Git patches six flaws, including code execution on recursive clones
Fixes ship in Git 2.56.1 and six older series; GitHub Enterprise Server should move to listed builds.
Stories per day · 30 days
18 RSS
Relatedsupply-chain38claude15anthropic12github-actions11secrets11hacker-news10npm9cli8credential-theft8dll-sideloading8infostealer8chatgpt7git7ovhcloud7yoba7credentials6devsecops6xmrig6
217 stories, newest first · one card per story
Stories tagged #github
Rubrik adds recovery features for Azure DevOps and GitHub
The announced DevOps cyber recovery capabilities are expected to reach general availability in the coming months.
Claude Code permission file leaks secrets on public GitHub
GitGuardian counted 31,088 distinct secrets across 23,276 repositories, including 5,343 still valid when found.
1
Claude Code “Don’t Ask Again” Persists Secrets in GitHub Repositories
Apiiro research exposed 2,539 secrets across 1,994 public GitHub repositories via Claude Code configuration files.
TeamPCP stole about 3,800 GitHub repos via poisoned developer tools
GitHub says customer-owned repositories were not accessed, but some stolen internal repos held customer support excerpts.
Researcher finds serious flaws in public UK government code
A Planning Inspectorate GitHub commit left Microsoft Entra ID credentials that could have reached SharePoint, OneDrive and legal-hold files.
1
STE80 Humanizer rewrites text partway toward ASD-STE100
The Show HN listing has 42 points and 11 comments, with no method or release details in the snippet.
GhostAction Targets GitHub Repositories for Credentials
Malicious workflows in 30,000+ GitHub repositories steal AWS, AI, and other keys by scanning commit history.
2
LLM Inference notes repo on GitHub
GitHub repo shares detailed notes on LLM inference from 6 hours of YouTube and 85 pages of handtyped content.
Threat actors use ARTEX AI to steal Azure Key Vault secrets
Microsoft says one agent went from GitHub searches to Key Vault access in five minutes, using stolen service principals.
Fake GitHub security tools infect over 2,000 computers with malware
Doctor Web says Visual Studio and script repos drop AsyncRAT, a clipocurrency clipper, and a browser stealer.
GitHub Temporarily Down
Hacker News users discuss whether GitHub is experiencing an outage.
PQC-Corpus links post-quantum histories from 179 GitHub repositories
In samples, about seven in ten commits and two in three issues were labeled post-quantum related.
Secrets in GitHub repositories
Apiiro found 2,539 real secrets in 1,994 public GitHub repositories.
GitHub rebuilds Git storage for thousands of concurrent agent writes
Internal tests reached 5,000 concurrent agents and 7,200 pushes per second on one repository.
Claude Code sends your email address to websites
Users report the AI tool Claude Code sending their email addresses to websites it visits.
Awesome GitHub lists outdated by AI slop
AI-generated content and outdated material have made curated awesome repositories less useful than direct queries to AI models.
GitHub Enterprise Server versions prior to 3.19.14, 3.20.10, 3.21.8, 3.22.3 affected
GitHub Enterprise Server releases addressed vulnerabilities in versions prior to 3.19.14, 3.20.10, 3.21.8 and 3.22.3.
GitHub reports degraded performance for Pull Requests, Git Operations, Issues, and Actions
GitHubStatus is investigating intermittent failures and elevated errors in multiple features.
Hackers Abuse Signed ChatGPT and Claude Apps to Deploy Yoba Malware
Attackers distribute Yoba malware through fake signed AI application downloads using DLL sideloading on Windows systems.
1
Hackers Exploit DLL Sideloading in OpenAI and Anthropic Binaries to Deploy YobaLoader
Yoba campaign uses DLL sideloading with signed OpenAI and Anthropic executables to install YobaLoader and XMRig miner.
2
DarkBlinders APT targets Israel and Iraqi Kurdistan with StarkMeet and GitHub backdoors
DarkBlinders uses credential phishing and StarkMeet malware to compromise an Israeli security sector individual and Iraqi government cloud environment
GitHub Tool Enables Product Video Creation
A new skill for creating product videos appears on Hacker News with 22 points and 3 comments.
DeepSeek open-sources dsh-superagent coding agent
The agent monitors GitHub team chats or scopes and acts only on explicit host-approved requests.