Tag: github
-
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS).The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives First seen…
-
PoC Exploit Code Released for Fortinet FortiClient EMS Authentication Bypass Flaw
A public proof-of-concept (PoC) exploit is now available for CVE-2026-35616, a critical authentication bypass in Fortinet FortiClient Endpoint Management Server (EMS). The flaw has been exploited in the wild since spring 2026. FortiClient EMS authentication bypass According to details published by GitHub user Alaatk, a repository titled >>CVE-2026-35616 FortiClient EMS Pre-Auth Bypass<< contains a Python…
-
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations.The spike, according to GitGuardian, was observed on October 8 and 9, 2026.”This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories’ CI,” security researchers Gaetan First…
-
10 Best Secrets Detection Tools Compared (2026): Features Pricing
GitGuardian anchors the dedicated platform lane, TruffleHog owns verification-first scanning (one vendor, despite two sheet rows), and GitHub’s native scanning plus Gitleaks set a free floor every team should exploit. With investigations revealing how a massive GitHub leak exposed over 39 million API keys and credentials, leaving authentication tokens in codebases is an invitation to…
-
UAT-6275 Hackers Use WinRAR Exploit and GitHub PowerShell to Target CIS Governments
An espionage campaign targeting government organizations across the Commonwealth of Independent States (CIS), with additional interest in water, environmental, and energy sectors. The investigation found four infection chains active from June 2025 through 2026. The attackers used macro-enabled Word documents, PS2EXE-built executables, malicious shortcuts that launched GitHub-hosted PowerShell, and a crafted WinRAR archive that exploited…
-
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online – Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10.A web shell is a small file that executes any command an attacker sends via a web request, with…
-
Meta GitHub Repositories Compromised, Exposing Software Code and Employee Personal Data
Meta has revealed a breach of a GitHub repository that exposed software code and personal information belonging to about 1,500 individuals, most of whom are U.S. employees. The company began notifying affected individuals on October 13, after discovering the intrusion several weeks earlier, which involved the theft of an employee’s credentials. According to Meta’s statement…
-
GitHub adopts cheaper AI model to catch secrets developers leave in code
GitHub has trained a credential classifier to improve generic secret detection and reduce false alerts. The new pipeline cut median post-push scan execution time by 86% and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/github-secret-detection-model/
-
GitHub adopts cheaper AI model to catch secrets developers leave in code
GitHub has trained a credential classifier to improve generic secret detection and reduce false alerts. The new pipeline cut median post-push scan execution time by 86% and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/github-secret-detection-model/
-
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user’s package without having to steal their credentials.”Your configuration becomes validated and exempt from expiry after its first successful publish,” the Microsoft-owned…
-
SAP Patches Critical NetWeaver and S/4HANA Security Flaws Affecting Enterprise Systems
SAP’s Security Patch Day on October 13, 2026, addresses critical vulnerabilities found in enterprise applications, integration platforms, and developer libraries. The October bulletin details the release, which includes 16 new security notes, four GitHub security advisories, and two updates to previously published notes, covering a total of 22 CVEs. Four vulnerabilities are rated as Critical.…
-
Attackers Can Hijack npm Packages Without Stealing Developer Credentials
A flaw in npm’s Trusted Publishing mechanism could let attackers publish malicious updates to legitimate packages without compromising a developer’s npm account, GitHub account, or publishing token. Researchers identified more than 1,500 potentially exposed packages with over 10 million combined downloads. The weakness is particularly concerning as AI coding agents increasingly select, install, and execute…
-
FakeGit malware campaign returns with 17,610 malicious GitHub repos
More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fakegit-malware-campaign-returns-with-17-610-malicious-github-repos/
-
Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
Thousands of hijacked servers have been looking up their command and control (C2) server in a poem posted on GitHub, according to Black Lotus Labs. The malware reading it, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/poellm-malware-github-poem-ai-servers/
-
GitHub adds AI to catch passwords before a code push
GitHub has announced an AI detector, developed with Microsoft Applied Sciences, to help prevent developers from uploading passwords and other credentials to code repositories. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/github-push-protection-modernbert/
-
GitHub adds AI to catch passwords before a code push
GitHub has announced an AI detector, developed with Microsoft Applied Sciences, to help prevent developers from uploading passwords and other credentials to code repositories. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/github-push-protection-modernbert/
-
12 Best SAST Tools Compared (2026): Features Pricing
GitHub CodeQL is the bundled baseline for GitHub estates, Snyk Code and SonarQube lead the developer-first lane, and Checkmarx/Veracode/Fortify anchor enterprise assessment. Twelve options priced across bundled, developer, enterprise, AI-era, and embedded lanes with fix-rate, not finding-count, as the metric this comparison optimizes for. Combining source code analysis alongside best DAST platforms ensures both static…
-
Hackers Abuse GitHub Actions to Steal SSH Keys, Cloud Credentials and Access Tokens
