An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.
GitHub MCP Exploited: Accessing private repositories via MCP
We showcase a critical vulnerability with the official GitHub MCP server, allowing attackers to access private repository data. The vulnerability is among the first discovered by Invariant's security analyzer for detecting toxic agent flows.
Investigating unauthorized access to GitHub-owned repositories
If any impact is discovered, customers will be notified via established incident response and notification channels.
A GitHub Issue Title Compromised 4,000 Developer Machines
A prompt injection in a GitHub issue triggered a chain reaction that ended with 4,000 developers getting OpenClaw installed without consent. The attack composes well-understood vulnerabilities into something new: one AI tool bootstrapping another.
Why GitHub Actually Won
How GitHub _actually_ became the dominant force it is today, from one of it's cofounders.
GitHub lock-in?
There has been a lot of noise recently on how GitHub is bad, and how developers should stop using it.
Ditching GitHub
This is going to be some sort of a public service announcement, withside notes. This has been brewing for a long, long time (years), it’sjust that I never se...
How GitHub Conquered Google, Microsoft, and Everyone Else
Google Code was supposed to spread the open source religion. But then GitHub came along. And GitHub, it turns out, was a much better preacher.
Is GitHub Cooked?
Track GitHub service incidents and outages. Real-time stats, incident history, and downtime analytics.
GitHub MCP Exploited: Accessing private repositories via MCP
GitHub's official MCP server grants LLMs a whole host of new abilities, including being able to read and issues in repositories the user has access to and submit new pull …
Red Squares — the GitHub outage graph
A satirical contribution graph: red squares track GitHub.com platform outages instead of green squares tracking commits.
Why I'm leaving GitHub for Forgejo | Jorijn Schrijvershof
I left GitHub for self-hosted Forgejo on a hardened NUC. The reason is digital sovereignty, not reliability outages. Here's the thinking and the architecture.
Incident Report: Leaked GitHub Personal Access Token - The Python Package Index Blog
We responded to an incident related to a leaked GitHub Personal Access Token for a PyPI administrator.
Submit Pull Requests to WordPress Core with the GitHub-to-Patch Utility
When Matt Mullenweg asked the audience who has used Git and/or GitHub during his 2014 State of the Word address, the response was almost unanimous. “Whoah, that’s all the hands!” he exclaimed befor…
Keytrace — One identity, many proofs.
Link your GitHub, domain, and other accounts to your internet handle. Cryptographically signed, user-owned, and portable.
