GitHub news

GitHub is testing Project HydraFusion, an AI system that uses multiple models together to improve coding assistance. This approach aims to deliver higher quality results while better managing performance and cost for complex developer tasks.

The AI code editor Cursor has launched Origin, its own git-based code hosting platform. It's designed as a direct GitHub alternative for teams that want to integrate AI agents deeply into their development workflow.

GitHub experienced a major outage, leaving developers unable to access repositories and services. The incident, confirmed on its status page, halted workflows and highlighted the industry's deep reliance on the platform for daily operations.

GitHub has launched Code Quality, a new tool that uses AI to automatically find and suggest fixes for code maintainability problems. It's designed to help development teams manage the growing volume of AI-generated code.

GitHub engineers found a surprising way to speed up text search. By removing a common optimization, they made case-insensitive matching run at the maximum speed of computer memory and released a new open-source library for developers.

Microsoft's new MAI-Code-1-Flash is a lightweight AI coding model designed for speed. Early data from real-world use shows it excels in fast, iterative developer workflows, signaling a shift toward smaller, more specialized AI tools.

GitHub now lets open-source maintainers limit pull requests from new contributors. This helps them manage high volumes of submissions and focus on quality contributions instead of getting bogged down by spam or low-effort changes.

An automated attack named Megalodon targeted 5,561 GitHub repositories in a six-hour period. Attackers used throwaway accounts to push malicious commits containing GitHub Actions workflows designed to steal secrets from CI/CD pipelines, such as API keys and other sensitive environment variables.

GitHub is rolling out security updates for npm, the popular JavaScript package manager. The changes will block malicious scripts from running automatically during installation, helping to protect developers and their projects from common supply-chain attacks.

Microsoft is advocating for Coordinated Vulnerability Disclosure, urging researchers to report issues privately. The statement follows a public dispute where a security researcher disclosed multiple zero-day vulnerabilities, leading to a debate on platform governance and responsible disclosure ethics.

GitHub has enhanced npm security with a new "staged publishing" feature. It requires maintainers to approve new package versions using two-factor authentication (2FA) before they are publicly available. This measure aims to prevent malicious package publications and strengthen the software supply chain against attacks.

Attackers are using GitHub and SourceForge to distribute malware disguised as popular software like ChatGPT and Claude. Compromised YouTube channels promote these fake installers, which deploy a Deno-based backdoor called DinDoor that installs additional remote access trojans on infected systems.

A flaw in Anthropic's Claude Code GitHub Action let attackers take over repositories by simply opening an issue. This created a serious supply chain risk, as the action itself could have been compromised and used to spread malicious code.

Microsoft is pushing enterprises to switch from Azure Repos to GitHub. The recommendation comes despite GitHub's recent history of major outages, forcing IT leaders to weigh new features against platform stability.

GitHub reduced token consumption in its AI-powered CI workflows by up to 62%. The company achieved this by removing unused tools, replacing API calls with its CLI, and deploying daily automated agents to audit and optimize usage, offering a model for others to follow.

The US Cybersecurity and Infrastructure Agency (CISA) accidentally exposed sensitive credentials, including plaintext passwords and SSH keys, in a public GitHub repository. The repository, discovered by security firm GitGuardian, was accessible for an extended period before being taken offline after a security researcher reported the issue.

Grafana Labs confirmed a security breach limited to its GitHub environment, exposing public and private source code. The company stated that its investigation found no evidence of customer production systems being compromised. The incident was linked to a supply chain attack involving a TanStack npm package.

GitHub is investigating a claim by a threat actor group called TeamPCP. The group alleges it accessed GitHub's internal repositories and is attempting to sell the platform's source code on a cybercrime forum. GitHub has found no evidence that customer data has been impacted so far.

GitHub has disclosed a security breach where an attacker gained unauthorized access to its internal repositories. The compromise originated from a malicious third-party VS Code extension on an employee's device. While thousands of internal repos were exfiltrated, GitHub reports no evidence of impact on customer data.

GitHub is updating its bug bounty program to handle a massive increase in low-quality submissions, many generated by AI tools. The company is tightening its standards and will now reward certain types of lower-impact vulnerability reports with merchandise instead of cash payments to discourage spam.

GitHub has confirmed that a recent breach of 3,800 internal repositories was caused by a malicious VS Code extension. The extension was compromised in a wider supply-chain attack targeting the popular TanStack npm packages, highlighting the growing risks of software dependencies.

A contractor's public GitHub repository accidentally exposed sensitive credentials. The leak included access keys for US government AWS accounts and internal systems for the Cybersecurity and Infrastructure Security Agency (CISA). A researcher from GitGuardian discovered the exposure, which was then reported by security journalist Brian Krebs.

Vercel has introduced a consolidated commit status for GitHub monorepos. Instead of receiving a separate status for each project in a pull request, teams can now opt-in to a single, unified status. This simplifies branch protection rules and streamlines the code review and merge process.

A CISA contractor exposed highly privileged AWS GovCloud credentials and internal system details in a public GitHub repository. Security experts call it a major government data leak, revealing sensitive information about how the agency builds, tests, and deploys its internal software systems, posing a significant security risk.

Grafana has disclosed a security incident where an unauthorized party gained access to its GitHub environment using a stolen token. The attacker was able to download the company's codebase. Grafana's investigation found no evidence that customer data or systems were affected by the breach.