SecurityWeek

Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection

A critical prompt injection vulnerability in GitHub Agentic Workflows could allow unauthenticated attackers to leak private repository data, ...
SecurityWeek

Network of 200 GitHub Repositories Used for Malware Infection

In Operation Muck and Load, over 200 GitHub repositories serve a Go module that leads to Windows malware infections.

CISA details security lapses that led to GitHub leak of passwords, cloud access keys

Weak security controls around the use of public GitHub code repositories allowed a contractor for the Cybersecurity and ...

‘GitLost’ vulnerability let GitHub’s AI workflows leak private repositories

GitHub Inc.’s new Agentic Workflows feature that allowed an unauthenticated attacker to siphon data from private code ...
Dark Reading

'GitLost' Flaw Leaks Private Data From GitHub's Agentic Workflows

The flaw allows an unauthenticated attacker to craft a GitHub Issue in an org's public repository and then silently pull data ...

Sideloading Android apps is great — until you have to update them. Here's my fix

Still manually updating sideloaded apps on your Android phone? Obtainium automates the update process, saving you time and effort.
Bleeping Computer

ChocoPoc malware delivered via trojanized exploits on GitHub

Multiple weaponized proof-of-concept (PoC) exploits on GitHub delivered a Python-based remote access trojan (RAT) called ChocoPoC that can execute commands and steal sensitive data. However, ChocoPoC ...
The Next Web

‘GitLost’: researchers tricked GitHub’s AI agent into leaking private repos

Noma Labs tricked GitHub's AI agent into leaking private repositories with a crafted issue. The prompt-injection flaw, GitLost, has no code fix.

HalluSquatting AI attack could hijack your computer

HalluSquatting exploits AI coding assistants that hallucinate fake repository names, letting attackers register those names ...

Kaspersky identifies malware framework targeting crypto investors

Cybersecurity firm Kaspersky warned of a new malware framework targeting cryptocurrency investors through ClickFix attacks ...