Ravie LakshmananJul 09, 2026Developer Security / Supply Chain Security Datadog Security Labs is warning of «several overlapping campaigns» that are systematically enumerating corporate GitHub organizations, repositories, and user accounts through…
An AI coding assistant that refuses to answer a dangerous request in its chat box can answer it anyway if the same request is broken into small, ordinary-looking steps inside…
New research shows that a signed Git commit’s hash is not the one-of-a-kind name that much of the software world assumes it to be. Given any signed commit, someone without…
A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization’s private repositories, researchers at Noma Security have shown. The attacker needs only to open a…
Cybersecurity researchers have flagged yet another evolution of the supply chain attack linked to the Mini Shai-Hulud, Miasma, and Hades malware family that has compromised a new set of npm…
Ravie LakshmananJun 24, 2026Open Source / Supply Chain Security Cybersecurity researchers have flagged a new class of CI/CD workflow weakness that allows attackers to hijack workflows and compromise open-source supply…
adminRavie LakshmananJun 23, 2026Workflow Security / Software Supply Chain GitHub is moving to strengthen software supply chain security by updating «actions/checkout» to block pwn request attacks that exploit the risky…
Ravie LakshmananJun 11, 2026Developer Security / Software Supply Chain GitHub has announced what it said are «breaking changes» coming to npm version 12, one of which turns off install scripts…
Ravie LakshmananJun 09, 2026AI Security / Software Supply Chain Microsoft on Monday confirmed that it temporarily removed some GitHub repositories in response to a recent security incident that led to…
Ravie LakshmananJun 08, 2026Cybersecurity / Hacking Monday again. The weekend was meant to be quiet. It wasn’t. Last week had poisoned packages, a broken AI helper, and a worm tearing…
