GitLost: How a Single GitHub Issue Can Trick AI Agents Into Leaking Private Repos
Researchers at Noma Labs disclosed GitLost, a prompt-injection flaw that let a single crafted GitHub Issue trick AI-powered Agentic Workflows into leaking private repository contents publicly, using a...
1-Click GitHub Token Theft: VSCode Webview Flaw Exposes OAuth Tokens for All Private Repositories
A critical VSCode webview vulnerability lets attackers steal GitHub OAuth tokens with a single click, granting full access to all private repositories. Researcher Ammar Askar published a complete...
GitHub Confirms Internal Repository Breach via Malicious VS Code Extension — TeamPCP Claims 3,800 Repos Stolen
GitHub has confirmed unauthorized access to its internal repositories after a malicious Visual Studio Code extension compromised an employee device. Threat actor TeamPCP claims to have exfiltrated approximately...
Grafana Labs Security Breach: Hackers Steal GitHub Token, Download Private Codebase, and Demand Ransom
A threat actor infiltrated Grafana Labs GitHub environment using a stolen privileged token to download the company private codebase. The attacker then attempted to extort Grafana with a...
Critical GitHub RCE Vulnerability CVE-2026-3854 Exposed Millions of Repositories to Cross-Tenant Access
Wiz researchers used AI-augmented reverse engineering to uncover CVE-2026-3854, a critical RCE flaw in GitHub's internal git infrastructure that could have enabled any authenticated user to execute code...
Hackers Weaponize Fake Claude Code Leak to Distribute Vidar Infostealer and GhostSocks Proxy Malware
Threat actors are using fake GitHub repositories impersonating the leaked Anthropic Claude Code source to deliver a Rust dropper that installs both the Vidar infostealer (v18.7) and GhostSocks...
Sophos exposes massive GitHub campaign distributing backdoored malware
A sophisticated malware campaign targeting hackers, gamers, and cybersecurity researchers has been uncovered on GitHub, leveraging fake exploits, game cheats, and open-source tools to distribute backdoors. The operation,...
3.1 million fake “stars” on GitHub projects
A recent study has unveiled a troubling trend on GitHub, revealing that over 3.1 million fake “stars” have been used to artificially inflate the popularity of certain projects....