macOS git still trusts compromised eMudhra certificates after 10 days
macOS 27.2, released October 26, left git, curl, and python3 trusting the certificates and undid manual workarounds.
76
- Mentions · 7d1
- Mentions · 30d5
- All mentions11
- First seenAug 26, 2026
- Last mentioned2d ago
Timeline
11 articles · newest firstGitHub puts nearly all repositories in Azure amid agent traffic
Per-reference quorums target the last 0.00001% of repos; tests saw 3–4x write throughput.
46
Two AI-assisted research repos leave incomplete Git provenance
Co-Authored-By marked 66 of 121 AI-related commits in one repo and 1 of 39 agent-note commits in the other.
36
I got targeted: Trying to get your credentials via a git post-checkout hook
A fake client shared a Dropbox git repo whose post-checkout hook fetched and executed a remote binary.
51
Git 3.0's upcoming SHA-256 default will be a costly mistake
A GitButler post argues Git 3.0's SHA-1 to SHA-256 default will be costly with little security gain.
44
Git-bug: Distributed, offline-first bug tracker embedded in Git
Git-bug is a distributed, offline-first bug tracker embedded in Git repositories.
5
TraceVIC: Causal Reasoning over Code Evolution for Identifying Vulnerability-Inducing Commits
TraceVIC ranks vulnerability-inducing commits by reasoning over how vulnerable code evolves across revisions.
46
Not In My Git Yard: Catching Backdoors at Commit and Release Time
An arXiv paper proposes catching software supply-chain backdoors during Git commits and release workflows before code ships.
40
What Comes After Git
East River Source Control argues Git's 2005 design strains under agentic development and is building a Git-protocol-compatible storage engine.
5
Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
Malicious .git core.fsmonitor configs let attacker code run in AI coding agents like Claude Code and Codex; four of eight flaws remain unpatched.
68
U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog
CISA added the actively exploited Gitea RCE flaw CVE-2026-60004 (CVSS 9.8) to its KEV catalog, with federal patching due by August 28, 2026.
74
Related CVEs
by mentions- CVE-2026-6000424%9.8Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
- CVE-2026-71963<1%8.6Command injection RCE in Hermes Agent via malicious .git/config
- CVE-2022-24346<1%7.8In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible
- CVE-2021-4389113%7.8Visual Studio Code Remote Code Execution Vulnerability
- CVE-2026-55607<1%7.7Claude Code: Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox…
- CVE-2026-19592<1%7.3Unsandboxed attacker code execution in OpenAI Codex via malicious Git core.fsmonitor
- CVE-2026-72718<1%7.0goose is general-purpose AI agent that runs on your machine
Appears with
- MITREorganization · 1
- Vercelvendor · 1
- Nous Researchorganization · 1
- Frank Wilesvictim · 1
- VulnCheckvendor · 1
- xAIorganization · 1
- Sonarvendor · 1
- GitButlerorganization · 1
- Alibabavendor · 1
- eMudhravendor · 1
- OpenAIvendor · 1
- Vercelorganization · 1
- Safariproduct · 1
- GitHubvendor · 1
- Hermes Agentproduct · 1
- REVSYSvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.