‘GitLost’ vulnerability let GitHub’s AI workflows leak private repositories

GitHub Inc.’s new Agentic Workflows feature that allowed an unauthenticated attacker to siphon data from private code ...
Hosted on MSN

Microsoft patches GitHub’s worst vulnerability in years within two hours of disclosure — no exploitation found

A critical remote code execution flaw in GitHub was patched by Microsoft in roughly two hours after public disclosure, closing what security researchers are calling the platform’s most severe ...

The GitHub Actions Attack Pattern Your CI Security Scanners Miss

ActiveState explains how GitHub Actions attack chains can evade traditional CI security scanners, why passing a scan doesn't ...
Infosecurity Magazine

Researcher Behind 'Exploitarium' Explains Release of Undisclosed Zero-Day Exploits

Infosecurity spoke with the researcher who dumped over 30 proof-of-concept exploits without disclosing the vulnerabilities ...
Bleeping Computer

GitHub fixes RCE flaw that gave access to millions of private repos

In early March, GitHub patched a critical remote code execution vulnerability (CVE-2026-3854) that could have allowed attackers to access millions of private repositories. The flaw was reported on ...
InfoWorld

GitHub Copilot update includes security vulnerability filtering

GitHub says the controversial AI-assisted coding tool is now being used by more than 400 organizations to increase developer productivity and improve code quality. GitHub Copilot, the controversial ...