Tag: github
-
The GitHub Actions Attack Pattern Your CI Security Scanners Miss
ActiveState explains how GitHub Actions attack chains can evade traditional CI security scanners, why passing a scan doesn’t guarantee a secure pipeline, and how organizations can better govern their CI/CD workflows. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/the-github-actions-attack-pattern-your-ci-security-scanners-miss/
-
GitLost: GitHub’s AI Agent Tricked Into Leaking Private Repository Data
Noma Labs details GitLost, a prompt injection flaw that made GitHub’s AI agent expose private repo data through a crafted public issue and guardrail failures. First seen on hackread.com Jump to article: hackread.com/gitlost-github-ai-agent-leaking-repository-data/
-
PHP TLS Flaw Lets Remote Server Trigger DoS and Crash Entire FPM Process
A newly disclosed high-severity vulnerability in PHP, tracked as CVE-2026-12184, poses a significant risk to web applications by allowing a remotely triggerable denial-of-service (DoS) condition. This vulnerability can cause entire PHP-FPM process pools to crash. Details of the issue are outlined in the GitHub advisory GHSA-mhmq-mmqj-2v39. It affects multiple supported PHP branches, including versions before…
-
Neue Schadsoftware ChocoPoC nutzt GitHub aus
Die neue Malware ChocoPoC nimmt Sicherheitsforscher ins Visier. Angreifer verstecken den Schadcode in den Abhängigkeiten von GitHub-Exploits. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/github-schadsoftware-chocopoco
-
Hackers Compromise GitHub Maintainer Accounts to Publish PolinRider-Infected Package Versions
A widescale escalation in the PolinRider supply”‘chain campaign: threat actors have compromised GitHub maintainer accounts to publish infected package versions across multiple ecosystems. The investigation identified 162 malicious release artifacts across 108 unique packages and extensions in npm, Packagist, Go modules, and a Chrome extension, linking this activity to the broader North Korean Contagious Interview…
-
New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living. The malware, called ChocoPoC, travels in Python proof-of-concept (PoC) repositories on GitHub that claim to exploit hot new CVEs.Run one, and it quietly lifts your saved passwords, browser cookies, and files, then hands the attacker…
-
ChocoPoC Campaign Abuses GitHub PoC Repositories to Steal Browser Credentials
A coordinated supply-chain campaign has been weaponizing GitHub proof-of-concept (PoC) repositories to compromise vulnerability researchers and penetration testers, delivering a stealthy Python Remote Access Trojan (RAT) dubbed “ChocoPoC.” The lure is simple and effective: newly disclosed high-severity CVEs create urgency for fast PoC and scanner module development. Adversaries create seemingly legitimate PoC repositories that include…
-
Cordyceps gefährdet CI/CD-Pipelines auf GitHub – Cordyceps trifft Repositories von Microsoft, Google und anderen
First seen on security-insider.de Jump to article: www.security-insider.de/cordyceps-github-cicd-pipeline-microsoft-google-schwachstelle-a-5937c5d6b9fbe3379be3997686acb4a6/
-
GitHub’s new tool helps prevent costly open-source license violations
GitHub’s Open Source Program Office (OSPO) uses the new GitHub License Compliance feature, now in public preview, to manage thousands of open-source dependencies and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/02/github-license-compliance-feature/
-
New ChocoPoC malware targets researchers via trojanized PoC exploits
Multiple weaponized proof-of-concept (PoC) exploits on GitHub were found delivering a Python-based remote access trojan (RAT) named ChocoPoC that can execute commands and steal sensitive data in a campaign believed to target cybersecurity researchers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/
-
ChocoPoc malware delivered via trojanized exploits on GitHub
Multiple weaponized proof-of-concept (PoC) exploits on GitHub delivered a Python-based remote access trojan (RAT) called ChocoPoC that can execute commands and steal sensitive data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chocopoc-malware-delivered-via-trojanized-exploits-on-github/
