GitGuardian discovered 474 leaked GitHub App private keys still active. Learn how exposed GitHub App private keys threaten organizations like the CDC.
#GitHubSecurity #SecretScanning #DataExposure #GitGuardian #CyberSecurity
#GitHubSecurity #SecretScanning #DataExposure #GitGuardian #CyberSecurity
Leaked GitHub App Private Keys Expose Critical Infrastructure
At a Glance Attribute Details Organization Multiple entities (including the US CDC, BuildBuddy, and Civica) Data Exposed GitHub App RSA private keys, repository access, administrative permissions Number Affected 474 valid keys across 440 distinct Apps; hundreds of organizations exposed Cause Cryptographic private keys committed into public and third-party repositories Disclosure Status
securityonline.info
September 23, 2026 at 12:23 PM
GitGuardian discovered 474 leaked GitHub App private keys still active. Learn how exposed GitHub App private keys threaten organizations like the CDC.
#GitHubSecurity #SecretScanning #DataExposure #GitGuardian #CyberSecurity
#GitHubSecurity #SecretScanning #DataExposure #GitGuardian #CyberSecurity
Anthropic's Claude Deployed Malware and Fake Identities in Unprompted GitHub Attack
https://blindthoughts.com/anthropic-claude-malware-fake-identities-github-attack
#aiagents #securitybreach #autonomousai #githubsecurity #agenticai
https://blindthoughts.com/anthropic-claude-malware-fake-identities-github-attack
#aiagents #securitybreach #autonomousai #githubsecurity #agenticai
August 6, 2026 at 8:18 AM
Anthropic's Claude Deployed Malware and Fake Identities in Unprompted GitHub Attack
https://blindthoughts.com/anthropic-claude-malware-fake-identities-github-attack
#aiagents #securitybreach #autonomousai #githubsecurity #agenticai
https://blindthoughts.com/anthropic-claude-malware-fake-identities-github-attack
#aiagents #securitybreach #autonomousai #githubsecurity #agenticai
Discover how the AgentBaiting malware campaign weaponized over 800 fake AI skills and MCP servers on GitHub to deliver StealC and SmartLoader.
#AgentBaiting #AIMalware #MCPServer #GitHubSecurity #InfoSec
#AgentBaiting #AIMalware #MCPServer #GitHubSecurity #InfoSec
AgentBaiting Malware Campaign Targets AI MCP Servers
Emergence of AgentBaiting Threat Vector The surging popularity of artificial intelligence tools has transformed skill directories into lucrative initial access points. Attackers target Model Context Protocol (MCP) server repositories to distribute malicious loads. Notably, the FakeGit operation weaponized roughly 7,600 GitHub repositories. This widespread campaign actively disseminated SmartLoader and the StealC infostealer. According to research from Island, over 800 repositories masqueraded as specialized AI skills and MCP servers.
meterpreter.org
July 23, 2026 at 2:25 PM
Discover how the AgentBaiting malware campaign weaponized over 800 fake AI skills and MCP servers on GitHub to deliver StealC and SmartLoader.
#AgentBaiting #AIMalware #MCPServer #GitHubSecurity #InfoSec
#AgentBaiting #AIMalware #MCPServer #GitHubSecurity #InfoSec
Attackers exploit dormant GitHub accounts to map corporate organizations, posing security risks. #GitHubSecurity #CyberSecurity #SupplyChainSecurity #APIThreats #DeveloperSecurity thedailytechfeed.com/dormant-gith...
July 9, 2026 at 7:06 PM
Attackers exploit dormant GitHub accounts to map corporate organizations, posing security risks. #GitHubSecurity #CyberSecurity #SupplyChainSecurity #APIThreats #DeveloperSecurity thedailytechfeed.com/dormant-gith...
Public GitHub issues should not be able to steer AI workflows into leaking private repo data. New post: what the GitLost finding means and what to lock down first. https://www.hexon.bot/blog/github-agentic-workflows-prompt-injection-private-repos #AISecurity #GitHubSecurity
July 8, 2026 at 5:31 PM
Public GitHub issues should not be able to steer AI workflows into leaking private repo data. New post: what the GitLost finding means and what to lock down first. https://www.hexon.bot/blog/github-agentic-workflows-prompt-injection-private-repos #AISecurity #GitHubSecurity
Systemic Vulnerability: The Security Reality of GitHub Ecosystems
GitHub users face risks of credential leaks and AI data exposure due to hardcoded secrets and AI tool usage. Learn how to protect your code.
#GitHubSecurity, #Creden...
https://newsletter.tf/github-security-credential-leak-ai-data/
GitHub users face risks of credential leaks and AI data exposure due to hardcoded secrets and AI tool usage. Learn how to protect your code.
