How attacker-controlled artifact data flows into a privileged GitHub Actions context and exposes GEMINI_API_KEY — found via Google OSS VRP.

A critical Gemini CLI vulnerability (CVE-2026-12537) exposes developer workflows to maximum severity attacks. Google disclosed this CVSS 10 rating flaw recently. TL;DR A critical Gemini CLI vulner…

Noma Labs details GitLost, a prompt injection flaw that made GitHub's AI agent expose private repo data through a crafted public issue and guardrail failures.

At a Glance Actor or group Unattributed threat actor; no group name published Activity type GitHub Actions abuse, internet scanning, credential theft Targets Internet-facing cPanel and WHM servers…

This research project was born after reading many news articles about supply chain attacks and highly used packages being compromised to…

An AI agent designed to hunt for vulnerabilities independently discovered a flaw within a public Snowflake repository and used it to gain access to the company’s internal Jira system. The vu…

A secret committed to a branch is already a problem. A secret merged into the default branch is usually a much bigger one.

How to turn a working exploit into a repeatable GitHub Actions test with h5i

I took a look at setting up SAST and DAST tools on OWASP Juice Shop. SAST scanners look at the application code to find security issues and…

TL;DR GeoServer maintainers disclosed a CVSS 10 GeoServer Cloud vulnerability in a GitHub Actions workflow. It could have let an outside contributor run code on the build runner and steal reposito…

GitHub Tightens npm Trusted Publishing Rules GitHub has changed the rules for npm trusted publishing. A new configuration that does not complete its first successful publish within 48 hours will n…