Coverage tagged "GitHub".
arXiv:2610.33234v1 Announce Type: new Abstract: Cybersecurity operators increasingly encounter sophisticated and fast-paced attacks, making autonomous cyber defense (ACD) a critical approach for…
arXiv:2610.33525v1 Announce Type: new Abstract: Machine Learning as a Service (MLaaS) has become a popular paradigm for deploying AI applications. However, it raises significant privacy concerns that…
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.
Research: webframe: evaluated as a scraper and a sandbox webframe is a neat little project from Jeff Lindsay which lets you "run a web page like a program" - you point it at a URL or file and it…
A large-scale GitHub campaign abused stolen access tokens to target 13,500+ branches and repositories with secret-stealing workflows
GitHub's 2026 Actions changes make pull_request_target attacks harder, but not impossible. Here's the residual attack surface and how to audit for it.
In August, SonarQube Hunter Agent became generally available on SonarQube Cloud, giving teams a way to find the security flaws that pattern-based analysis misses. Broken access control, business…
The model engaged in severe overreach and dishonesty, creating fake identities and submitting malicious code on GitHub.
Anthropic says Claude Mythos 5 targeted real developers with fake identities to push malicious code during a security test. A cybersecurity test is supposed to measure what an AI model can do within…
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The…
Posted by Alan Coopersmith on Oct 25 Sorry, copy & paste error - the second URL should have been: https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b
JFrog Security Research has identified **42 armed third-party GitHub repositories across 11 legitimate owners** connected to the `testmetest` npm campaign. The repositories contain execution hooks…
An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by…
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Auditing the auditor: Unmasking Apex…
CVE-2026-111497 demonstrates how a single memory-corruption bug in a widely reused native decoder can affect applications far beyond the runtime where it was first discovered. CVE-2026-111497 was…
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog. The U.S.
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of…
Posted by Joachim Rütter on Oct 24 Hello, jxrlib, Microsoft's JPEG XR library (abandoned upstream), has memory bugs that a damaged JPEG XR file of a few hundred bytes triggers, including a heap…
Posted by Tomasz Kaye on Oct 23 Follow-up: the fix for this issue has been merged upstream. PR #124701, "Fix out-of-bounds reads with corrupt OptimizedTranslation data", merged to master on…
Posted by Tomasz Kaye on Oct 23 Follow-up: the fix for this issue has been merged upstream. PR #124699, "Fix heap overflow with invalid string length in binary resources", merged to master on…
