GitHub Advanced Security
“Fix vulnerabilities and safeguard your software supply chain with built-in, AI-powered security.”
Dependency review, code scanning and secret scanning with push protection.
Product pageGitHub
United States1 product listed
Join the world's most widely adopted, AI-powered developer platform where millions of developers, businesses, and the largest open source community build software that advances humanity.
Our summaryCode hosting platform owned by Microsoft. GitHub Security Lab researches open-source vulnerabilities.
- Products listed
- 1
- Research stories
- 18
- Incidents and advisories
- 99
- Indicators
- 169
GitHub in our news, month by month
ResearchIncidents and advisories
5
11
Jun
4
11
Jul
3
Aug
1
5
Sept
2
18
Oct
3
11
Nov
Products and the controls they provide
External reviews
Independent tests, peer reviews and articles about GitHub. We link to them; we did not write or commission them, and nobody pays to appear here.
Research by GitHub
Stories in our coverage based on what researchers at GitHub found or reported: 18 in total.
- 12 Nov 2026GitHub Agentic Autofix and the question of who owns a bad AI patch
GitHub discusses accountability for AI-generated code patches and the implications for security.
- 10 Nov 2026Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones
Git fixes flaw allowing malicious repos to execute code during recursive clones.
- 5 Nov 2026GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub to block pull_request_target workflows by default in public repos on Dec 2, 2026.
- 28 Oct 2026GitHub’s npm package firewall can block brand-new versions before they install
GitHub's new npm package firewall blocks new versions, malware, and critical vulnerabilities before installation.
- 26 Oct 2026The Pwn Request Reckoning: What Still Works Against GitHub Actions
GitHub Actions pull_request_target attacks persist despite 2026 security changes.
- 16 Sept 2026GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
GitHub Actions adds cache-mode to mitigate cache poisoning risks.
- 27 Jul 2026New GitHub, PyPI Policies Boost Supply Chain Security
GitHub and PyPI implement new policies to enhance supply chain security.
- 27 Jul 2026GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
GitHub Dependabot adds a 3-day cooldown for version updates to prevent poisoned package adoption.
- 9 Jul 2026npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk
npm 12 disables install scripts by default to mitigate supply chain risks.
- 23 Jun 2026GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
GitHub updates actions/checkout to block pwn request attacks via pull_request_target.
Incidents and advisories
Stories where a GitHub product had a vulnerability or was attacked, or GitHub itself was: 99 in total. Useful if you run its products.
- 12 Nov 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials
Hackers used 4,800 compromised GitHub accounts in the 'wfx-loot' campaign to steal cloud credentials.
- 12 Nov 2026Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign
Attacker targets 60,000 GitHub repos with credential-stealing malware via hijacked accounts.
- 12 Nov 2026Check your GitHub repos: A secret stealer hit tens of thousands of them
Threat actor wfx-loot targets GitHub repos with stolen credentials, stealing secrets from thousands.
- 12 Nov 2026Hackers Hijack 4,837 GitHub Accounts to Target 61,764 Repositories With CI Secret-Stealing Malware
Hackers hijacked 4,837 GitHub accounts to inject secret-stealing malware into 61,764 repositories.
- 12 Nov 2026WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks
WFX Phantom malware uses compromised GitHub accounts to steal secrets via GitHub Actions.
- 11 Nov 2026Git fixes six vulnerabilities, including code execution during recursive clones
Git fixes six vulnerabilities, including code execution during recursive clones.
- 10 Nov 2026Hackers Steal GitHub Tokens Through Malicious VS Code Extension That Remained Available for 18 Minutes
Malicious VS Code extension stole GitHub tokens for 18 minutes.
- 2 Nov 2026Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD Secrets
Hackers targeted 61 GitHub repos with command injection to steal CI/CD secrets.
- 1 Nov 2026Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability
Week in review covers r/opensource AI ban, Microsoft Authenticator flaw, GitHub token theft, and K-12 school breaches.
- 30 Oct 2026North Korean Hackers Steal Developer Credentials to Inject Malware Into GitHub and Software Packages
North Korean DeceptiveDevelopment group steals developer credentials to inject malware into GitHub and software
Indicators from these storieslatest 30 of 169 · show· hide
Vendor Watch
Run GitHub?
Get an email when a new story names GitHub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
From GitHub
Is this your company, or did we get something wrong?
Tell us what to fix on this page: a product, a description, a link or a review. We check every suggestion before changing anything, and listing stays free and editorial.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.