A flaw in Anthropic’s Claude Code GitHub Action let attackers bypass permission checks via a fake bot account and use prompt injection to steal OIDC tokens, gaining write access to any vulnerable ...

The FBI has warned that TeamPCP compromised trusted developer tools to steal cloud credentials, deploy malware, extort ...

Hackers compromised 19 packages on the PyPI, collectively downloaded hundreds of thousands of times, in a new Shai-Hulud supply-chain attack that delivered malware designed to steal developer secrets.

Mozilla researchers revealed a new attack that tricks Claude Code into running hidden commands from seemingly harmless GitHub repositories.

Mozilla 0DIN’s Claude Code demo shows how clean GitHub repos can expose AI coding agents to prompt injection, reverse shells, ...

After years of trying to educate developers to use pull_request_target securely, the platform finally implements stronger ...

GitHub secret scanning now extends beyond org-owned repositories: Public Monitoring scans all of GitHub.com in real time, ...

GitHub’s actions/checkout v7 now blocks risky fork PR checkouts in privileged workflows to reduce common pwn request attacks.

An agentic coding tool tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious ...

Cybersecurity researchers at Kaspersky have identified more than 250,000 potential security misconfigurations across GitHub ...

Threat actor reused unrotated GitHub Actions secrets to compromise 73 Microsoft repos Miasma worm planted across Azure, microsoft, Azure‑Samples, and MicrosoftDocs orgs Microsoft pulled affected repos ...