GitHub Actions stories
The stealer's use of typosquatted npm packages has raised fears that bug bounty channels are being abused to monetise stolen developer data.
Paid Cursor subscribers can now host repositories and manage pull requests in one place, as Origin enters early beta against GitHub and GitLab.
Malicious packages are now spreading faster across code repositories, with Google saying open source ecosystems face the sharpest rise in risk.
The new platform aims to cut breach risk as firms let AI agents use more systems, with 40% of developers leaving their access in place.
Developers using AI assistants could face stolen credentials and poisoned repositories as the worm hides inside normal coding workflows.
Public release of the Mini Shai-Hulud code means copycat attacks can now hit developers, CI/CD systems and open-source supply chains.
The acquisition aims to curb standing privileges as firms grapple with AI agents and machine identities reaching sensitive systems.
Marketplace bookings through Microsoft rose by double digits as New Relic deepened integrations aimed at helping customers manage AI-era software risk.
Developers can now manage multiple AI coding agents in one place as GitHub tests a desktop Copilot app with worktree automation and review tools.
More than half of patched flaws in major DevOps tools were high or critical in 2025, putting software supply chains at greater risk.
A flaw in a widely watched Microsoft repository could have let attackers run code and steal secrets through GitHub Actions, Tenable said.
A critical flaw in a widely used Microsoft code-sample repository could have let attackers steal secrets and run code through GitHub issues.
Leaked AI credentials and unpatched dependencies are leaving production systems exposed across US and European organisations, Orca Security said.
The malicious packages could leave build systems and Kubernetes clusters exposed, prompting checks across CI/CD pipelines and AI frameworks.
Enterprises could spot compromised maintainers sooner, as the new tool maps open-source contributors, dependencies and policy breaches across builds.
Aqua Security's Trivy GitHub Action was hijacked to ship infostealer code via CI/CD pipelines, exposing secrets across downstream users.
1Password unveils Unified Access to secure AI agents and machine credentials, promising endpoint-to-agent visibility for security teams.
Attackers are now moving fast enough that patching delays, standing privilege and inherited trust leave organisations exposed within minutes.
Browser verification can now be folded into development workflows, as teams face pressure to prove AI-generated code works before review.
A flaw in a Microsoft GitHub workflow could let attackers run unauthorised code and steal repository secrets, Tenable said.
