Tag: github
-
Court document in Asato case reveals xAI/Grok sexual prompts
Grok’s design and training allows it to generate harmful sexualised content, according to the policy file in its GitHub repository First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366646848/Court-document-in-Asato-case-reveals-xAI-Grok-sexual-prompts
-
BlackTech APT Uses New BlueShell Linux Backdoor in Attacks on Japanese Organizations
BlackTech, a long-running China-aligned APT group, has adopted a new Linux backdoor built on the BlueShell open-source RAT to conduct post-intrusion operations against Japanese organizations, signaling ongoing toolchain evolution and focused targeting of enterprise Linux environments. Originally published on GitHub with Chinese-language documentation, BlueShell has seen limited but consistent abuse by China-based threat actors, including…
-
Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root
OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws in network services enabled by default.The critical issue, tracked as CVE-2026-53921 and rated 9.8 on CVSS 3.1 in OpenWrt’s GitHub advisory, lets an unauthenticated attacker able to reach the DHCPv6 server overwrite a stack buffer…
-
Operation STANDOFF Uses GitHub Redirects Across 44 Servers to Hide Multi-Malware C2 Traffic
Operation STANDOFF is a Russian”‘speaking cybercriminal campaign that uses a cluster of at least 44 TimeWeb”‘hosted servers that all masquerade as benign GitHub redirectors to conceal multi”‘malware command”‘and”‘control (C2) and proxy traffic. This infrastructure underpins a full ecosystem: a pay”‘per”‘install loader, a proxy”‘botnet, a multi”‘operator intrusion console, and an AI”‘driven influence and outreach platform. All…
-
GitHub and PyPI implement new security measures against supply-chain attacks
First seen on scworld.com Jump to article: www.scworld.com/brief/github-and-pypi-implement-new-security-measures-against-supply-chain-attacks
-
GitHub Adds Dependabot Cooldown to Stop Poisoned Dependencies
GitHub has introduced a default cooldown period for Dependabot version updates to decrease the risk of organizations automatically adopting malicious or compromised open-source dependencies as soon as they are released. This change comes in response to a rise in supply chain attacks where attackers publish trojanized package versions to public registries, relying on automated update…
-
GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request.”The cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parameter that fits your project,” the Microsoft-owned subsidiary said.According…
-
GitHub delays version updates so malware gets caught first
An automated update tool watches a package registry, catches a new release the moment it publishes, and opens a pull request for your team. That is the job it was built to do. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/27/github-dependabot-cooldown/
-
GitHub, PyPI add time-based defenses against supply chain attacks
GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect against supply-chain attacks and to limit their impact. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/github-pypi-add-time-absed-defenses-against-supply-chain-attacks/
-
GitHub, PyPI add time-absed defenses against supply chain attacks
GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect against supply-chain attacks and to limit their impact. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/github-pypi-add-time-absed-defenses-against-supply-chain-attacks/
-
GitHub to implement two-tier bug bounty program amid AI-generated report surge
First seen on scworld.com Jump to article: www.scworld.com/brief/github-to-implement-two-tier-bug-bounty-program-amid-ai-generated-report-surge
-
Github reagiert auf KI-Flut: Hohe Bug-Bounty-Prämien bald nur noch für VIPs
Github überarbeitet sein Bug-Bounty-Programm. Wer sich nur auf KI verlässt und sich wenig Mühe gibt, bekommt künftig geringere Prämien. First seen on golem.de Jump to article: www.golem.de/news/github-reagiert-auf-ki-flut-hohe-bug-bounty-praemien-bald-nur-noch-fuer-profis-2607-211255.html
-
Github reagiert auf KI-Flut: Hohe Bug-Bounty-Prämien bald nur noch für Profis
Github überarbeitet sein Bug-Bounty-Programm. Wer sich nur auf KI verlässt und sich wenig Mühe gibt, bekommt künftig geringere Prämien. First seen on golem.de Jump to article: www.golem.de/news/github-reagiert-auf-ki-flut-hohe-bug-bounty-praemien-bald-nur-noch-fuer-profis-2607-211255.html
-
Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager (WHM) instances.The activity involves malicious Packagist development versions spanning 10 packages associated with a legitimate PHP and DevOps developer, dinushchathurya, between July 12 and 13, First seen on thehackernews.com…
-
Critical FreePBX Flaws Let Unauthenticated Attackers Execute Code and Take Over Administrator Accounts
Critical security vulnerabilities in FreePBX have been disclosed, exposing organizations to risks of unauthenticated remote code execution and the takeover of administrator accounts. These flaws, tracked under GitHub advisories GHSA-37j8-fhxx-9vhp and GHSA-g27h-xf3q-h3rm, affect FreePBX versions 16 and 17, carrying a CVSS v4 base score of 9.3, which highlights their severity. Security researchers warn that these…
