CISA details security lapses that led to GitHub leak of passwords, cloud access keys

Weak security controls around the use of public GitHub code repositories allowed a contractor for the Cybersecurity and ...
Tech Times on MSN

GitHub Actions gets secure-by-default CI/CD: Backport shuts the pwn request window

GitHub Actions security enforcement went live today: actions/checkout now refuses by default to execute untrusted fork code ...
Bleeping Computer

GitHub Actions artifacts found leaking auth tokens in popular projects

Multiple high-profile open-source projects, including those from Google, Microsoft, AWS, and Red Hat, were found to leak GitHub authentication tokens through GitHub Actions artifacts in CI/CD ...
InfoWorld

GitHub’s public APIs are becoming an enterprise reconnaissance tool

Researchers have uncovered a sustained campaign using GitHub's public APIs and ghost accounts to profile enterprise software ...
VentureBeat

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee’s device gave attackers access to roughly 3,800 internal repositories at the Microsoft-owned code storage and ...