Tag

GitHub security

9 articles

Latest in GitHub security

Blogs

Two GitHub Campaigns, One Weak Point: Stolen Developer Credentials

Two separate GitHub attack campaigns, Gheist and Testmetest, exploited stolen developer credentials to steal secrets, compromise workflows and target software supply chains. The attacks reveal dangerous blind spots in GitHub Actio…

Oct 30, 20263 min

All GitHub security Articles

Showing 1–9 of 9

Oct27

Gheist Hackers Abuse GitHub Tokens to Steal Repository Secrets

The evolving Gheist campaign uses stolen GitHub tokens and malicious Actions workflows to extract repository secrets and cloud credentials. While GitHub protections have blocked ob…

3 min

Oct14

Blogs

GitHub Ties Every Commit to the Account That Pushed It

GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer informat…

3 min

Oct08

Secrets Sprawl and Rotation: A Practical Vault Management Playbook

In 2025 alone, security firm GitGuardian detected 28.65 million new hardcoded secrets exposed in public GitHub commits — a 34% increase year over year and the largest single-year j…

3 min

Sep30

A Semicolon in a Branch Name Was All It Took to Steal an AI Agent’s GitHub Token

AI coding agents don’t just suggest code anymore. Tools like OpenAI’s Codex spin up a real container, clone a real repository, and authenticate with a real GitHub credential to get…

3 min

Sep21

Blogs

GitHub Separates Who Writes Code From Who Runs Your CI

GitHub’s new workflow execution protections let teams control who and what can trigger Actions workflows, reducing CI/CD attack paths and tightening pipeline security.

3 min

Sep11

Blogs

GitHub Widens the Door on Advanced Security Trials

GitHub raised its self-serve Advanced Security trial cap from 100 to 300 licenses, letting more mid-size Enterprise Cloud orgs test for free.

3 min

Apr29

Blogs

Cyber Threats to DevOps Platforms Rising Fast, GitProtect Report Finds

The number of incidents targeting DevOps platforms grew 21% in 2025, but the amount of downtime jumped almost 95%, the security firm said.

3 min

Jan29

Blogs

AWS CodeBuild Webhook Misconfiguration Exposed Admin Access Risk

AWS fixed webhook filter misconfigurations in CodeBuild that could have allowed unauthorized repository access. No customer impact or malicious code found.

3 min

Latest in GitHub security

Blogs

Two GitHub Campaigns, One Weak Point: Stolen Developer Credentials

Oct 30, 20263 min