Multiple threat actors are abusing the GitHub API to discover organizations’ repositories and members via ghost accounts.

Researchers have uncovered a sustained campaign using GitHub's public APIs and ghost accounts to profile enterprise software ...

GitHub ghost accounts and exposed PATs scrape corporate orgs through the API, with select cases cloning private repos.

GitHub secret scanning now extends beyond org-owned repositories: Public Monitoring scans all of GitHub.com in real time, ...

A prompt injection attack can trick GitHub’s preview Agentic Workflows into retrieving content from private repositories and ...

A new form of malware is targeting macOS users by impersonating Apple’s built-in crash-reporting component to trick victims ...

GitHub also launches Codex as an agent provider in JetBrains IDEs and rolls out AI credit pools giving enterprise admins ...

Microsoft maps three Salesforce intrusion paths that abuse OAuth apps, vendor tokens, and guest access while ordinary sign-in ...

Malicious prompters could easily trick GitHub agents into pulling data from private repositories and then leaking the ...

Crunch, the leading API security platform for the agentic era, today announced the availability of the 42Crunch API Security Testing Plugin for GitHub Copilot. This latest advance enables developers ...

GitHub has recorded its ‘best month ever’ in June after a major change to how it charges customers for its Copilot AI coding ...

CrashStealer, a newly documented Mac infostealer, used an Apple-notarized meeting app to reach victims before stealing ...