GitHub supply chain attack spills secrets from 23,000 projects
StepSecurity disclosed a compromise of the popular GitHub Action tj-actions/changed-files, which works to detect file changes ...
The Hacker News19h
GitHub Action Compromise Puts CI/CD Secrets at Risk in Over 23,000 Repositories
GitHub Action tj-actions/changed-files was compromised, leaking CI/CD secrets. Users must update immediately to prevent ...
Fake "Security Alert" issues on GitHub use OAuth app to hijack accounts
A widespread phishing campaign has targeted nearly 12,000 GitHub repositories with fake "Security Alert" issues, tricking ...
Supply chain attack on popular GitHub Action exposes CI/CD secrets
A supply chain attack on the widely used 'tj-actions/changed-files' GitHub Action, used by 23,000 repositories, potentially ...
InfoWorld6h
Thousands of open source projects at risk from hack of GitHub Actions tool
Researchers say compromised tool in the GitHub CI/CD environment stole credentials; infosec leaders need to act immediately.
Security issue in open source software leaves businesses concerned for systems
“Wiz Threat Research has so far identified dozens of repositories affected by the malicious GitHub action, including repos ...
CSO Online17h
GitHub accounts targeted with fake security alerts
Successful execution of the Click-fix campaign, which has reportedly targeted over 12,000 GitHub repositories, can allow ...
Security Boulevard14h
Addressing The Growing Challenge of Generic Secrets: Beyond GitHub’s Push Protection
Generic secrets are hard to detect and are getting leaked more often. See how GitGuardian offers advanced protection where ...
Supply chain attack against GitHub Action triggers massive exposure of secrets
Security researchers are warning of a supply chain attack against tj-actions/changed-files GitHub Action, which is used in ...
HealthcareInfoSecurity15h
Supply Chain Attack Targets GitHub Repositories and Secrets
Attackers subverted a widely used tool for software development environment GitHub, potentially allowing them to steal ...
Large enterprises scramble after supply-chain attack spills their secrets
Open source software used by more than 23,000 organizations, some of them in large enterprises, was compromised with credential-stealing code after attackers gained unauthorized access to a maintainer ...
Techzine Europe17h
Phishing campaign attacks 12,000 GitHub users with rogue OAuth app
A phishing campaign on GitHub with fake security alerts has attempted to trick about 12,000 developers into installing a malicious OAuth app. This app ...