"Meta told SecurityWeek that 99% of the data the hackers took was business data, in the form of software code related to some of its products. The remaining 1% was personal data."

"That personal data had been added to the repositories by mistake and should not have been there."

Security Week: Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/ @SecurityWeek #Meta #GitHub #databreach #infosec

Hm, I was looking through my #GitHub settings and noticed that there was an authorized GitHub app called "Copilot for SWE". I definitely didn't enable that on purpose. Anyone else get this?

The GhostAction attack compromised developer accounts on GitHub, injecting malicious scripts to steal API keys and secrets in a major supply chain attack.

#GitHub #GhostAction #Cybersecurity #SupplyChainAttack #DataBreach

https://meterpreter.org/ghostaction-github-developer-hack/?utm_source=mastodon&utm_medium=jetpack_social

"Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War" published by Genians. #Kimsuky, #Phishing, #LNK, #GitHub, #GitPower https://www.genians.co.kr/en/blog/threat_intelligence/operation-gitpower

Sometimes, even GitHub has problems...

Fortunately, the Unicorns are here to fix a really bad day. 😉

#error #issue #github

Alt...

GitHub error page if something goes wrong

Well, #github is down. lol.

Software developers, the #GNU Project urges you to avoid hosting your repositories on #GitHub: https://u.fsf.org/4ci #FreeSoftware

We regularly post updates about TestLens on our blog. If you would like get notified when this happens, you can now subscribe to our newsletter on https://testlens.app

#Java #JUnit #Gradle #Maven #GitHub

#Qualcomm Snapdragon X2 erhält #Linux-Unterstützung mit einer frühen Entwicklervorschau. Entwickler können #Debian-Images bei #GitHub erstellen. #Asus plant für das erste Halbjahr 2027 Linux-Notebooks mit Snapdragon X2. Die Fokus liegt aktuell auf Laptop-Unterstützung. https://stadt-bremerhaven.de/qualcomm-snapdragon-x2-linux-unterstuetzung-kommt/

"Gut Ding will Weile haben"
vs.
"Warum bin ich nicht schon viel früher auf die Idee gekommen?!"

Na jedenfalls: bin jetzt bei github registriert (und codeberg) um mit Jekyll Markdown-Inhalte in HTML-Seiten zu integrieren und als github-pages zu speichern, zum Üben erstmal.

#github #git #Webentwicklung #Markdown #Jekyll

I’m looking for testers for #SparkleShare’s new CLI mode!

all you need is an empty git repository and to follow the instructions in the readme.

all feedback welcome. 🙏

https://github.com/hbons/Twinkle

#git #github #gitlab #forgejo

New PlayStation 5 Console Jailbreak Released

https://github.com/ntfargo/Relapse-Exploit

#github #playstation

📝 Nouveau service public : #Opengist est en ligne !

Marre de chercher où coller un bout de code ou un fichier de conf ? Je viens de déployer Opengist (opengist.blablalinux.be), une alternative libre, épurée & rapide à #GitHub Gist ! 🚀

🐧 J'y ai déposé un premier snippet de bienvenue en Bash pour fêter ça 👉 https://opengist.blablalinux.be

🔑 Inscriptions fermées aux bots, mais grand ouverte à la communauté sur simple demande : fais-moi signe en MP ou sur Matrix si tu veux ton compte !

📢 Two of @w3c’s most commonly used IRC bots, RRSAgent and Zakim, are now open source. These bots have assisted over 60,000 meetings at W3C over the past 25 years! 😊🎉

▶️ https://www.w3.org/blog/2026/w3c-irc-bots-now-open-source/ - by @gerald

Zakim is for agenda and queue management and RRSAgent for recording minutes. Their code and issue trackers are on #GitHub:
- https://github.com/w3c/zakim
- https://github.com/w3c/rrsagent
#OpenSource

👇From a T-shirt designed by @karlcow to thank W3C group chairs back in 2008!

Alt...

Two designed robots representing W3C's IRC bots: on the left, Zakim (in green, raising a hand for queue management) and on the right, RRSAgent (in blue, recording minutes).

Punto Informatico: Falso LastPass Authenticator installa il malware Rapuncel

Un falso installer di LastPass Authenticator, distribuito tramite GitHub, installa Rapuncel, un infostealer che ruba numerosi dati dal computer.
The post Falso LastPass Authenticator installa il malware Rapuncel appeared first on Punto Informatico.