-
Hackers Turn GitHub Actions Into a Global Botnet for Attacking Web Hosting Servers
Hackers are abusing compromised GitHub repositories and GitHub Actions workflows to build a de facto global botnet that scans and exploits web hosting servers, with a primary focus on cPanel and WHM deployments. The campaign first surfaced when malicious development versions were discovered across ten Packagist PHP packages tied to a legitimate PHP and DevOps…
-
GitHub revamps bug bounty program with new VIP tier, payout changes
GitHub is changing its bug bounty program to reward higher-quality vulnerability reports and reduce low-effort submissions, including AI-generated reports. The changes will … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/23/github-bug-bounty-program-changes/
-
GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier
Beginning July 27, 2026, GitHub will cut public bug bounty payouts by at least half at every severity level. Critical findings will drop from $20,000-$30,000+ to a fixed $10,000, while its permanent invite-only VIP tier will pay $30,000 or more.Reports filed before that date, including those already in GitHub’s growing triage queue, will retain the…
-
FakeGit verbreitet SmartLoader über Tausende GitHub-Projekte
In der Kampagne FakeGit verbreiten gefälschte GitHub-Repositorys und KI-Server die Schadsoftware SmartLoader. Auch KI-Agenten fallen auf den Trick herein. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/github-projekte-fakegit
-
Gefälschte KI-Tools machen ChatGPT, Claude und Gemini zu unfreiwilligen Helfern von Cyberkriminellen
Eine neue Angriffsmethode zeigt, dass künftig nicht mehr nur Menschen auf Phishing oder manipulierte Downloads hereinfallen sondern auch KI-Agenten. Sicherheitsforscher von Island haben eine groß angelegte Kampagne mit dem Namen <> aufgedeckt, bei der Angreifer tausende gefälschte GitHub-Repositories erstellen, um sowohl Entwickler als auch KI-Assistenten zur Installation von Malware zu verleiten. Die Forscher bezeichnen […]…
-
FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware
A large-scale operation dubbed ‘FakeGit’ is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fakegit-campaign-uses-7-600-github-repos-to-push-smartloader-malware/
-
AI agents tricked into recommending malicious GitHub repositories
Roughly 7,600 malicious GitHub repositories were uncovered, more than 800 of them posing as AI Skills or Model Context Protocol (MCP) servers, in a wave that peaked in April … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/21/github-repos-malware-campaign-fakegit-ai-agents/
-
AsyncAPI Supply Chain Attack Deploys Miasma Backdoor Through Trusted npm Workflows
AsyncAPI’s npm ecosystem suffered a coordinated supply chain compromise on July 14, 2026, delivering a Miasma”‘associated Node.js backdoor through trusted GitHub Actionsdriven release workflows and exposing high”‘value developer and CI/CD environments to remote access, credential theft, and further lateral movement. Malicious versions were shipped for @asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, and @asyncapi/specs@6.11.2 and 6.11.2-alpha.1, together accounting for…
-
AgentBaiting Uses Fake AI Skills and MCP Servers to Deliver SmartLoader and StealC Malware
AgentBaiting is the clearest sign yet that AI agents and their capability ecosystems have become a first”‘class malware delivery surface, with FakeGit’s 7,600″‘repo operation pushing SmartLoader and StealC directly into AI Skills and MCP workflows. By turning agent”‘readable READMEs, public AI registries, and GitHub trust signals into a weaponized “AI capability supply chain,” attackers now…
-
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit.”FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP First…
-
LegacyHive Windows Zero-Day Lets Attackers Hijack Administrator Registry Hives
A newly disclosed Windows local privilege-escalation vulnerability, dubbed LegacyHive, could allow a standard user to load and modify the per-user registry classes hive of an administrator account. The proof-of-concept (PoC), published by researcher NightmareEclipse under the MSNightmare/LegacyHive GitHub repository, abuses Windows’ User Profile Service to mount a target user’s UsrClass.dat hive into a registry location…
-
New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands
Ask an AI agent to summarize the reviews on a product page, and a single planted review can make it click “Buy Now” instead. Ask a coding assistant to apply a maintainer’s fix from a GitHub thread, and a fake comment can make it run a stranger’s command on your computer.Neither trick hijacks the agent’s…
-
Nearly 300 GitHub repos pose as legit software to push malware
A threat actor has published hundreds of fake GitHub repositories impersonating legitimate software and security projects to distribute infostealer malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/nearly-300-github-repos-pose-as-legit-software-to-push-malware/
-
Inaktive GitHub-Konten für Spionage genutzt
Tags: githubDatadog Security Labs warnt vor Kampagnen, die mittels inaktiver GitHub-Konten und kompromittierter Token gezielt Firmenstrukturen auskundschaften. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/inaktive-github-konten-spionage