-
Exploitarium: Anonymer Forscher leakt massenweise Zero-Day-Exploits
Ein öffentliches Github-Repository enthält 26 Exploits für Zero-Day-Lücken in mehreren populären Softwaretools. Und es werden immer mehr. First seen on golem.de Jump to article: www.golem.de/news/exploitarium-anonymer-forscher-leakt-massenweise-zero-day-exploits-2607-210388.html
-
Fluentd Security Flaws Enable Remote Code Execution, SSRF, DoS, and Credential Exposure
Tags: credentials, cyber, data, dos, flaw, github, open-source, remote-code-execution, service, vulnerabilityFluentd, a widely used open-source data collector for unified logging, has reported several high-impact vulnerabilities that could enable attackers to achieve remote code execution (RCE), server-side request forgery (SSRF), denial-of-service (DoS), and the exposure of sensitive credentials. These issues, documented in multiple GitHub Security Advisories, affect Fluentd versions up to 1.19.2 and have been resolved…
-
Sicherheitslücken ohne Ende: Menge an KIReports überfordert Github
Github kommt bei der Bearbeitung von Sicherheitsmeldungen nicht mehr hinterher. Es gibt wohl einen Rückstau von mehreren Wochen. First seen on golem.de Jump to article: www.golem.de/news/sicherheitsluecken-ohne-ende-flut-an-ki-bug-reports-ueberfordert-github-2606-210347.html
-
Sicherheitslücken ohne Ende: Flut an KIReports überfordert Github
Github kommt bei der Bearbeitung von Sicherheitsmeldungen nicht mehr hinterher. Es gibt wohl einen Rückstau von mehreren Wochen. First seen on golem.de Jump to article: www.golem.de/news/sicherheitsluecken-ohne-ende-flut-an-ki-bug-reports-ueberfordert-github-2606-210347.html
-
Vulnerability reports are arriving faster than GitHub can review them
Across the open source world, people are reporting software flaws in record numbers, and the systems built to verify those reports are straining under the weight. The GitHub … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/30/github-advisory-database-review/
-
Gefälschtes Vertrauen wird zur neuen Währung der Cyberkriminalität
Die Kampagne rund um manipulierte Krypto-Tools macht deutlich, wie sehr sich Cyberangriffe inzwischen verändert haben. Malware muss sich heute nicht mehr nur verstecken, sie kann sich auch gezielt als vertrauenswürdiges Produkt inszenieren. In diesem Fall wurde eine gesamte Fake-Reputation-Ökonomie aufgebaut, um einen Crypto-Clipboard-Hijacker als beliebtes, geprüftes und sicheres Tool erscheinen zu lassen. Gefälschte Github-Sterne, künstlich…
-
Critical Hoppscotch Vulnerability Lets Attackers Overwrite JWT_SECRET and Forge Admin Tokens
A critical security vulnerability, identified as CVE-2026-50160, has been discovered in the self-hosted Hoppscotch backend. This vulnerability allows unauthenticated attackers to overwrite sensitive configuration values, including the JWT signing secret, which can ultimately lead to a complete administrative takeover of affected instances. The issue is documented in the GitHub advisory GHSA-j542-4rch-8hwf and impacts all versions…
-
Mozilla warns of indirect prompt injection risk in AI coding agents
A malicious GitHub repository can silently compromise a developer’s machine without containing a single line of malicious code, security researchers at Mozilla’s … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/29/mozilla-warns-of-indirect-prompt-injection-risk-in-ai-coding-agents/
-
Root-Zugriff möglich: Exploits für gefährliche Lücke im Linux-Kernel geleakt
Admins sollten zügig ihre Linux-Systeme absichern. Auf Github sind Exploits für eine Root-Lücke in Debian, Ubuntu und RHEL aufgetaucht. First seen on golem.de Jump to article: www.golem.de/news/root-zugriff-moeglich-exploits-fuer-gefaehrliche-luecke-im-linux-kernel-geleakt-2606-210283.html
-
Critical Google Gemini CLI Flaw Lets Attackers Execute Code on Headless CI Platforms
