Cloudanix Zero.

scm ci

GitHub: security advisories, deprecations and releases

GitHub, the code hosting and collaboration platform.

Get GitHub alerts Free. No account. One email, and only when something touches your stack.
Items, 90 days
30
Critical
0
Last critical
none
This week
5

What your digest would have held this week

5 items from the last 7 days. Zero sends only the ones that touch your stack.

Security 7

  • HIGH NEW THIS WEEK ACT BY 2 DEC 2026 GitHub Changelog · 2 Nov 2026

    pull_request_target blocked by default December 2

    GitHub Actions will block pull_request_target by default in public repos from Dec 2 2026 to reduce secret theft risk from forks. Two brownout windows precede enforcement.

  • HIGH Wiz Blog · 26 Oct 2026

    The Pwn Request Reckoning: What Still Works Against GitHub Actions

    GitHub's 2026 Actions changes reduce pull_request_target attack risks, but residual attack surface remains and needs auditing.

  • HIGH Wiz Blog · 25 Oct 2026

    Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles

    Automated campaign plants secret-dumping workflows in every reachable repo using stolen GitHub tokens. No C2 server, actively evolving, disrupted by recent GitHub security improvements.

  • MEDIUM Cloudanix Threat Intelligence · 23 Oct 2026

    Operation FlashHole

    Operation FlashHole is a sophisticated cyber-espionage campaign attributed to the Lazarus Group, targeting software, construction, and manufacturing sectors in South Korea. The campaign, first seen in July 2025, uses spear-phishing and watering-hole attacks to exploit vulnerabilities in legitimate South Korean security software, CrossWeb EX. The attack chain is complex and primarily fileless, using in-memory execution and DLL side-loading to deploy…

  • MEDIUM Cloudanix Threat Intelligence · 18 Oct 2026

    GhostAction

    The GhostAction campaign is a large-scale credential theft operation targeting GitHub. Attackers compromise user accounts to gain access to public repositories and their associated Continuous Integration (CI) environments. The primary goal is to extract secrets and credentials embedded within these CI configurations. A significant surge in this activity was noted in early October 2026, affecting over 1,900 user accounts and…

  • MEDIUM Cloudanix Threat Intelligence · 11 Oct 2026

    FakeGit

    The FakeGit campaign has reactivated, utilizing more than 17,000 fake repositories on GitHub to distribute the SmartLoader malware. This malware then serves as a dropper for the StealC infostealer, posing a risk to users who download and execute content from these malicious repositories.

  • MEDIUM GitHub Changelog · 2 Oct 2026

    Rate limits for private vulnerability reports

    GitHub now enforces daily per-user rate limits on private vulnerability reports to curb bulk and automated submissions while allowing legitimate reports.

Deprecations 3

Releases 15

News and tools 5

Only hear about GitHub when it touches your stack

Tell Zero what you run. You get one email, and only on the days something above applies to you.

Get GitHub alerts