Version Control Systems

Version Control Systems | News, how-tos, features, reviews, and videos

A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove

The vulnerability impacts self-managed CE and EE instances and provides an unauthenticated path to arbitrary file reads. It’s already being probed in the wild.

By Taryn Plumb

Sep 14, 20265 mins

CI/CDDevopsGitLab

GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos

By Shweta Sharma

May 26, 20263 mins

Code SecurityGitHubMalware

TrapDoor malware campaign puts developer workstations in CISO spotlight

By Prasanth Aby Thomas

May 26, 20264 mins

Code SecurityGitHubMalware

GitHub admits major source code leak after 3,800 internal repositories breached

By John E. Dunn

May 20, 20264 mins

Code SecurityGitHubVersion Control Systems

Contractor’s public GitHub account exposed GovCloud and CISA credentials

By Howard Solomon

May 19, 20266 mins

Data and Information SecurityGitHubVersion Control Systems

Articles

GitHub scales back bug bounties, reminds users security is their responsibility too

The cloud code repository asks security researchers to cut out the AI-generated noise and focus on reporting security problems that are its fault, not the fault of its users’.

By Anirban Ghoshal

May 19, 2026 5 mins

BugsGitHubVersion Control Systems

Unplugged holes in npm and yarn could let attackers bypass Shai-Hulud defenses

A researcher at Koi Security says the two key platforms have not plugged the vulnerabilities enabling the worm attacks, and ‘the JavaScript ecosystem deserves better.’

By Howard Solomon

Jan 26, 2026 4 mins

Development ToolsGitHubJavaScript

GitLab 2FA login protection bypass lets attackers take over accounts

The platform warns users of on-premises versions to upgrade to the latest versions; SaaS and web versions have been patched.

By Howard Solomon

Jan 21, 2026 6 mins

Access ControlGitLabMultifactor Authentication

Possible software supply chain attack through AWS CodeBuild service blunted

Researchers at Wiz, who discovered the hole, said it could have led to compromised AWS GitHub repositories.

By Howard Solomon

Jan 15, 2026 5 mins

Development ToolsGitHubVulnerabilities

GitHub Action Secrets aren’t secret anymore: exposed PATs now a direct path into cloud environments

Wiz has found threat actors exploiting GitHub tokens, giving them access to GitHub Action Secrets and, ultimately, cloud environments.

By Taryn Plumb

Dec 9, 2025 6 mins

Cloud SecurityGitHubSecurity

New Shai-Hulud worm spreading through npm, GitHub

The latest version also executes malicious code during the preinstall phase, and is bigger and faster than the first wave, say researchers.

By Howard Solomon

Nov 24, 2025 7 mins

GitHubVersion Control SystemsVulnerabilities

QR codes become the vehicle for malware in new technique

A newly-discovered malicious package with layers of obfuscation is disguised as a utility library, with malware essentially hiding in plain sight in embedded QR codes.

By Taryn Plumb

Sep 23, 2025 1 min

Development ToolsMalwareVersion Control Systems

GitHub Actions attack renders even security-aware orgs vulnerable

Many open-source repositories contain privileged GitHub Actions workflows that execute untrusted code and can be triggered by attackers to expose credentials and access tokens, as MITRE and Splunk found out.

By Lucian Constantin

Jun 18, 2025 7 mins

DevSecOpsVersion Control SystemsVulnerabilities

'Dangerous' vulnerability in GitLab Ultimate Enterprise Edition

Admins and developers using self-managed installations urged to upgrade ASAP.

By Howard Solomon

Jun 12, 2025 5 mins

Version Control SystemsVulnerabilities

GitHub package limit put law firm in security bind

A cautionary tale of how a developer tool limit case could derail cybersecurity protections if not for quick thinking, public outreach, longtime relationships, and a vendor willing to listen and respond.

By Evan Schuman

May 21, 2025 5 mins

Identity and Access ManagementSoftware DevelopmentVersion Control Systems