GhostAction has returned with an expanded credential-theft operation, injecting malicious GitHub Actions workflows into 790 repositories by October 9, 2026. GitGuardian first documented GhostAction in 2025, when it reported 817 affected repositories an…

An espionage campaign targeting government organizations across the Commonwealth of Independent States (CIS), with additional interest in water, environmental, and energy sectors. The investigation found four infection chains active from June 2025 thro…

Meta has revealed a breach of a GitHub repository that exposed software code and personal information belonging to about 1,500 individuals, most of whom are U.S. employees. The company began notifying affected individuals on October 13, after discoveri…

Hackers are abusing GitHub Actions to steal SSH keys, cloud credentials, and access tokens through malicious workflows disguised as security checks. The workflows targeted 2,577 secrets, but targeting did not always translate into theft. Researchers co…

Security researchers have revealed an attack against GitHub Copilot CLI that can expose developer secrets through an attacker-controlled webpage. This technique is called Cryptographic Context Injection (CCI). It involves hiding malicious instructions …

Security researchers have identified 543,699 unique credentials that remain valid despite being exposed in public GitHub repositories. This highlights a persistent failure to revoke secrets once they enter source code. These credentials were verified a…

AI coding agents have inadvertently exposed over 13,000 internal developer screenshots in public GitHub repositories. These exposures potentially revealed sensitive information such as customer records, credentials, financial interfaces, and unreleased…

Threat actors have compromised at least 65 public GitHub repositories in a software supply-chain campaign that abused npm trusted publishing to distribute a stealthy backdoor through a legitimate package. The malicious package was identified as @dforge…