pristine layout vanished in what looks like a miss on the company's part in renewing an SSL certificate. The expired certificate prevented numerous resources like images, JavaScript, and CSS stylesheets from loading correctly on GitHub.
- Ax Sharma
- November 02, 2020
- 04:31 PM
- 1
GitHub threatens to ban users who bypass YouTube-dl takedown

GitHub has issued a warning that accounts could be banned if they continue to upload content that was removed due to DMCA takedown notices.
- Lawrence Abrams
- November 02, 2020
- 11:27 AM
- 6
Angry YouTube-dl users flood GitHub with new repos after takedown

Users of the extremely popular YouTube-dl YouTube media downloader have flooded GitHub with new repositories containing the tool's source code after GitHub took down the project's repositories on Friday.
- Sergiu Gatlan
- October 26, 2020
- 07:21 PM
- 4
DeepSource resets logins after employee falls for Sawfish phishing

GitHub notified DeepSource earlier this month of detecting malicious activity related to the startup's GitHub app after one of their employees fell victim to the Sawfish phishing campaign.
- Sergiu Gatlan
- July 21, 2020
- 10:35 AM
- 0
New Octopus Scanner malware spreads via GitHub supply chain attack

Security researchers have found a new malware that finds and backdoors open-source NetBeans projects hosted on the GitHub web-based code hosting platform to spread to Windows, Linux, and macOS systems and deploy a Remote Administration Tool (RAT).
- Sergiu Gatlan
- May 28, 2020
- 11:00 AM
- 0
Microsoft's GitHub account hacked, private repositories stolen

A hacker has claimed to have hacked into Microsoft's GitHub account and downloaded over 500GB of 'Private' repositories, BleepingComputer has learned.
- Lawrence Abrams
- May 06, 2020
- 08:04 PM
- 3
GitHub accounts stolen in ongoing phishing attacks

GitHub users are currently being targeted by a phishing campaign specifically designed to collect and steal their credentials via landing pages mimicking GitHub's login page.
- Sergiu Gatlan
- April 17, 2020
- 11:46 AM
- 1
Attackers Create Elaborate Crypto Trading Scheme to Install Malware

Attackers have created an elaborate scheme to distribute a cryptocurrency trading program that installs a backdoor on a victim's Mac or Windows PC.
- Lawrence Abrams
- October 12, 2019
- 10:30 AM
- 0
Microsoft Acquires Semmle, GitHub Now a CVE Numbering Authority

Microsoft subsidiary GitHub announced today that it has become a CVE Numbering Authority and that it completed its acquisition of Semmle code-analysis platform.
- Ionut Ilascu
- September 18, 2019
- 07:33 PM
- 0
GitHub Experienced Widespread Major Services Outage

The GitHub Git repository hosting platform experienced a widespread and major services outage impacting the Issues, PRs, Dashboard, Projects, and Notifications features.
- Sergiu Gatlan
- August 22, 2019
- 08:36 AM
- 0