False LastPass Authenticator installs malware Rapunzle

A fake LastPass Authenticator installer, distributed via GitHub, installs Rapuncel, a spyware that steals numerous data from the computer.
The post Fake LastPass Authenticator installs malware Rapuncel appeared first on Punto Informatico.

#Rapunzle #GitHub #Rapuncel #first #PuntoInformatico

https://www.punto-informatico.it/falso-lastpass-authenticator-installa-malware-rapuncel/

Hop, un p'tit repo tout chaud sur #GitHub et bien planqué/synchronisé sur #Gitea ! 🚀

C'est mon p'tit script pour mettre à jour les invités #Proxmox (#LXC et #VM) sans prise de tête.

👉 C'est par ici : https://github.com/anyblabla/proxmox-update-scripts

Socket, posted yesterday, if you missed it:

PolinRider Spreads Through Compromised GitHub Accounts and Packagist https://socket.dev/blog/polinrider-github-packagist @SocketSecurity #infosec #threatresearch #GitHub

Your repository already is project memory.

Code, docs, tests and Git preserve the *what* and *how*.

What’s usually missing is the *why*:
why this design, what was tried, what was rejected.

That belongs in the repo too.

https://keepthewhy.com

#AI #CodingAgents #AgenticCoding #ProjectMemory #SoftwareArchitecture #SoftwareEngineering #DevTools #Git #GitHub #OpenSource #DeveloperTools #LLM #AIEngineering #Documentation #KnowledgeManagement #ContextEngineering

So, #TIL about #ShitHub. #Github w/o #CoPilot #AI.

And here I thought I'd seen it all. 💩 ​

https://shithub.sh/

Your repository already is a surprisingly good project memory.

README, docs, tests, changelog, configuration and Git history already describe what the project is and how it became what it is.

What repositories usually don't preserve systematically is why.

Why does this workaround exist?
Why was an apparently cleaner solution rejected?
What was investigated and abandoned without ever producing a commit?

AI coding agents make capturing that reasoning cheap enough that we can finally treat it as another ordinary part of the repository.

That's the idea behind repo-native project memory.

No database.
No daemon.
No account.

Just one missing layer next to the code.

https://blog.technopathy.club/your-repository-already-is-your-project-s-memory-one-layer-was-missing

#AI #CodingAgents #AgenticCoding #ProjectMemory #SoftwareEngineering #Git #GitHub #OpenSource #DevTools #Documentation #LLM

@marcel

Open Source Projekte auf GitHub sind fast genau so anfällig auf Trumps Launen, wie Closed Source Apps...

#opensource #GitHub #forgejo #Codeberg

📢 Fediverse-Sprechstunde: Was sind eigentlich „Issues“ – und warum gehen sie uns alle etwas an?

Ihr nutzt Friendica, Mastodon, Hubzilla, Sharkey oder eine andere Fediverse-Software und plötzlich funktioniert etwas nicht so, wie ihr es erwartet? 🤔

Oder ihr denkt euch bei einer Funktion:
„Das könnte man doch besser machen!“

Vielleicht habt ihr auch eine Idee, die ihr gern den Entwicklerinnen und Entwicklern mitteilen würdet.

Dann fällt früher oder später ein Begriff: „Mach doch ein Issue auf.“

Aber was bedeutet das eigentlich?
Was gehört in ein gutes Issue hinein? Wo erstelle ich es? Welche Informationen brauchen Entwickler, um einen Fehler nachvollziehen zu können? Und muss ich dafür überhaupt technische Kenntnisse haben?

Genau darum geht es bei unserer nächsten Fediverse-Sprechstunde:

📅 Montag, 31. August 2026
🕢 19:30 Uhr
💻 Online

🔎 Was sind Issues und wie erstelle ich welche?

Für dieses Thema konnten wir Jens (@qbi ) gewinnen. Einige von euch kennen ihn vielleicht bereits aus unserer Fediverse-Sprechstunde zum Thema BookWyrm.

Jens ist Administrator und Entwickler und kennt Issues nicht nur aus der Theorie, sondern aus der täglichen Praxis. Gemeinsam wollen wir uns anschauen, wie aus einem beobachteten Problem, einer Idee oder einem Verbesserungsvorschlag ein Issue wird, mit dem Entwickler auch wirklich etwas anfangen können.

