Mozilla researchers revealed a new attack that tricks Claude Code into running hidden commands from seemingly harmless GitHub repositories.

An agentic coding tool tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious ...

GitHub’s actions/checkout v7 now blocks risky fork PR checkouts in privileged workflows to reduce common pwn request attacks.

Cursor Origin git platform launched at Compile alongside a 1.5-trillion-parameter model in training and a new iOS app, as ...

Researchers found Cordyceps CI/CD flaws affecting 300+ repositories, enabling code execution, credential theft, and supply ...

Cybersecurity researchers at Kaspersky have identified more than 250,000 potential security misconfigurations across GitHub Actions workflows in thousands of ...

The researcher, who goes by bikini, dropped the exploit code and vulnerability write-ups in a now-removed GitHub repository ...

Three levels of indirection, all with seemingly innocuous steps, will catch a bot off-guard.

Overview Windsurf and Amazon Q Developer, two familiar AI coding brands, will have each moved into different product areas by ...

Rust Lightning heads to self-hosted git.rust-bitcoin.org as GitHub's slowdowns, bans, and LLM spam erode trust.

Security firm Novee has revealed Cordyceps as a class of exploitable CI/CD vulnerabilities across open-source repositories ...

Figma Config 2026 closed Thursday with Code Layers for GitHub-linked canvas editing, Figma Motion in open beta with CSS and ...