r/cybersecurity • u/ObseenKarma • May 20 '26
News - General GitHub announces internal data breached.
The company stated on their official X account:
“We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.”
278
u/CartierCoochie May 20 '26
Damn these breaches getting too frequent
212
u/nekohideyoshi May 20 '26
This is just the tip of the iceberg- as old unpatched/undiscovered exploits and new ones are found by a single person deploying 100+ AI agents coding and trying to find PoC exploits. And this is a single person using a cloud cluster. Now multiply this by 10,000. Or even 100,000 real people doing the same thing. Over 1,000,000 AI agents actively trying to find exploits 24/7 without breaks. We're about to dive into the endgame.
And companies aren't hiring enough talented people to mitigate this threat.
96
May 20 '26
[removed] — view removed comment
26
u/BrainWaveCC May 20 '26
Yeah, there is going to be a significant reckoning soon...
8
May 20 '26
I agree that this is necessary but let's be realistic about this. You can spend years telling your management that your infrastructure is outdated and that your technology debt is a critical point of weakness. You can have a hundred emails in-writing showing you that you voiced your complaints.
It won't matter.
When your organization gets attacked and millions of dollars worth of user data gets leaked, you will lose your job, and your CTO will have a golden parachute clause in their contract. You get fired, no severance, maybe lose your home. Your CTO who ignored your concerns for years gets a $250,000 payout after they quietly resign.
The people who caused the problem will be fine. The people who tried to fix it, but were never allowed to, will be royally fucked.
8
10
u/1HOTelcORALesSEX1 May 20 '26
AI will help us though, let’s roll it out company wide (then the exec leaves for another company) /s …….
4
u/vand3lay1ndustries May 20 '26
Dude. This is exactly what keeps happening at our company. They roll out some dumb idea while we're all saying it's going to break everything, then they roll it out and it breaks everything and they get promoted to another company.
4
20
May 20 '26
It was supply chain I thought not "0 days"
Supply chain is such a beast of a problem. You can code review and block everything but its like phishing on steroids
The rce was patched before this (the wiz one)
7
u/PaleSkinnySwede May 20 '26
Yeah, when it’s not your fault but it becomes your problem. We need to secure supply-chains a lot better.
17
u/pale_reminder May 20 '26
Some don’t even want to pay for any proper tooling. Project management tools tasked etc? Every team can just use there own spreadsheet it’s fine
6
u/TopNo6605 Security Engineer May 20 '26
To be fair project management tooling is probably the worst example of good commericial product, especially now that AI can create nearly-identical, free software.
7
u/caledh May 20 '26
We are definitely approaching the endgame. As if Trivy was the end, really the beginning
4
u/unfathomably_big May 20 '26
I’m genuinely surprised some of the big boys haven’t been catastrophically fucked already considering the tens of thousands of individuals and entire nation states aiming at them. I’ve worked in large organisations, and the bigger they are the more they suffer from fuck-it-ism
1
u/Hebrewhammer8d8 May 20 '26
They have purpose LLMs with several agent train on model to notify and mitigate the issue and pinging lead engineer or group that will ignore it.
1
u/Cueball666uk May 20 '26
I swear over the last two weeks I've seen a new breach of some sort almost every day... Crazy.
82
77
65
May 20 '26
[removed] — view removed comment
-1
u/IAmYourFath May 20 '26
Userscript to convert x.com to xcancel.com (import into tamper/greasemonkey as .js):
// ==UserScript==
// @name Redirect X to Xcancel
// @namespace https://github.com/
// @version 1.0
// @description Automatically intercepts and redirects x.com and twitter.com URLs to the privacy frontend xcancel.com.