Dabei geht es ausdrücklich nicht nur um Entwickler oder Administratoren!

Denn freie und offene Software lebt auch davon, dass diejenigen, die sie täglich benutzen, Rückmeldungen geben. Niemand kann jeden Fehler selbst entdecken und niemand kennt alle Wünsche und Probleme der Nutzerinnen und Nutzer.

Ein gut beschriebenes Issue kann deshalb ein kleiner, aber sehr wertvoller Beitrag zur Weiterentwicklung einer Software sein. 🌱

Und vielleicht nehmen wir dabei auch ein wenig die Scheu vor Plattformen wie GitHub oder Codeberg. 😉

Ihr müsst dafür keine Programmierer sein und keinen Quellcode verstehen. Neugier und Fragen reichen völlig aus.

💬 Was ist überhaupt ein Issue?
🐞 Wie melde ich einen Fehler sinnvoll?
💡 Kann ich auch Ideen und Verbesserungsvorschläge einreichen?
📝 Welche Angaben gehören hinein?
🔍 Sollte ich vorher prüfen, ob es bereits ein ähnliches Issue gibt?
🤝 Wie erleichtere ich Entwicklern die Arbeit?

Und natürlich bleibt wie immer Raum für eure Fragen und den gemeinsamen Austausch.

Die Fediverse-Sprechstunde soll kein Frontalunterricht sein. Sie ist ein Treffpunkt zum Fragen, Erklären, Ausprobieren und voneinander Lernen – für Einsteiger ebenso wie für erfahrene Nutzer, Administratoren und Entwickler.

🌐 Mehr Miteinander statt Gegeneinander.

Gerade im Fediverse gehören Nutzer, Administratoren und Entwickler zusammen. Wenn wir besser verstehen, wie die jeweils anderen arbeiten und wie wir uns gegenseitig unterstützen können, profitiert am Ende das gesamte Fediverse davon.

👉 Montag, 31.08.2026 um 19:30 Uhr

💻 Konferenzraum:
campus.ws-12.de/rooms/8p9-mvy-…campus.ws-12.de/rooms/8p9-mvy-…

📢 Weitersagen und Teilen ausdrücklich erwünscht!

Vielleicht kennt ihr jemanden, der schon einmal einen Fehler entdeckt hat, eine gute Idee hatte – aber nicht wusste, wie und wo man sie den Entwicklern am besten mitteilt. Bringt ihn oder sie einfach mit. 😊

#Fediverse #FediverseSprechstunde #OpenSource #Issues #GitHub #Codeberg #Friendica #Mastodon #Hubzilla #BookWyrm #sharkey

Alt...

KI-generierte Grafik zur Fediverse-Sprechstunde am Montag, 31.08.2026 um 19:30 Uhr. Unter der Überschrift „Was sind Issues und wie erstelle ich welche?“ ist ein Laptop mit einer beispielhaften Issue-Seite zu sehen. Sprechblasen fragen „Fehler melden?“, „Idee einbringen?“ und „Verbesserung vorschlagen?“. Als Referent wird Jens (qbi), Admin, Entwickler und Issue-Profi, genannt. Darunter steht: „Mehr Miteinander statt Gegeneinander. Gemeinsam machen wir das Fediverse besser!“ Die Veranstaltung findet online im Konferenzraum der Fediverse-Sprechstunde statt.

Oh, so it's YOUR fault.

"GitHub says AI-driven growth overwhelmed its infrastructure, triggering an eight-hour outage as it races to shift more platform traffic to Microsoft Azure."

The New Stack: GitHub now sees 2.9 billion commits a month — and it can’t keep up https://thenewstack.io/github-2-9b-monthly-commits/ @TheNewStack #GitHub #Microsoft #infosec

🤯

> Since April, monthly commits have grown from 1.4 billion to 2.9 billion.

> We have since added more than 3 million CPU cores, 120 petabytes of high-speed storage, and significant network capacity.

🤯

#ai #github

https://github.blog/news-insights/company-news/the-august-17-outage-and-the-work-ahead/

Hey, #GitHub, I think you dropped this.

Alt...

Count hon Count smiles widely beside the number 9

Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR
#GitHub #Snowflake #Jira #Wiz
https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug

what a welcome coincidence #github #cursor

Alt...

