Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub is investigating unauthorized access to their internal repositories

twitter.com

Post reply on HN
Print view View original

31–40 of 359 posts

Re: GitHub is investigating unauthorized access to their internal repositories

#31

Post by tptacek »

tom_ wrote: post #17
mstank wrote: post #4

Is it just me or is this happening way more frequently in the last 4 or 5 months? Coincidently around the same time the models got a lot more capable?

It's more likely that it isn't coincidental at all: software development-oriented LLMs became a lot better towards the end of 2025, and so there's a non-zero chance that people are using them to find new security exploits. (People are not sleeping on this and it is not something people have failed to notice. I don't use LLMs at all and even I have noticed it - largely because there is approximately nobody that isn't…

There is a 100% chance that people are using LLMs to find vulnerabilities and build exploits. If it was possible for something to be a 101% chance, that's what it would be.

Re: GitHub is investigating unauthorized access to their internal repositories

#32

Post by vldszn »

keyle wrote: post #21
vldszn wrote: post #6

- Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e... - add Socket Free Firewall when installing npm packages on CI https://docs.socket.dev/docs/socket-firewall-free#git…

The only way to 'harden your github actions' is to not use github actions.

Makes sense tbh :)

Re: GitHub is investigating unauthorized access to their internal repositories

#33

Post by vldszn »

TZubiri wrote: post #26
vldszn wrote: post #14

GitHub: "We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity."

It reminds me of the famous "mistakes were made" Nixon quote. "We are investigating unauthorized access" sounds much better than "we've been hacked"

Exactly =)

Re: GitHub is investigating unauthorized access to their internal repositories

#34

Post by [deleted] »

TZubiri wrote: post #28
syngrog66 wrote: post #13

between all the Linux LPEs and Claude's known security flaws, alone, I'd be shocked if Github and Microsoft hadnt gotten hacked by now. reasonable bet we mainly hear it when big shops get bit

Before 2026 I hosted client code on GitHub, now it feels suboptimal, code is both an intellectual property asset and security risk. Especially if the company is software based, self-hosting your code just has a much better risk profile for almost no cost. It's also one of those things that warms your team up and gets them ready for actual work, a team that has to self host their git and other infra, like self-hosting…

[deleted]

Re: GitHub is investigating unauthorized access to their internal repositories

#35

Post by OptionOfT »

tom_ wrote: post #17
mstank wrote: post #4

Is it just me or is this happening way more frequently in the last 4 or 5 months? Coincidently around the same time the models got a lot more capable?

It's more likely that it isn't coincidental at all: software development-oriented LLMs became a lot better towards the end of 2025, and so there's a non-zero chance that people are using them to find new security exploits. (People are not sleeping on this and it is not something people have failed to notice. I don't use LLMs at all and even I have noticed it - largely because there is approximately nobody that isn't…

I think the other side is much more important. With company mandates to use AI as much as possible, there has been a deluge of low-quality PRs. Everybody is feeling tired from reviewing those, and quite possibly numerous security issues have been introduced since.

Re: GitHub is investigating unauthorized access to their internal repositories

#36

Post by robbiet480 »

vldszn wrote: post #6

- Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e... - add Socket Free Firewall when installing npm packages on CI https://docs.socket.dev/docs/socket-firewall-free#git…

Thanks for making me aware of zizmor, just ran and fixed all issues on our core repos.

Re: GitHub is investigating unauthorized access to their internal repositories

#37

Post by guluarte »

mstank wrote: post #4

Is it just me or is this happening way more frequently in the last 4 or 5 months? Coincidently around the same time the models got a lot more capable?

I heard an engineer at Anthropic was submitting 150 PRs per day. That's one PR every 5 to 10 minutes, so you can guess the level of review and quality control involved.

Re: GitHub is investigating unauthorized access to their internal repositories

#39

Post by yallpendantools »

cebert wrote: post #30
tiffanyh wrote: post #29

Is Twitter/X the right channel to announce a security event like this? I ask because I don’t see anything posted on their official blog or status page. https://github.blog/ https://www.githubstatus.com/

It’s a very popular messaging platform for tech enthusiasts.

So? Is this where your corporate paying clients should find out about an issue of this severity?

Not to mention Twitter is not an open platform anymore! (A) I'm an employee in an organization paying for Github. (B) I don't have a Twitter account. I already have a Github account because of (A). Why should (B) stop/delay me from getting official comms about this?

Re: GitHub is investigating unauthorized access to their internal repositories

#40

Post by vldszn »

robbiet480 wrote: post #36
vldszn wrote: post #6

- Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e... - add Socket Free Firewall when installing npm packages on CI https://docs.socket.dev/docs/socket-firewall-free#git…

Thanks for making me aware of zizmor, just ran and fixed all issues on our core repos.

You are welcome! Recently discovered it and found it genuinely useful. Fixed a bunch of issues in my workflows too :)
Post reply on HN