Tag: github
-
Realtek Bluetooth Driver Flaw Allows Attackers to Delete Any File on Windows Systems
A high-severity security vulnerability has been identified in the Realtek Bluetooth Host Controller Interface (HCI) Adaptor, raising significant concerns for device manufacturers and end-users. The flaw, tracked as CVE-2024-11857, was disclosed on June 2, 2025, and published in both the National Vulnerability Database (NVD) and the GitHub Advisory Database within hours of its discovery. This…
-
New Study Reveals Vulnerable Code Pattern Putting GitHub Projects at Risk of Path Traversal Attacks
A comprehensive research study has identified a widespread path traversal vulnerability (CWE-22) affecting 1,756 open-source GitHub projects, some of which are highly influential in the software ecosystem. The vulnerability, present in a commonly used Node.js code pattern for creating static HTTP file servers, enables attackers to access files outside of restricted locations, potentially compromising confidentiality…
-
New Relic Enhances Software Reliability with GitHub Copilot Integration
New Relic’s integration with GitHub Copilot to boost productivity and enhance software reliability. Discover more now! First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/new-relic-enhances-software-reliability-with-github-copilot-integration/
-
LexisNexis Risk Solutions says 364,000 impacted by breach involving GitHub data
The company said data held in GitHub pertaining to LexisNexis Risk Solutions had been acquired by an unknown third party. First seen on therecord.media Jump to article: therecord.media/lexis-nexis-breach-hundreds-thousands
-
MCP Server: Github-Tool ermöglicht Datenklau aus privaten Code-Repos
Forscher haben einen Angriff demonstriert, mit dem sich über den offiziellen Github MCP Server Code und Daten aus privaten Repos ausleiten lassen. First seen on golem.de Jump to article: www.golem.de/news/mcp-server-github-tool-ermoeglicht-datenklau-aus-privaten-code-repos-2505-196651.html
-
GitHub becomes go-to platform for malware delivery across Europe
Phishing has become the go-to method for attackers looking to get past security controls and access sensitive environments in Europe, according to Netskope. Users are now … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/28/attackers-phishing-method-europe/
-
SilverRAT Source Code Leaked Online: Here’s What You Need to Know
SilverRAT Source Code leaked on GitHub, exposing powerful malware tools for remote access, password theft, and crypto attacks before removal. First seen on hackread.com Jump to article: hackread.com/silverrat-source-code-leaked-online-you-need-to-know/
-
ChatGPT Deep Research Now Integrates with Dropbox and OneDrive to Retrieve Data
ChatGPT has rolled out a beta feature called Deep Research Connectors, designed to integrate seamlessly with third-party applications such as Dropbox, Microsoft OneDrive, GitHub, Microsoft SharePoint, and Box. Announced this week, this feature enables users to access and analyze live data from these platforms directly within ChatGPT’s interface, eliminating the need to toggle between multiple…
-
SafeLine WAF: Open Source Web Application Firewall with Zero-Day Detection and Bot Protection
Tags: application-security, attack, detection, exploit, firewall, github, open-source, waf, zero-dayFrom zero-day exploits to large-scale bot attacks, the demand for a powerful, self-hosted, and user-friendly web application security solution has never been greater.SafeLine is currently the most starred open-source Web Application Firewall (WAF) on GitHub, with over 16.4K stars and a rapidly growing global user base.This walkthrough covers what SafeLine is, how it works, and…
-
GitHub’s AI Assistant Opened Devs to Code Theft
Even after a fix was issued, lingering prompt injection risks in GitLab’s AI assistant might allow attackers to indirectly deliver developers malware, dirty links, and more. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/github-ai-assistant-opened-devs-to-code-theft
-
GitHub package limit put law firm in security bind
The most dangerous time for enterprise security? One month after an acquisitionNearly 10% of employee genAI prompts include sensitive dataThe SolarWinds $4.4 billion acquisition gives CISOs what they least want: Uncertainty> First seen on csoonline.com Jump to article: www.csoonline.com/article/3991286/github-package-limit-put-law-firm-in-security-bind.html
-
GitHub Copilot’s New AI Coding Agent Saves Developers Time And Requires Their Oversight
GitHub has launched a powerful AI coding agent in Copilot that writes code, fixes bugs, and opens pull requests. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-github-copilot-ai-coding-agent/
-
The Windows Subsystem for Linux goes open source
Microsoft has officially open-sourced the Windows Subsystem for Linux (WSL), closing the very first issue ever filed on the Microsoft/WSL GitHub repository: “Will this be open … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/20/microsoft-wsl-open-sourced/
-
New GitHub Copilot agent edges into DevOps
Tags: githubThe GitHub Copilot coding agent can take on toilsome tasks such as bug fixes and code reviews with its own GitHub Actions pull requests. First seen on techtarget.com Jump to article: www.techtarget.com/searchsoftwarequality/news/366623845/New-GitHub-Copilot-agent-edges-into-DevOps
-
Microsoft open-sources Windows Subsystem for Linux at Build 2025
Microsoft has open-sourced the Windows Subsystem for Linux (WSL), making its source code available on GitHub, except for a few components that are part of Windows. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-open-sources-windows-subsystem-for-linux-at-build-2025/
-
Curl-Entwickler warnt: Unicode-Trick gefährdet Softwareprojekte auf Github