Cursor tweet: Origin, our code hosting platform, is now live. It's fast, easy to use, and deeply integrated with Cursor. Get started by syncing your repos from GitHub.

GitHub experiencing widespread outage, API errors reach ~20%

GitHub is currently experiencing a widespread service disruption affecting multiple core services.

GitHub reports approximately 20% error rates across web experiences and API traffic, while archive downloads and raw repository content are seeing around 50% errors**.

Affected services include:

* GitHub API
* GitHub Actions
* Pull Requests
* Issues
* Webhooks
* GitHub Copilot
* SAML/OIDC authentication
* SCIM and Team Sync
* Repository downloads and much more

The incident began at approximately 13:40 UTC on August 17, 2026, and GitHub says it is continuing to investigate while applying mitigations.

There is currently no indication that this is a cyberattack. The root cause has not yet been publicly confirmed.

Full incident coverage and timeline:
https://thecybersecguru.com/news/github-outage-api-errors-20-percent/

#GitHub #GitHubOutage #GitHubDown #GitHubAPI #GitHubActions #GitHubCopilot #DevOps #CyberSecurity #Infosec #OpenSource

New.

Zscaler: C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 https://www.zscaler.com/blogs/security-research/c2looper-new-backdoor-likely-tied-ransomware-github-c2 #infosec #threatresearch #ransomware #GitHub

BleepingComputer: Microsoft confirms GitHub is down worldwide

https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-github-is-down-worldwide/

#github

Of course #GitHub is having an incident again right that moment I want to look up something to file an issue. 📉

i think the time has come.
i'm gonna migrate.
destination unclear
#github

Down and out, for now.

"We are experiencing high error rates around 20% for web experiences and api traffic. Archive downloads and raw repository content downloads are experiencing an approximate 50% error rate. SAML and OIDC authentication, SCIM, and Team Sync are also impacted. We are currently performing mitigations based on our investigation thus far and are monitoring for improvement."

GitHub Status: https://www.githubstatus.com/

The Register: GitHub has Issues as repo downloads hit 50% error rate https://www.theregister.com/ai-and-ml/2026/08/17/github-has-issues-as-repo-downloads-hit-50-error-rate/5288543 @theregister #GitHub #Microsoft #Copilot

You're absolutely correct! When you asked me to "clean up and archive some old data" I should not have sent the command "DROP DATABASE github.master" to the SQL server.
I'll make a note to ask before I do this next time.

#GithubDown #Github

I wonder if they're going to tell us that an AI "slipped through its guardrails" and deleted the whole of Github.

#GithubDown #Github

The moment you finally decide to get some work done on that pending bunch of open PRs, and… #Github #GithubDown

Alt...

Screenshot of https://www.githubstatus.com, showing a widespread outage on Github

Live from #GitHub Status HQ, this just in. A quiet afternoon turned into a nightmare at 13:40 UTC with performance issues. Within 4 minutes, Actions, Webhooks, and API were degraded. By 14:04, 1 in 5 pull requests silently vanished and half of all archive downloads were failing. We're told engineers are "investigating", the IT equivalent of saying "stay calm" while the house is on fire. Developers worldwide are being advised to remain calm, open three different tabs, and pray. Back to you, Bob.

Pink unicorns, as far as the eye can see.

#GithubDown #github

Oh, great. So apparently #Microsoft decided to add "#Copilot Pull Request Reviewer" to my "Authorized #GitHub Apps", behind my back.

If you need to check quick: https://github.com/settings/apps/authorizations

#NoAI #NoLLM

heise+ | Interview: Wie sich KI auf die Sicherheit von Open-Source-Software auswirkt

KI beschert dem Open-Source-Kosmos neue Probleme und verstärkt bestehende – hilft aber auch bei der Lösung. Wie, erklärt Andrew Nesbitt im Gespräch mit c't.

https://www.heise.de/ratgeber/Interview-Wie-sich-KI-auf-die-Sicherheit-von-Open-Source-Software-auswirkt-11365971.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#GitHub #IT #KünstlicheIntelligenz #Malware #OpenSource #Security #Sicherheitslücken #news

I wrote a post about making #Haskell scripts run faster on #Github actions using the magic of #Nix and some bash scripting: https://abhinavsarkar.net/posts/fast-haskell-scripts-on-github-actions/

#Blogging #programming

@ThePrimeTime

#ThePrimeTime

https://www.youtube.com/watch?v=RoHzXoolPTY

#GitHub #Codeberg #AI #LLM #VibeCoding #SayNo2Crypto ;)

7/29/26

new article: Migrating a #GitHub repository to #Tangled

after moving several of my own repos, i decided to publish my own little step-by-step guide

https://www.frytg.digital/blog/2026-07-28-migrating-to-tangled/

@mthie So much wrong with this, the cognitive dissonance on these „replies“ is just baffling.

