Latest GitHub news

GitHub passkeys generally available for passwordless sign-ins

GitHub has made passkeys generally available across the platform today to secure accounts against phishing and allow passwordless logins for all users.
- Sergiu Gatlan
- September 21, 2023
- 02:59 PM
- 1
Fake WinRAR proof-of-concept exploit drops VenomRAT malware

A hacker is spreading a fake proof-of-concept (PoC) exploit for a recently fixed WinRAR vulnerability on GitHub, attempting to infect downloaders with the VenomRAT malware.
- Bill Toulas
- September 20, 2023
- 10:49 AM
- 0
New CVE-2023-3519 scanner detects hacked Citrix ADC, Gateway devices

Mandiant has released a scanner to check if a Citrix NetScaler Application Delivery Controller (ADC) or NetScaler Gateway Appliance was compromised in widespread attacks exploiting the CVE-2023-3519 vulnerability.
- Bill Toulas
- August 15, 2023
- 11:32 AM
- 0
GitHub warns of Lazarus hackers targeting devs with malicious projects

GitHub is warning of a social engineering campaign targeting the accounts of developers in the blockchain, cryptocurrency, online gambling, and cybersecurity sectors to infect their devices with malware.
- Lawrence Abrams
- July 20, 2023
- 06:48 PM
- 0
Fake Linux vulnerability exploit drops data-stealing malware

Cybersecurity researchers and threat actors are targeted by a fake proof of concept (PoC) CVE-2023-35829 exploit that installs a Linux password-stealing malware.
- Bill Toulas
- July 13, 2023
- 02:28 PM
- 3
GitHub goes passwordless, announces passkeys beta preview

GitHub announced today the introduction of passwordless authentication support in public beta, allowing users who opt-in to upgrade from security keys to passkeys.
- Sergiu Gatlan
- July 12, 2023
- 11:00 AM
- 1
Millions of GitHub repos likely vulnerable to RepoJacking, researchers say

Millions of GitHub repositories may be vulnerable to dependency repository hijacking, also known as "RepoJacking," which could help attackers deploy supply chain attacks impacting a large number of users.
- Bill Toulas
- June 22, 2023
- 11:45 AM
- 0
Fake zero-day PoC exploits on GitHub push Windows, Linux malware

Hackers are impersonating cybersecurity researchers on Twitter and GitHub to publish fake proof-of-concept exploits for zero-day vulnerabilities that infect Windows and Linux with malware.
- Bill Toulas
- June 14, 2023
- 06:00 AM
- 1
GitHub reveals reason behind last week’s string of outages

GitHub's Chief Security Officer and SVP of Engineering shared more details today on a string of outages that hit the code hosting platform last week.
- Sergiu Gatlan
- May 16, 2023
- 03:26 PM
- 0
Open-source Cobalt Strike port 'Geacon' used in macOS attacks

Geacon, a Go-based implementation of the beacon from the widely abused penetration testing suite Cobalt Strike, is being used more and more to target macOS devices.
- Bill Toulas
- May 16, 2023
- 08:10 AM
- 2
GitHub now auto-blocks token and API key leaks for all repos

GitHub is now automatically blocking the leak of sensitive information like API keys and access tokens for all public code repositories.
- Sergiu Gatlan
- May 09, 2023
- 05:42 PM
- 0
Researcher hijacks popular Packagist PHP packages to get a job

A researcher hijacked over a dozen Packagist packages—with some having been installed hundreds of millions of times over the course of their lifetime. The researcher reached out to BleepingComputer stating that by hijacking these packages he hopes to get a job. And, he seems pretty confident that this would work.
- Ax Sharma
- May 03, 2023
- 11:30 AM
- 1
GitHub now allows enabling private vulnerability reporting at scale

GitHub announced that private vulnerability reporting is now generally available and can be enabled at scale, on all repositories belonging to an organization.
- Sergiu Gatlan
- April 22, 2023
- 12:18 PM
- 0
Twitter takes down source code leaked online, hunts for downloaders

Twitter has taken down internal source code for its platform and tools that was leaked on GitHub for months. Now it's using a subpoena to search for those who leaked and downloaded its code.
- Bill Toulas
- March 27, 2023
- 10:55 AM
- 3
GitHub.com rotates its exposed private SSH key

GitHub has rotated its private SSH key for GitHub.com after the secret was was accidentally published in a public GitHub repository. The software development and version control service says, the private RSA key was only "briefly" exposed, but that it took action out of "an abundance of caution."
- Ax Sharma
- March 24, 2023
- 04:33 AM
- 0
GitHub makes 2FA mandatory next week for active developers

GitHub will start requiring active developers to enable two-factor authentication (2FA) on their accounts beginning next week, on March 13.
- Sergiu Gatlan
- March 09, 2023
- 12:00 PM
- 0
GitHub’s secret scanning alerts now available for all public repos

GitHub has announced that its secret scanning alerts service is now generally available to all public repositories and can be enabled to detect leaked secrets across an entire publishing history.
- Bill Toulas
- March 01, 2023
- 12:33 PM
- 0
GitHub Copilot update stops AI model from revealing secrets

GitHub has updated the AI model of Copilot, a programming assistant that generates real-time source code and function recommendations in Visual Studio, and says it's now safer and more powerful.
- Bill Toulas
- February 15, 2023
- 04:03 PM
- 0
GitHub revokes code signing certificates stolen in repo hack

GitHub says that unknown attackers have stolen encrypted code-signing certificates for its Desktop and Atom applications after gaining access to some of its development and release planning repositories.
- Sergiu Gatlan
- January 30, 2023
- 01:27 PM
- 0
Hackers can use GitHub Codespaces to host and deliver malware

GitHub Codespaces, a cloud-hosted integrated development environment (IDE), has a port forwarding feature that malicious actors can abuse to host and distribute malware to unaware developers.
- Bill Toulas
- January 17, 2023
- 02:53 PM
- 0