Tags: githubDie wenigsten Entwickler dürften die Unterschiede zwischen bestimmten Unicode-Zeichen zuverlässig erkennen. Gerade auf Github ist das ein Problem. First seen on golem.de Jump to article: www.golem.de/news/curl-entwickler-warnt-unicode-trick-gefaehrdet-softwareprojekte-auf-github-2505-196314.html
-
Xanthorox Emerging BlackHat AI Tool Empowering Hackers in Phishing and Malware Campaigns
Tags: ai, conference, crypto, cyber, cybercrime, cybersecurity, dark-web, github, hacker, intelligence, malware, phishing, toolArtificial intelligence platform named Xanthorox has emerged as a potent new tool for cybercriminals, enabling the automated generation of phishing campaigns, malware, and hyperrealistic deepfakes. Unlike traditional dark-web tools restricted to hidden forums, Xanthorox’s developer openly advertises its capabilities on public platforms like GitHub, YouTube, and Telegram while accepting cryptocurrency payments for access. Cybersecurity experts…
-
BSidesLV24 GroundFloor Detection Engineering Demystified: Building Custom Detections For GitHub Enterprise
Author/Presenter: David French Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel. Permalink First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/bsideslv24-groundfloor-detection-engineering-demystified-building-custom-detections-for-github-enterprise/
-
Linux wiper malware hidden in malicious Go modules on GitHub
A supply-chain attack targets Linux servers with disk-wiping malware hidden in Golang modules published on GitHub. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/linux-wiper-malware-hidden-in-malicious-go-modules-on-github/
-
xAI Developer Accidentally Leaks API Key Granting Access to SpaceX, Tesla, and X LLMs
An employee at Elon Musk’s artificial intelligence venture, xAI, inadvertently disclosed a sensitive API key on GitHub, potentially exposing proprietary large language models (LLMs) linked to SpaceX, Tesla, and Twitter/X. Cybersecurity specialists estimate the leak remained active for two months, offering outsiders the capability to access and query highly confidential AI systems engineered with internal…
-
Hackers Weaponize Go Modules to Deliver Disk”‘Wiping Malware, Causing Massive Data Loss
Tags: attack, cyber, cybersecurity, data, exploit, github, hacker, malicious, malware, programming, sans, supply-chainCybersecurity researchers uncovered a sophisticated supply chain attack targeting the Go programming language ecosystem in April 2025. Hackers have weaponized three malicious Go modules-github[.]com/truthfulpharm/prototransform, github[.]com/blankloggia/go-mcp, and github[.]com/steelpoor/tlsproxy-to deploy devastating disk-wiping malware. Leveraging the decentralized nature of Go’s module system, where developers directly import dependencies from public repositories like GitHub sans centralized gatekeeping, attackers exploit namespace…
-
Hackers Exploit Critical NodeJS Vulnerabilities to Hijack Jenkins Agents for RCE
Tags: cyber, exploit, flaw, github, hacker, infrastructure, rce, remote-code-execution, risk, supply-chain, vulnerabilitySecurity researchers have identified critical vulnerabilities in the Node.js CI/CD infrastructure, exposing internal Jenkins agents to remote code execution and raising the risk of supply chain attacks. These flaws stemmed from the integration and communication gaps between multiple DevOps platforms-specifically GitHub Apps, GitHub Actions workflows, and Jenkins pipelines-that collectively manage Node.js’ continuous integration processes. Exploiting…
-
GitHub secrets: Deleted files still pose risks
git diff) the list of files with its parent commit,” Briznov said. Once deleted files were restored, a simple search for secrets that were still active was performed through another automation. AI made the exploit much easier: Interestingly, Brizinov relied on AI to do a lot of routine tasks in the exploit. For instance, a…
-
Forscher macht aus gelöschten Dateien 64.000 US-Dollar
Tags: githubEin Sicherheitsforscher hat in Github-Repos mehrerer Fortune-500-Unternehmen Token und Zugangsdaten entdeckt, die eigentlich längst gelöscht waren. First seen on golem.de Jump to article: www.golem.de/news/github-forscher-macht-aus-geloeschten-dateien-64-000-us-dollar-2504-195616.html
-
CrazyHunter Hacker Group Exploits Open-Source GitHub Tools to Target Organizations
A relatively new ransomware outfit known as CrazyHunter has emerged as a significant threat, particularly targeting Taiwanese organizations. The group, which started its operations in the healthcare, education, and industrial sectors of Taiwan, leverages sophisticated cyber techniques to disrupt essential services. Sophisticated Techniques and Open-Source Exploitation CrazyHunter’s toolkit is largely composed of open-source tools sourced…
-
Latest Mustang Panda Arsenal: ToneShell and StarProxy – P1
IntroductionThe Zscaler ThreatLabz team discovered new activity associated with Mustang Panda, originating from two machines from a targeted organization in Myanmar. This research led to the discovery of new ToneShell variants and several previously undocumented tools. Mustang Panda, a China-sponsored espionage group, traditionally targets government-related entities, military entities, minority groups, and non-governmental organizations (NGOs) primarily…
-
MITRE CVE Program Funding Set To Expire
Tags: cve, cvss, cybersecurity, data, github, identity, intelligence, mitre, monitoring, nist, technology, update, vulnerability, vulnerability-managementMITRE’s CVE program has been an important pillar in cybersecurity for over two decades. The lack of certainty surrounding the future of the CVE program creates great uncertainty about how newly discovered vulnerabilities will be cataloged. Background On April 15, reports circulated that the contract for funding the Common Vulnerabilities and Exposures (CVE) program along…