Like starting with understanding what #codeberg is and aims to be and that it is NOT competition to #github would be a start, aye…

My view on the recent Codeberg drama:

https://gagliardoni.net/#20260724_codeberg_drama

Codeberg voting members have the right to decide the policy of their association, and I understand if a community is averse to anything that is AI- or Web3-related. I understand it, but I don't agree with it, because it's 2026, and if you still think you can just stick your head in the sand and wish for these ugly bad things to go away, well, I have bad news for you.

To me, this is a perfect recipe to relegate Codeberg to irrelevance. And we are already seeing the beginning of a new exodus.

Here is my conspiracy theory: the vote was pushed or manipulated from the inside by Big Tech. Whether this is true or not, one thing is sure: folks at Microsoft, GitHub, OpenAI etc. are now popping champagne.

#codeberg #opensource #foss #floss #libre #ai #llm #web3 #blockchain #crypto #cryptocurrency #antiai #luddism #eu #bigtech #politics #tech #censorship #github #microsoft #openai

And now, after banning vaguely-defined "LLM-generated code", Codeberg bans cryptocurrency projects. Discussion:

https://codeberg.org/Codeberg/org/pulls/1254

The specific ban is for "Content that harms the reputation of Codeberg, such as cryptocurrency related projects".

https://codeberg.org/Codeberg/org/commit/f383b648fd733ab88083dc390b91e77cd7589980

I think the reputation of Codeberg has been now harmed enough. When I originally escaped GitHub, I chose Codeberg exactly for the ethical stance and values. For me, anti-censorship is a non-negotiable ethical value. The folks at Codeberg have the right to run their org as they want. However, having now shown that they consider "censorship" good when it's about things they dislike, this made clear that their values and mine are not compatible (even if I dislike those same things, mind you).

Supporters of this ban say that this "draws a line", that "is not meant to be applied blanket-wide to all projects, only those which are harmful to the community", as if having constantly to worry about the next mood swing of Codeberg voting members were an acceptable Sword of Damocles for any reputable project. What's next? Banning US users? Banning software aligned with "capital-fascist" values? Open-source banking/wallet apps? Quantum computing tools? Robotics?

I'm moving off Codeberg, probably to Radicle. But I feel a bit sad, because Codeberg had the potential, in my opinion, to become the European alternative to GitHub, and they have made clear that they are not ready nor willing to become so. Which is fine: software is political, and everyone has the right to express their political stance.

But we still desperately need an alternative to GitHub.

#codeberg #drama #github #radicle #politics #opensource #bigtech #eu #europe #europa #usa #digitalsovereignty #ethics #censorship #crypto #web3 #blockchain #ai #llm #vibecoding

Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign
#Packagist #GitHub #cPanel #CVE_2026_41940
https://socket.dev/blog/github-actions-abuse-powers-cpanel-and-whm-exploitation

🎶 Oops, they did it again.

#Github #GithubDown #GithubStatus

Alt...

A screenshot from githubstatus.com showing a host of services are currently not working correctly.

Codeberg community voted to ban AI-generated code in repositories:

https://codeberg.org/Codeberg/org/pulls/1253#issuecomment-19820434

I am a regular Codeberg user, left GitHub in 2019, and co-maintain Libre projects that saw very little if none at all AI in development.

And still I think this decision will backfire badly.

I, like most of Codeberg users, was not even aware that this discussion was in place, did not vote. This only passed because of the anti-AI Luddite crowd. Which, mind you, has a point, I have very conflicting feelings about AI myself, and I think that the current trajectory is quite worrying. But this is just a knee-jerk reaction that has clearly not been thought of well enough.

I applaude the philosophy, or the intent if you want, of not having Codeberg turn into another SlopHub. But this is fairy-tale wishful thinking. There is no way to reliably detect AI-generated code at scale in 2026.
I can already smell the mutual witch hunts across projects and "camps".

Anyway, I hope I'm wrong.

