Attackers can inject indirect prompts in normal-looking repositories to trick Claude Code into spawning a reverse shell.

An anonymous researcher has dumped what they say is working exploit code for zero-day vulnerabilities across 15 software ...

Just two months ago, researchers at the Data Intelligence Lab at the University of Hong Kong introduced CLI-Anything, a new state-of-the-art tool that analyzes any repo’s source code and generates a ...

An agentic coding tool tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious ...

A Hacker News commenter identifying as a VS Code team member said Workspace Trust is the intended security protection against repo-based attacks. The commenter acknowledged user experience issues and ...

Microsoft GitHub hack hit open-source AI tools, exposing developer passwords and cloud credentials. Here’s why SA tech teams should care.

Rumor mill: OpenAI is reportedly developing a code-hosting platform designed to compete with GitHub, which is owned by Microsoft. According to The Information, the project is still in its early stages ...

After publicly touting pull request limits as a way to cut maintainer noise, GitHub is taking the same idea further with a new setting that lets repository admins restrict issue creation to ...

Administrators of the open-source game engine Godot have blocked automated code submissions to protect repository governance and fix review backlogs.