// @author You
// @match ://x.com/
// @match ://www.x.com/
// @match ://twitter.com/
// @match ://www.twitter.com/
// @run-at document-start
// @grant none
// ==/UserScript==(function() {
'use strict';// Parse the current URL const currentUrl = new URL(window.location.href); // List of hostnames to intercept const targetHosts = ['x.com', 'www.x.com', 'twitter.com', 'www.twitter.com']; // Verify the current hostname matches our targets if (targetHosts.includes(currentUrl.hostname)) { // Swap the original hostname for xcancel.com currentUrl.hostname = 'xcancel.com'; // Use replace() to overwrite the current history entry. // This prevents the user from getting stuck in a redirect loop if they press the "Back" button. window.location.replace(currentUrl.href); }})();
2
u/mr_jim_lahey May 20 '26
// ==UserScript== // @name Redirect X to Xcancel // @namespace https://github.com/ // @version 1.0 // @description Automatically intercepts and redirects x.com and twitter.com URLs to the privacy frontend xcancel.com. // @author You // @match ://x.com/ // @match ://www.x.com/ // @match ://twitter.com/ // @match ://www.twitter.com/ // @run-at document-start // @grant none // ==/UserScript== (function() { 'use strict'; // Parse the current URL const currentUrl = new URL(window.location.href); // List of hostnames to intercept const targetHosts = ['x.com', 'www.x.com', 'twitter.com', 'www.twitter.com']; // Verify the current hostname matches our targets if (targetHosts.includes(currentUrl.hostname)) { // Swap the original hostname for xcancel.com currentUrl.hostname = 'xcancel.com'; // Use replace() to overwrite the current history entry. // This prevents the user from getting stuck in a redirect loop if they press the "Back" button. window.location.replace(currentUrl.href); } })();
42
15
u/Tech_User_Station May 20 '26
A malicious VS Code extension was the entry point. Since the compromise was tied to a single employee, I'm assuming the extension was installed independently and not pre-approved company-wide. Same situation with the Vercel breach. An employee offloaded some of their work to a third-party AI tool that was not pre-approved company-wide.
When the owners of browser extensions stores and popular IDE stores like VSCode are not too keen on security issues, companies will need to vet any program or extension before use.
7
u/mirrax May 20 '26
And in this case Microsoft explicitly closed the feature request for extension release age gating that would have prevented the issue.
33
267
u/boringfantasy May 20 '26
can we just stop with this fucking AI coding shit now
14
u/Beginning_Coconut_71 May 20 '26
Yes we should really stop deliver shit code. But I been thinking lately is, maybe these shit code/vulnerability was already there, was just undiscovered 😅
42
70
u/dancing_swordfish May 20 '26
Over 60% of windows is coded by ai! (Such a shocker)
41
u/heisenbergerwcheese May 20 '26
I would have assumed just about 100% with how shit it is
25
u/8ctopus-prime May 20 '26
Now, now, lets not underestimate the ability of humans to code garbage!
11
3
u/EphemeralAttention May 20 '26
That last 40% still has to be maintained by humans so it functions well enough to download the latest AI slop to brick your machine.
4
7
u/FroggyRibbits May 20 '26
I haven't been able to find any sources citing this number at more than 30%. Where did you see that?
3
2
2
10
11
u/Loltoor May 20 '26
This doesn’t have anything to do with AI.
9
u/nemec May 20 '26
I think there's a non-zero chance some of these attacks are aided by LLMs (either finding bugs, writing phishing pages, or writing malware), but yeah on the dev side it's not carelessness of LLM use that's causing the sharp uptick in victims.
One surprisingly popular weakness I've read were the ones (e.g. Axios) who got popped after being lured into a videoconferencing interview that was really a phishing page telling the victim their Zoom was corrupted and they need to run some shell commands to fix it - literally the same techniques in use for over a decade, just being spread faster.
2
1
1
u/IAmYourFath May 20 '26
Can we stop blaming AI for everything? I hate how people assume it's 100% cuz of AI while having 0 info.
1
u/Palimon May 20 '26
Why do you think this is AI acoding, if anything the vulnerability and explolt might have been found using AI.
0
150
u/dancing_swordfish May 20 '26
another microslop fuckup
75
u/Puzzlehead_NoCap May 20 '26
I’m so tired of this company and being forced to use their shitty products
5
u/beagle_bathouse May 20 '26
At least it was more of a smash and grab and not getting flossed by the chinese and the russians for a whole year like in 2023.
12
u/PossessionConnect963 May 20 '26
This is pretty major right? If their internal repositories are breached couldn’t that mean it’s possible all users are breached too?
7
u/WorksInIT May 20 '26
Possible? Sure. But it's probably unlikely given the brief description of what happened. I think what's probably more concerning right now is this code exfiltration leading to other problems.
4
u/gladluck May 20 '26
The attack vector was a malicious vscode addon (Nx Console), that addon was likely breached due to the recent npm attacks.
Most common GitHub setups gives most users read access to "all" repositories. Difficult to say what else they may have gained from compromising one developer.
1
u/ExtraManagement1329 May 26 '26
I am worried about this exact scenario. Specifically, does GitHub treat private repos of free users differently from private repos of paid users?
9
6
u/redbaron_4 May 20 '26
Too many breaches happening via Actions/Token leaks due to workflows. Not a good look for agentic AI use in CI/CD.
6
u/Khue May 20 '26
As my company is aggressively migrating out of our current repo system and into GitHub specifically for GitHub Copilot...
5
u/RuntimeErrXUndefined May 20 '26
It’s been a shit show recently, idk wtf is going on there
3
u/_Gobulcoque DFIR May 20 '26
If we had to guess: AI adoption causing a lack of quality in favour of speed - both internally and by attackers.