#codeberg #ai #llm #drama #opensource #ludd #luddism #antiai #libre #foss #floss #slop #github

@tante sorry, the "how will people enforce this" argument is real, dismissing it will not make it disappear.

I am a regular Codeberg user, left GitHub in 2019, and co-maintain Libre projects that saw very little if none at all AI in development.

And still I think this decision will backfire badly.

I, like most of Codeberg users, was not even aware that this discussion was in place, did not vote. This only passed because of the anti-AI Luddite crowd. Which, mind you, has a point, I have very conflicting feelings about AI myself, and I think that the current trajectory is quite worrying. But this is just a knee-jerk reaction that has clearly not been thought of well enough.

I applaude the philosophy, or the intent if you want, of not having Codeberg turn into another SlopHub. But this is fairy-tale wishful thinking. There is no way to reliably detect AI-generated code at scale in 2026.
I can already smell the mutual witch hunts across projects and "camps".

Anyway, I hope I'm wrong.

#codeberg #ai #llm #drama #opensource #ludd #luddism #antiai #libre #foss #floss #slop #github

I don't know what's more stupid: #OpenSSH using different authentication flow depending on whether you have a `.pub` file in addition to the private key or not, or #GitHub suddenly starting to reject one of the two valid RFC 4252 workflows.

https://thorsell.io/2026/07/21/github-ssh-keys.html

#SSH

people using #github in a professional environment (paying for), how's the experience nowadays?

Are you also impacted by throttling ?

«xAI stellt KI-Agen "Grok-Build" nach massivem Datenleck als Open Source auf GitHub:
xAIs Kommandozeilen-Tool "grok" hat massive Kritik ausgelöst, weil es beim Ausführen in einem Verzeichnis sämtliche Dateien auf xAIs Google-Cloud-Server hochlud.»

So viel zum Thema Suverenität von xAI. Klar ist, dass Open-Source ist schon länger auch Marketing der IT-Konzernen auf die meisten basieren.

🤖 https://the-decoder.de/xai-stellt-ki-agen-grok-build-nach-massivem-datenleck-als-open-source-auf-github/

#xai #datenleck #github #opensource #git #grok #grokbuild #googlecloud #ai #ki #x

@christin yepp. Das ++ sollte nur symbolisieren, dass ich auch zu Codeberg gewechselt bin. Und #github--

GitHub gehört Microsoft. Zeit für einen Ausweg.

GitHub gehört seit 2018 Microsoft, unterliegt dem US Cloud Act und lässt Copilot seit April 2026 standardmäßig mit deinem Code trainieren, wenn du nicht widersprichst. Codeberg ist die naheliegende Alternative: gemeinnützig, europäisch, ohne Konzern im Rücken. Reden wir drüber!

https://www.chrislo.de/blog/2026-07-12-12-49-32-github-gehoert-microsoft-zeit-fuer-einen-ausweg/

#chrislo #DigitaleUnabhängigkeit #ServerInfrastruktur #GitHub #Codeberg #GitLab #Microsoft #OpenSource #CloudAct #Copilot #SelfHosting

@christin

Viele Projekte nutzen noch GitHub, statt dezentrale Gits...

#opensource #GitHub #forgejo #Codeberg

New.

Socket: Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics https://socket.dev/blog/compromised-injective-sdk-npm-package @SocketSecurity #infosec #threatresearch #npm #GitHub

GitLost Attack Exploits GitHub Agentic Workflows Preview

🔗 https://cybersecurefox.com/en/gitlost-github-agentic-workflows-data-leak

#gitlost #github #agentic #workflows #ai #agents #prompt #injection #private #repositories

GitHub-Alternative für KI-Entwickler: Entire startet eigenes Git-Netzwerk

Entire startet ein eigenes Git-Netzwerk für die EU, USA und Australien. Das Start-up von Ex-GitHub-CEO Thomas Dohmke spiegelt auch GitHub-Repos.

https://www.heise.de/news/GitHub-Alternative-fuer-KI-Entwickler-Entire-startet-eigenes-Git-Netzwerk-10178760.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Git #GitHub #IT #OpenSource #Softwareentwicklung #Versionskontrolle #news

🚨 GitHub had two trust failures in the same week. Neither broke cryptography. Neither hacked AI.

They simply exploited the gap between what GitHub checks and what developers assume.

