Vulnerabilities

Vulnerabilities | News, how-tos, features, reviews, and videos

GitHub Actions hardens checkout security to block ‘pwn request’ attacks

After years of trying to educate developers to use pull_request_target securely, the platform finally implements stronger defaults.

By John E. Dunn

Jun 22, 2026 4 mins

Code Security GitHub Version Control Systems

The causes of cloud outages are changing

The latest outage data show that the cloud’s operational complexity, process failures, and control-plane errors are overshadowing infrastructure failures.

By David Linthicum

Jun 12, 2026 6 mins

Business Continuity Cloud Architecture Incident Response

GitHub finally pulls the plug on automatic install script execution for npm

The change, expected in July, will likely block one of the more common attack vectors; developers are wondering what took GitHub so long, and why other repositories acted so much sooner.

By Evan Schuman

Jun 10, 2026 8 mins

GitHub Version Control Systems Vulnerabilities

Protocol Buffers schemas expose remote code execution risk

Researchers at Cyera found six vulnerabilities in protobuf.js, including a flaw that can turn attacker-controlled schema data into executable code and expose downstream software supply chains.

By Shweta Sharma

Jun 8, 2026 4 mins

Security Vulnerabilities

Hole in GitHub’s browser-based VSCode editor could lead to stolen token

Its disclosure raises questions about what security researchers should expect from vendors, and how far in advance of its publication they should notify vendors about a bug.

By Howard Solomon

Jun 3, 2026 7 mins

Browser Security Endpoint Protection GitHub

Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects

Two months after Rapid7 discovered the hole in the Git service, the project maintainer has yet to patch the bug.

By Howard Solomon

May 28, 2026 5 mins

Open Source Security Vulnerabilities

FastAPI-based AI tools exposed to authentication bypass by flaw in Starlette framework

Researchers who found the bug warn that its Moderate rating understates a threat reaching across LLM gateways, MCP servers and agent infrastructure.

By Gyana Swain

May 27, 2026 5 mins

APIs Artificial Intelligence Vulnerabilities

13 new critical holes in JavaScript sandbox allow execution of arbitrary code

Developers are urged to upgrade to latest version of the vm2 library to plug all vulnerabilities.

By Howard Solomon

May 7, 2026 5 mins

Development Tools JavaScript Programming Languages

Critical GitHub RCE bug exposed millions of repositories

The now‑patched flaw allowed authenticated users to execute arbitrary code via crafted git push requests, affecting GitHub.com and Enterprise Server.

By Shweta Sharma

Apr 29, 2026 3 mins

Development Tools Security Vulnerabilities

Claude Mythos signals a new era in AI-driven security, finding 271 flaws in Firefox

The AI exposed hundreds of bugs in Mozilla’s web browser, raising hopes around defensive advantage, alongside fears of dual-use risk.

By Taryn Plumb

Apr 22, 2026 6 mins

Browser Security Endpoint Protection Vulnerabilities