GitHub supply chain attack spills secrets from 23,000 projects
StepSecurity disclosed a compromise of the popular GitHub Action tj-actions/changed-files, which works to detect file changes ...
The Hacker News16h
GitHub Action Compromise Puts CI/CD Secrets at Risk in Over 23,000 Repositories
GitHub Action tj-actions/changed-files was compromised, leaking CI/CD secrets. Users must update immediately to prevent ...
Fake "Security Alert" issues on GitHub use OAuth app to hijack accounts
A widespread phishing campaign has targeted nearly 12,000 GitHub repositories with fake "Security Alert" issues, tricking ...
CSO Online13h
GitHub accounts targeted with fake security alerts
Successful execution of the Click-fix campaign, which has reportedly targeted over 12,000 GitHub repositories, can allow ...
Security Boulevard10h
Addressing The Growing Challenge of Generic Secrets: Beyond GitHub’s Push Protection
Generic secrets are hard to detect and are getting leaked more often. See how GitGuardian offers advanced protection where ...
Supply chain attack on popular GitHub Action exposes CI/CD secrets
A supply chain attack on the widely used 'tj-actions/changed-files' GitHub Action, used by 23,000 repositories, potentially ...
InfoWorld6h
Thousands of open source projects at risk from hack of GitHub Actions tool
Researchers say compromised tool in the GitHub CI/CD environment stole credentials; infosec leaders need to act immediately.
Security issue in open source software leaves businesses concerned for systems
“Wiz Threat Research has so far identified dozens of repositories affected by the malicious GitHub action, including repos ...
HealthcareInfoSecurity12h
Supply Chain Attack Targets GitHub Repositories and Secrets
Attackers subverted a widely used tool for software development environment GitHub, potentially allowing them to steal ...
Supply chain attack against GitHub Action triggers massive exposure of secrets
Security researchers are warning of a supply chain attack against tj-actions/changed-files GitHub Action, which is used in ...
Techzine Europe14h
Phishing campaign attacks 12,000 GitHub users with rogue OAuth app
A phishing campaign on GitHub with fake security alerts has attempted to trick about 12,000 developers into installing a malicious OAuth app. This app ...