1️⃣ Git Hash Chain Malleability
A signed commit can be transformed into multiple different commit SHAs without the signing key.

✅ Same code
✅ Same signature
✅ Still shows Verified
❌ Different commit hash

2️⃣ GitLost (AI Prompt Injection)
GitHub's AI agent could be tricked into reading data from private repositories and posting it publicly through a malicious issue.

One attacks cryptographic trust.
The other attacks AI trust.

Different bugs. Same lesson:
"Verified" doesn't always mean what you think it means.

Full breakdown with technical details 👇
https://thecybersecguru.com/news/github-verified-commit-vulnerability/

#GitHub #Git #CyberSecurity #SupplyChainSecurity #DevSecOps #AppSec #AI #LLMSecurity #OpenSource #InfoSec

🤖 'GitLost' flaw: GitHub Agentic Workflows leak private repo data via a crafted public issue. No auth needed — attacker opens an issue, and if the agent has broad read access, private data is exfiltrated.

🔗 https://www.darkreading.com/cyber-risk/gitlost-leaks-private-data-github-agentic-workflows
#DataBreach #GitHub #DevSecOps #CyberSec

This was posted yesterday.

NOMA: GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/

More:

The Hacker News: Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data https://thehackernews.com/2026/07/public-github-issue-could-trick-github.html @thehackernews #GitHub #infosec #bots

& now there's YA reason: last week, #GitHub urged the FOSS community to *oppose* important #California legislation that places transparency and consumer rights requirements on deployment of LLM-gen-AI!

GitHub's tactic? Disinformation claiming #FOSS licenses are incompatible with Cal. Bus. & Prof. Code §22757 and California #SB1000 (which seeks to amend §22757).

Read the analysis: https://sfconservancy.org/blog/2026/jul/03/github-gen-ai-california-22757-ok-for-foss-license/

#LLM #AI #copyleft #GPL #Microsoft #law

I just got this bill from #microsoft for #github usage. See if you can spot what is ridiculous about this bill.

Alt...

Screenshot of my “account usage” page at GitHub. It lists a bunch of “Included usage” items, each of which is zero dollars. They’re things like 2,000 Actions minutes .5 GB Actions storage 10 GB Git LFS storage Then it says Free usage: 100% off per month Zero dollars and two cents. The only thing on the list that explicitly says one hundred percent discount has a non-zero charge.

Downloads from https://release-assets.githubusercontent.com/ are now speed limited or what?

Looks like, i can just download with a speed of 10 Mbit/s github uploaded releases.

Doesnt matter from which project i try to download assets, it's limited to ~1MB/s -.-

#github #microsoft #microslop #git

💡 Today is a perfect day to exercise your independence from #BigTech, and #GiveUpGitHub.

☣️ #GitHub is the equivalent of #Twitter and #Facebook for software development -- creators of the most enticing proprietary walled garden ever made for #FOSS developers.

Don't be stuck when Microsoft decides to change the rules on you.

Start today.

https://GiveUpGitHub.org

#FreeSoftware #OpenSource

Alt...

GitHub "Octocat" mascot holding a bag with a "$" sign, and the other hand crushing blue words "USER RIGHTS".

I've oft had copyleft v. non-copyleft debates—usually heated—in public since USENIX ATC '98.
The *argument* wastes time. Sadly, #FOSS has 2 entrenched policy camps: 1 ultra-libertarian& 1 socialist-democratic;the philosophies are mutually exclusive.
Do: Advocate copyleft! Criticize billionaire-class(eg: #Microsoft &its #Github) on their 25yr anti-copyleft campaign! Write #copyleft sw! Fork non-copyleft sw!
Don't: have YA of these threads!
@mwl @jens
@miniBill
@whitequark
@david_chisnall
@lproven

New.

"The latest activity includes malicious npm releases affecting LeoPlatform and RStreams packages, GitHub Actions workflow abuse, and a related Go module compromise involving the Verana Blockchain project."

Socket: Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem @SocketSecurity #infosec #threatresearch #GitHub #npm #malware #JavaScript

FYI @ifin

Such an interesting read, not only did the author discover this vulnerability across multiple platforms (while still being too young to drive). But he also wrote a bot within one of the platforms to show the vulnerability in action.

https://gist.github.com/hackermondev/45a3cdfa52246f1d1201c1e8cdef6117

Tags: #redteam #github #vulnerability #discord #signal #cloudflare

The GitHub update was made yesterday: https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22

More:

The Hacker News: GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns https://thehackernews.com/2026/06/github-updates-actionscheckout-to-block.html @thehackernews #infosec #GitHub

@ifin

RE: https://infosec.exchange/@jkirk/116796238469020925

I know we like to all dunk on pastebin-with-devops but I will always hat tip every non-AI secure-by-design improvement an org takes!