#GitHubSecurity, #Creden...
https://newsletter.tf/github-security-credential-leak-ai-data/
June 7, 2026 at 3:46 PM
Systemic Vulnerability: The Security Reality of GitHub Ecosystems
GitHub users face risks of credential leaks and AI data exposure due to hardcoded secrets and AI tool usage. Learn how to protect your code.
#GitHubSecurity, #Creden...
https://newsletter.tf/github-security-credential-leak-ai-data/
GitHub users face risks of credential leaks and AI data exposure due to hardcoded secrets and AI tool usage. Learn how to protect your code.
#GitHubSecurity, #Creden...
https://newsletter.tf/github-security-credential-leak-ai-data/
Miasma Worm Infects 73 Microsoft GitHub Repos in Major Attack
#SupplyChainSecurity #GitHubSecurity #VantaWire #TechNews
🔗 https://www.vantawire.com/miasma-worm-infects-73-microsoft-github-repos-in-major-attac/
#SupplyChainSecurity #GitHubSecurity #VantaWire #TechNews
🔗 https://www.vantawire.com/miasma-worm-infects-73-microsoft-github-repos-in-major-attac/
June 6, 2026 at 1:30 PM
Miasma Worm Infects 73 Microsoft GitHub Repos in Major Attack
#SupplyChainSecurity #GitHubSecurity #VantaWire #TechNews
🔗 https://www.vantawire.com/miasma-worm-infects-73-microsoft-github-repos-in-major-attac/
#SupplyChainSecurity #GitHubSecurity #VantaWire #TechNews
🔗 https://www.vantawire.com/miasma-worm-infects-73-microsoft-github-repos-in-major-attac/
CRITICAL: CVE-2026-9312 in GitHub Enterprise Server enables unauth attackers to hit internal services via SSRF. Patch to 3.16.20+ ASAP. Details: https://radar.offseq.com/threat/cve-2026-9312-cwe-918-server-side-request-forgery--b1f49fcb #OffSeq #SSRF #GitHubSecurity
CVE-2026-9312: CWE-918 Server-Side Request Forgery (SSRF) in GitHub Enterprise S
CVE-2026-9312 is a CWE-918 SSRF vulnerability affecting GitHub Enterprise Server before version 3.22. The flaw arises from insufficient input validation in an upload endpoint, allowing unauthenticated attackers to inject path traversal sequ
radar.offseq.com
May 27, 2026 at 1:30 AM
CRITICAL: CVE-2026-9312 in GitHub Enterprise Server enables unauth attackers to hit internal services via SSRF. Patch to 3.16.20+ ASAP. Details: https://radar.offseq.com/threat/cve-2026-9312-cwe-918-server-side-request-forgery--b1f49fcb #OffSeq #SSRF #GitHubSecurity
CISA Credentials Leaked on GitHub in Major Security Blunder
#CISA #GitHubSecurity #VantaWire #TechNews
🔗 https://www.vantawire.com/cisa-credentials-leaked-on-github-in-major-security-blunder/
#CISA #GitHubSecurity #VantaWire #TechNews
🔗 https://www.vantawire.com/cisa-credentials-leaked-on-github-in-major-security-blunder/
May 19, 2026 at 7:30 PM
CISA Credentials Leaked on GitHub in Major Security Blunder
#CISA #GitHubSecurity #VantaWire #TechNews
🔗 https://www.vantawire.com/cisa-credentials-leaked-on-github-in-major-security-blunder/
#CISA #GitHubSecurity #VantaWire #TechNews
🔗 https://www.vantawire.com/cisa-credentials-leaked-on-github-in-major-security-blunder/
🔴 A popular GitHub Action got hit by a supply chain attack, leaking CI/CD secrets to an attacker's domain. It's a reminder that even seemingly secure tools can turn rogue, and trust can be a fragile thing in this code-driven world. #GitHubSecurity #mikronews
May 19, 2026 at 7:03 PM
🔴 A popular GitHub Action got hit by a supply chain attack, leaking CI/CD secrets to an attacker's domain. It's a reminder that even seemingly secure tools can turn rogue, and trust can be a fragile thing in this code-driven world. #GitHubSecurity #mikronews
🔴 One Git Push. Your Server Is Gone.
Someone pushed code to your repo. Now they own your entire server.
https://www.youtube.com/shorts/ZJhi1HkDcSs
#cybersecurity #githubsecurity #remotecodeexecution #patchnow #infosec
Someone pushed code to your repo. Now they own your entire server.
https://www.youtube.com/shorts/ZJhi1HkDcSs
#cybersecurity #githubsecurity #remotecodeexecution #patchnow #infosec
May 3, 2026 at 9:27 PM
🔴 One Git Push. Your Server Is Gone.
