CSO Online

Argo CD flaw shows why GitOps infrastructure should be treated as tier zero

The unpatched vulnerability could give attackers a pathway from a compromised pod to broader control over Kubernetes ...
Dark Reading

'GitLost' Flaw Leaks Private Data From GitHub's Agentic Workflows

The flaw allows an unauthenticated attacker to craft a GitHub Issue in an org's public repository and then silently pull data ...
SecurityWeek

North Korean Hackers Target Open Source Developers in Supply Chain Attacks

North Korean hackers are targeting open source software developers with a backdoor and an information stealer as part of a ...

The GitHub Actions Attack Pattern Your CI Security Scanners Miss

ActiveState explains how GitHub Actions attack chains can evade traditional CI security scanners, why passing a scan doesn't ...
Tech Times

GitHub Secret Scanning Now Watches All Public Repos for Leaked Enterprise Keys

GitHub secret scanning now extends beyond org-owned repositories: Public Monitoring scans all of GitHub.com in real time, ...
Bleeping Computer

ChocoPoc malware delivered via trojanized exploits on GitHub

Multiple weaponized proof-of-concept (PoC) exploits on GitHub delivered a Python-based remote access trojan (RAT) called ChocoPoC that can execute commands and steal sensitive data. However, ChocoPoC ...
techtimes

Open-Weight AI Enters GitHub Copilot: Kimi K2.7 Code Costs Less, Audits Differently

GitHub moved the AI coding landscape on Wednesday when it made Kimi K2.7 Code — a Beijing-built, open-weight model from Moonshot AI — generally available in the GitHub Copilot model picker, marking ...