More of this #gitHub team!

Angreifer nutzen GitHub als Malware-Schleuder: Laut Marc Stöckel verbreiten sie Trojaner über etwa 10.000 Repos. Vorgehen: bestehende Code-Projekte kopieren, Trojaner per Zip-Link in der Readme einschleusen – und kompromittierte Commits teils mehrfach am Tag erneut posten. GitHub reagiert offenbar nur auf Meldungen, nicht proaktiv. https://www.golem.de/news/github-als-malware-schleuder-trojaner-ueber-10-000-github-repos-verbreitet-2606-210032.html #Cybersecurity #GitHub #Malware

A post about how to perform phishing using github issues

https://blog.atsika.ninja/posts/the-phishy-github-issue-case

#infosec #cybersecurity #redteam #phishing #github

@jens said:
> “The aim of gen #AI is to move…means of production from devs to model owners”
…same idea as “The aim of copyright, work-for-hire,& proprietary software is to move the means of production from devs to for-profit company owners.”

Yet, we used the tools of theses oppressors & yielded a strong stalemate against them.

& *of course* they wanna undermine #FOSS! #Microsoft, #GitHub, #Apple, etc. have worked to undermine #FOSS for *decades*.

Pragmatic idealism FTW then & (we hope) again!

New post:

"A modular phishing infrastructure targeting multiple Mexican banks has been uncovered, abusing GitHub-hosted Pages, employing obfuscated scripts, and featuring a centralized credential exfiltration via SheetBest API, indicating a scalable and persistent multi-brand phishing operation."

Group-IB: GitBait: Phishing the Mexican Financial Sector https://www.group-ib.com/blog/gitbait-phishing-mexico-banking-finance/ #infosec #phishing #Github #cybercrime

New.

Check Point: From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker https://research.checkpoint.com/2026/from-stars-to-upvotes-fake-reputation-fueling-a-crypto-clipboard-hijacker/ #infosec #threatresearch #Rust #GitHub #YouTube

WhatsApp Clone, but Decentralized with P2P Messaging

App: https://Enkrypted.Chat

"Secure and private" is the general goal.

This is a technical/concept demo of a fairly unique approach using a browser-based, local-first and webrtc.

This is intended to introduce a new paradigm in client-side managed secure cryptography. We can avoid registration of any sort.

Features:

* P2P
* End to end encryption
* Signal protocol
* Post-Quantum cryptography
* File transfer
* Local-first
* No registration
* No installation
* No database
* TURN server

Feel free to reach out for clarity instead of diving into the docs/code.

IMPORTANT: While this is aiming to provide a secure experience, it isnt audited or reviewed. **Shared for testing, feedback and demo purposes only.** Please use responsibly.

#Privacy #OpenSource #P2P #WebRTC #Decentralization #DigitalSovereignty #CyberSecurity #FOSS #SelfHosted #NoCloud #AntiCorp #Encryption #WebDev #TechLiberty #PrivateMessaging #Networking #DataPrivacy #InternetFreedom #LocalFirst #SoftwareEngineering #WebApps #ZeroKnowledge #PrivacyTech #IndieDev #NoSignup #NoInstall #DecentralizedWeb #SecureMessaging #BrowserApp #TechEthics #P2P #WebRTC #PeerJS #ZeroData #EphemeralData #Encryption #E2EE #BrowserToBrowser #NoInstall #Privacy #Security #Decentralized #Messaging #VideoCall #NoTracking #PrivateMessaging #Prototype #Demo #WorkInProgress #CloseSource #OpenSource #WebDev #GitHub #TechDevelopment #WhatsApp #ChatApp #InstantMessaging #PWA

@nextcloud @jospoortvliet

Open Source projects should be hosted on Open Source products.

#nextcloud #GitHub #Codeberg #forgejo #opensource

#tech #dev #software #Claude #LLM #GitHub #NoAI

#AI #GenAI #GenerativeAI #github #tech #dev #SoftwareDevelopment