Hackers are abusing GitHub Actions to steal SSH keys, cloud credentials, and access tokens through malicious workflows disguised as security checks. The workflows targeted 2,577 secrets, but targeting did not always translate into theft. Researchers confirmed successful exfiltration of 26 secrets from 13 repositories, highlighting the distinction between malicious injections and executed payloads. Attackers inserted…
-
Hackers Abuse GitHub Actions to Steal SSH Keys, Cloud Credentials and Access Tokens
Hackers are abusing GitHub Actions to steal SSH keys, cloud credentials, and access tokens through malicious workflows disguised as security checks. The workflows targeted 2,577 secrets, but targeting did not always translate into theft. Researchers confirmed successful exfiltration of 26 secrets from 13 repositories, highlighting the distinction between malicious injections and executed payloads. Attackers inserted…
-
GitHub Copilot CLI Flaw Lets Attackers Steal Developer Secrets Using Encrypted Prompt Injection
Security researchers have revealed an attack against GitHub Copilot CLI that can expose developer secrets through an attacker-controlled webpage. This technique is called Cryptographic Context Injection (CCI). It involves hiding malicious instructions in encrypted content, which then convinces the coding agent to decrypt and run them in its runtime environment. According to Adversa AI’s disclosure,…
-
Hackers Pose as Dubai Airports Recruiters to Infect Software Engineers With ShelbyLoader V2
An Iranian state-aligned threat actor impersonated Dubai Airports recruiters to deliver weaponized coding assessments to software engineers. The operation deployed ShelbyLoader V2 through a stealthy execution chain that abused legitimate Microsoft development tools and GitHub infrastructure. Tracked as CL-STA-1178, the activity includes “Blinder Tunnel,” a campaign targeting Iraqi critical infrastructure beginning in March 2026. The…
-
GitHub’s ReviewBench puts AI code reviewers to the test
GitHub’s ReviewBench measures how well AI code review tools detect problems before software is released. Available in research preview through its website, the benchmark lets … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/06/github-reviewbench-ai-code-review-benchmark/
-
Hackers Are Turning Trusted Software Updates Into Credential-Stealing Malware
Tags: attack, credentials, cyber, flaw, github, hacker, malicious, malware, open-source, software, supply-chain, updateA growing wave of supply-chain attacks is proving the opposite: attackers are compromising legitimate open-source packages and using trusted update channels to deploy credential-stealing malware directly into developer and enterprise environments. Malicious Nx releases, published after attackers stole an npm publishing token through a GitHub Actions workflow flaw, ran post-install scripts that searched systems for…
-
GitHub-Leak: 543.699 Zugangsdaten sind noch immer gültig
GitHub-Leak mit 543.699 gültigen Zugangsdaten: Untersuchung zeigt, wie lange geleakte Credentials öffentlich bleiben und weiter funktionieren First seen on tarnkappe.info Jump to article: tarnkappe.info/artikel/it-sicherheit/github-leak-543699-zugangsdaten-334237.html
-
Researchers Find 543,699 Active Credentials Leaked in Public GitHub Repos
Security researchers have identified 543,699 unique credentials that remain valid despite being exposed in public GitHub repositories. This highlights a persistent failure to revoke secrets once they enter source code. These credentials were verified as active in July 2026, even though many had been publicly accessible for years. Researchers at Truffle Security examined The Stack…
-
Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests
OWASP ModSecurity has disclosed multiple vulnerabilities that could let attackers bypass web application firewall rules, evade request and response inspection, or trigger denial-of-service conditions. Not all of the newly published advisories currently have CVE identifiers; the project has indicated that CVE requests have been submitted via GitHub but remain unassigned for several issues. The recently…
-
Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests
OWASP ModSecurity has disclosed multiple vulnerabilities that could let attackers bypass web application firewall rules, evade request and response inspection, or trigger denial-of-service conditions. Not all of the newly published advisories currently have CVE identifiers; the project has indicated that CVE requests have been submitted via GitHub but remain unassigned for several issues. The recently…
-
Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests
OWASP ModSecurity has disclosed multiple vulnerabilities that could let attackers bypass web application firewall rules, evade request and response inspection, or trigger denial-of-service conditions. Not all of the newly published advisories currently have CVE identifiers; the project has indicated that CVE requests have been submitted via GitHub but remain unassigned for several issues. The recently…
-
AI Agents Expose 13,000+ Developer Screenshots Across 900+ GitHub Repositories
AI coding agents have inadvertently exposed over 13,000 internal developer screenshots in public GitHub repositories. These exposures potentially revealed sensitive information such as customer records, credentials, financial interfaces, and unreleased product features. The issue, referred to as >>PixelLeak<< by Glow Labs, affected developers across more than 300 organizations and spanned over 900 repositories. AI Agents…
-
AI Agents Expose 13,000+ Developer Screenshots Across 900+ GitHub Repositories
AI coding agents have inadvertently exposed over 13,000 internal developer screenshots in public GitHub repositories. These exposures potentially revealed sensitive information such as customer records, credentials, financial interfaces, and unreleased product features. The issue, referred to as >>PixelLeak<< by Glow Labs, affected developers across more than 300 organizations and spanned over 900 repositories. AI Agents…