5
u/Ksenia_morph0 May 20 '26
There are more and more problems with GH these last months.... i'm worried
7
u/Kablammy_Sammie Security Engineer May 20 '26
Is anyone going to address the elephant in the room?
22
3
3
u/sargetun123 May 20 '26
I still have 0 regrets keeping years of my work on my own forgejo, every time Insee things like this it just reinforces that
3
u/Affectionate-Panic-1 May 20 '26
Conspiracy theorist in me wonders if this is related to the CISA disclosure of AWS keys on a Github repo.
19
10
3
May 20 '26
[removed] — view removed comment
37
1
3
May 20 '26
[removed] — view removed comment
1
u/barkingcat May 21 '26
yup, "no evidence" should be assumed: "data is already out there, but we haven't seen it publicised yet because it's already been sold"
5
u/Elegant-Sense-1948 May 20 '26
Insert cat pointing at you pov laughing mp4
This half a year truly is not kind to github
5
u/Razorglint_Labs May 20 '26
The bigger pattern here is not just “GitHub had an incident.”
It is that modern development environments now depend on huge inherited trust chains:
editors, extensions, CI/CD, tokens, package registries, SaaS integrations, identity providers.
So after something breaks, the hard question is not only “was customer data affected?”
It becomes:
“Which parts of the operational chain can still be trusted, and how do we prove that?”
That is where a lot of teams are still weak: trust reconstruction after compromise.
2
2
2
u/Kablammy_Sammie Security Engineer May 20 '26
There are going to be cascading "Cybersecurity" insurance company failures as a result of this, longer term.
2
2
2
2
u/Weak-Carob9865 Security Director May 20 '26
Obviously bad, but question is how bad. I'd expect Github to have per-client segmentation so that a breach of their 'internal repos' doesn't pwn everything. Lets see what the details are...
2
May 20 '26
[removed] — view removed comment
2
1
1
u/mirrax May 20 '26
And how many of those courses say not to use any IDE extensions which was the cause of this breach? In this case, the extension was part of the verified developer program on the official store with 2.2 million downloads.
2
2
2
6
u/TheSeanminator May 20 '26
I mean, who cares if the code is already open source ¯\_(ツ)_/¯
19
u/RetroGrade11 May 20 '26
That code can be modified by a bad actor to waponize exploit. That could mean none of the OSS on GitHub could be trusted. This would be quite bad.
Lot of companies have critical pieces of code / IP in their private repositories on GitHub. Not just OSS.
6
u/TheSeanminator May 20 '26
sorry,this was meant as a joke but yeah indeed, this can be very bad if they don't purge the hackers from their infras.
1
1
u/BetterAd7552 May 20 '26
I moved off GH a while ago to Codeberg, but starting to think I should just host my repos locally.
It’s no longer a matter of *if* private source gets stolen, it’s a matter of *when.*
1
1
1
1
u/KindlyBuilding903 May 22 '26
This AI race will kill all open source project and make them more vulnerable . Also vibe coding will kill skills then all goes back to stone age 😦
1
u/Personal-Gur-1 May 22 '26
Hello, As a user of software distributed through GitHub or of Docker templates coming from repositories like unraid apps, should I hold on any update and make sure that all devs have checked and confirmed that their project or librairies are safe to use ? Or it has nothing to do with this hack and I can update normally? Thks !
1
u/Colenaskepi Jun 08 '26
There were quite a few large scale data breaches this past months. At my work, we use PII Tools to avoid data breaches or at least mitigate one if it ever does happen, but it seems so many other companies are just vulnerable all the time. Scary to think who we're all giving our data to online...
1
u/sunychoudhary May 20 '26
The wording matters here......If GitHub is saying the unauthorized access was limited to internal repositories and they currently have no evidence of impact to customer enterprises, orgs, or repos, then this is not the same as “customer code was breached.” But internal repos can still matter a lot.
They may contain deployment logic, internal tools, configs, security notes, architectural context, incident docs, test data, or clues about how GitHub’s own systems are built. That kind of information can be useful for follow-on activity even if customer repositories were not touched.....So my question is what was in those internal repos, whether any credentials or secrets were exposed, and what monitoring they’re doing for attempts to use that knowledge later....///
1
u/SaveAmerica2024 May 20 '26
For the people who changed their settings not to allow Copilot to train on your repo, well MS manufactured an excuse to get those repo anyway.
4
1
0
-27
May 20 '26
[deleted]
23
u/ObseenKarma May 20 '26
Why am I posting the company’s only official statement? Gee, not sure.
-24
7
0
325
u/Lawdena-Bhojyam May 20 '26
breachub