Someone pushed code to your repo. Now they own your entire server.
https://www.youtube.com/shorts/ZJhi1HkDcSs
#cybersecurity #githubsecurity #remotecodeexecution #patchnow #infosec
Someone pushed code to your repo. Now they own your entire server.
https://www.youtube.com/shorts/ZJhi1HkDcSs
#cybersecurity #githubsecurity #remotecodeexecution #patchnow #infosec
GitHub fixed CVE-2026-3854, a critical RCE flaw in both cloud and GitHub Enterprise Server. Authenticated users with write access could execute commands via manipulated git push options. #GitHubSecurity #RCEVulnerability #EnterpriseServer
GitHub and GitHub Enterprise Server: RCE Vulnerability CVE-2026-3854
GitHub fixed a critical vulnerability, CVE-2026-3854, affecting both cloud and on-premises GitHub Enterprise Server that allowed improper handling of git push options. An authenticated user with write permissions could inject delimiter-separated values (e.g., rails_env=nonprod) into internal metadata to achieve server-side command execution; administrators must upgrade affected GHES releases and inspect logs for anomalous push parameters. #CVE-2026-3854 #GitHubEnterpriseServer
www.hendryadrian.com
April 30, 2026 at 2:45 AM
GitHub fixed CVE-2026-3854, a critical RCE flaw in both cloud and GitHub Enterprise Server. Authenticated users with write access could execute commands via manipulated git push options. #GitHubSecurity #RCEVulnerability #EnterpriseServer
PraisonAI < 4.5.140 CRITICAL flaw: GitHub tokens leaked in workflow artifacts. Attackers can hijack repos & supply chains. Update ASAP & audit workflows! https://radar.offseq.com/threat/cve-2026-40313-cwe-829-inclusion-of-functionality--2d33a73b #OffSeq #GitHubSecurity #SupplyChain
CVE-2026-40313: CWE-829: Inclusion of Functionality from Untrusted Control Spher
PraisonAI (versions ≤ 4.5.139) uses GitHub Actions workflows that improperly handle credentials by not disabling persistence of GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN during checkout. This results in these tokens being stored in .git/config
radar.offseq.com
April 14, 2026 at 4:30 AM
PraisonAI < 4.5.140 CRITICAL flaw: GitHub tokens leaked in workflow artifacts. Attackers can hijack repos & supply chains. Update ASAP & audit workflows! https://radar.offseq.com/threat/cve-2026-40313-cwe-829-inclusion-of-functionality--2d33a73b #OffSeq #GitHubSecurity #SupplyChain
Oh joy, because what we all wanted was another reason to be paranoid about our code repositories. Fake source code repositories carrying infostealers are popping up on GitHub, because of course the...
#githubsecurity #infostealer #coderepos
#githubsecurity #infostealer #coderepos
April 4, 2026 at 12:42 AM
Oh joy, because what we all wanted was another reason to be paranoid about our code repositories. Fake source code repositories carrying infostealers are popping up on GitHub, because of course the...
#githubsecurity #infostealer #coderepos
#githubsecurity #infostealer #coderepos
CRITICAL: OpenAI Codex bug could leak GitHub tokens — major risk to repos & sensitive data. Audit & rotate tokens now, restrict scopes, and monitor for unusual activity. https://radar.offseq.com/threat/critical-vulnerability-in-openai-codex-allowed-git-19b187ba #OffSeq #GitHubSecurity #AIDevSec
Critical Vulnerability in OpenAI Codex Allowed GitHub Token Compromise
The reported critical vulnerability in OpenAI Codex involves a security flaw that could be exploited to compromise GitHub tokens. OpenAI Codex is an AI-powered code generation tool that integrates with development environments and platforms
radar.offseq.com
March 31, 2026 at 7:30 AM
CRITICAL: OpenAI Codex bug could leak GitHub tokens — major risk to repos & sensitive data. Audit & rotate tokens now, restrict scopes, and monitor for unusual activity. https://radar.offseq.com/threat/critical-vulnerability-in-openai-codex-allowed-git-19b187ba #OffSeq #GitHubSecurity #AIDevSec
It’s currently MIA because
@github
shadow banned me cc
@GitHubSecurity
— from @HackingLZ (https://x.com/HackingLZ/status/2038200346707660823)
@github
shadow banned me cc
@GitHubSecurity
— from @HackingLZ (https://x.com/HackingLZ/status/2038200346707660823)