A critical vulnerability has been identified in Google’s Gemini CLI and the associated run-gemini-cli GitHub Action. This flaw exposes headless continuous integration (CI) platforms to potential host-level code execution when processing untrusted workspaces. It is tracked as CVE-2026-12537, with the advisory identifying it as GHSA-wpqr-6v78-jr5g. Rated at the maximum severity under CVSS v4, the issue…
-
Schadsoftware Miasma infiziert npm und GitHub Actions
Eine neue Infektionswelle der Miasma-Schadsoftware trifft npm-Pakete und GitHub Actions, um Entwicklerdaten und Cloud-Geheimnisse zu entwenden. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/miasma-npm-und-github-actions
-
Clean GitHub repo tricks AI coding agents into running malware
An agentic coding tool tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious payload that remains invisible to security scanners, AI agents, and human reviewers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/clean-github-repo-tricks-ai-coding-agents-into-running-malware/
-
FOSSBilling Flaw Lets Admin Attackers Abuse DI Container for SQL Access and RCE
A critical server-side template injection (SSTI) vulnerability in FOSSBilling, tracked as CVE-2026-28496, is exposing instances to potential full database compromise and remote code execution (RCE), with early signs of active exploitation appearing shortly after public disclosure. This flaw is documented under GitHub advisory GHSA-57mv-jm88-66jc and affects all versions up to 0.7.2. It has been patched…
-
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
Cybersecurity researchers have flagged yet another evolution of the supply chain attack linked to the Mini Shai-Hulud, Miasma, and Hades malware family that has compromised a new set of npm packages, even as it has propagated to the Go ecosystem.”The latest activity includes malicious npm releases affecting LeoPlatform and RStreams packages, GitHub Actions workflow abuse,…
-
Mini Shai-Hulud Worm Poisons LeoPlatform npm Packages to Steal Developer and CI/CD Secrets
A fresh supply-chain wave tied to the Mini Shai-Hulud, Miasma, and Hades malware families is actively poisoning npm packages in the LeoPlatform and RStreams ecosystems and expanding into source-repository compromises. The intrusion blends registry poisoning, install-time execution via binding.gyp, Bun-staged JavaScript loaders, GitHub Actions abuse, and persistence hooks for IDEs and AI coding assistants an…
-
Mini Shai-Hulud Worm Poisons LeoPlatform npm Packages to Steal Developer and CI/CD Secrets
A fresh supply-chain wave tied to the Mini Shai-Hulud, Miasma, and Hades malware families is actively poisoning npm packages in the LeoPlatform and RStreams ecosystems and expanding into source-repository compromises. The intrusion blends registry poisoning, install-time execution via binding.gyp, Bun-staged JavaScript loaders, GitHub Actions abuse, and persistence hooks for IDEs and AI coding assistants an…
-
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
Tags: apache, attack, control, cybersecurity, flaw, github, google, microsoft, open-source, supply-chainCybersecurity researchers have flagged a new class of CI/CD workflow weakness that allows attackers to hijack workflows and compromise open-source supply chains.The “critical exploitable pattern” has been codenamed Cordyceps by Novee Security. The issue can allow full attacker control of repositories at dozens of the largest organizations worldwide, including Microsoft, Google, Apache, and First seen…
-
Grafana Confirms TanStack npm Supply Chain Attack Led to GitHub Repository Cloning
Grafana Labs has confirmed that a recent supply chain attack involving the TanStack npm ecosystem resulted in the cloning of its internal GitHub repositories. However, it did not compromise customer production systems or the Grafana Cloud platform. This disclosure follows a thorough internal investigation completed on May 27, 2026, as well as an independent forensic…
-
Hacker kapern GitHub mit 10.000 Fake-Projekten
Über 10.000 gefälschte Repositories auf GitHub verteilen Krypto-Trojaner. Experten vermuten, dass die Kampagne gezielt autonome KI-Agenten ins Visier nimmt. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/hacker-kapern-github