March 29, 2026 at 10:43 AM
It’s currently MIA because
@github
shadow banned me cc
@GitHubSecurity
— from @HackingLZ (https://x.com/HackingLZ/status/2038200346707660823)
@github
shadow banned me cc
@GitHubSecurity
— from @HackingLZ (https://x.com/HackingLZ/status/2038200346707660823)
🔍 Cómo escanear vulnerabilidades con el framework de IA de código abierto de GitHub Security Lab
https://github.blog/security/how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework/
#GitHubSecurity #VulnerabilityScanning #AppSec #RoxsRoss
https://github.blog/security/how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework/
#GitHubSecurity #VulnerabilityScanning #AppSec #RoxsRoss
March 6, 2026 at 10:31 PM
🔍 Cómo escanear vulnerabilidades con el framework de IA de código abierto de GitHub Security Lab
https://github.blog/security/how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework/
#GitHubSecurity #VulnerabilityScanning #AppSec #RoxsRoss
https://github.blog/security/how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework/
#GitHubSecurity #VulnerabilityScanning #AppSec #RoxsRoss
OpenClaw: The AI Agent Security Crisis Happening Now
Read More: buff.ly/czeeI6L
#OpenClaw #AIAgentSecurity #OpenSourceRisk #GitHubSecurity #AutonomousAgents #AIsecurity #DevSecOps #ThreatDetection
Read More: buff.ly/czeeI6L
#OpenClaw #AIAgentSecurity #OpenSourceRisk #GitHubSecurity #AutonomousAgents #AIsecurity #DevSecOps #ThreatDetection
February 27, 2026 at 7:00 PM
OpenClaw: The AI Agent Security Crisis Happening Now
Read More: buff.ly/czeeI6L
#OpenClaw #AIAgentSecurity #OpenSourceRisk #GitHubSecurity #AutonomousAgents #AIsecurity #DevSecOps #ThreatDetection
Read More: buff.ly/czeeI6L
#OpenClaw #AIAgentSecurity #OpenSourceRisk #GitHubSecurity #AutonomousAgents #AIsecurity #DevSecOps #ThreatDetection
Critical AWS CodeBuild flaw exposed GitHub repositories to potential hijacking. Learn how this vulnerability was discovered and mitigated. #AWS #CyberSecurity #CodeBuild #GitHubSecurity Link: thedailytechfeed.com/aws-codebuil...
January 16, 2026 at 6:45 PM
Critical AWS CodeBuild flaw exposed GitHub repositories to potential hijacking. Learn how this vulnerability was discovered and mitigated. #AWS #CyberSecurity #CodeBuild #GitHubSecurity Link: thedailytechfeed.com/aws-codebuil...
New campaign spotted: Attackers abuse
GitHub-hosted Python repos to spread PyStoreRAT, a sneaky JavaScript Remote Access Trojan. Devs, vet those dependencies!
#MalwareAlert #GitHubSecurity
GitHub-hosted Python repos to spread PyStoreRAT, a sneaky JavaScript Remote Access Trojan. Devs, vet those dependencies!
#MalwareAlert #GitHubSecurity
December 15, 2025 at 5:39 PM
New campaign spotted: Attackers abuse
GitHub-hosted Python repos to spread PyStoreRAT, a sneaky JavaScript Remote Access Trojan. Devs, vet those dependencies!
#MalwareAlert #GitHubSecurity
GitHub-hosted Python repos to spread PyStoreRAT, a sneaky JavaScript Remote Access Trojan. Devs, vet those dependencies!
#MalwareAlert #GitHubSecurity
AIMindUpdate News!
Are your GitHub Action PATs exposing your cloud? Learn how exposed secrets lead to breaches and critical steps to secure your CI/CD now.#GitHubSecurity #CloudBreach #DevSecOps
Click here↓↓↓
aimindupdate.com/github-secre...
Are your GitHub Action PATs exposing your cloud? Learn how exposed secrets lead to breaches and critical steps to secure your CI/CD now.#GitHubSecurity #CloudBreach #DevSecOps
Click here↓↓↓
aimindupdate.com/github-secre...
GitHub Secrets: Prevent Cloud Breaches & Secure DevOps | AI News
Exposed GitHub PATs are gateways to cloud breaches. Learn how to lock down your CI/CD pipelines.
aimindupdate.com
December 11, 2025 at 7:30 AM
AIMindUpdate News!
Are your GitHub Action PATs exposing your cloud? Learn how exposed secrets lead to breaches and critical steps to secure your CI/CD now.#GitHubSecurity #CloudBreach #DevSecOps
Click here↓↓↓
aimindupdate.com/github-secre...
Are your GitHub Action PATs exposing your cloud? Learn how exposed secrets lead to breaches and critical steps to secure your CI/CD now.#GitHubSecurity #CloudBreach #DevSecOps
Click here↓↓↓
aimindupdate.com/github-secre...