French security firm CrowdSec disclosed that attackers used the Shai-Hulud worm to compromise a former employee's machine in May, stealing a GitHub OAuth token that still had read access to the company's private repositories. Over roughly nine minutes, attackers downloaded about 170 private repos plus 130+ public ones; CrowdSec only learned of the breach on September 16 after stolen source code surfaced on the cybercrime marketplace pwnforum.
darkreading.com
· 2026-09-22
Microsoft used AI agents to convert the Copilot runtime's 430,000 lines of TypeScript into 800,000 lines of Rust, a project that took about 14.5 weeks, over 135 releases, roughly $120,000 in AI token costs, and three weeks of human developer oversight to fix dozens of regressions. The Rust version now powers Copilot across VS Code, Visual Studio, the CLI, SDK, and Office apps like Excel and Outlook.
theregister.com
· 2026-09-20
Rickub is a new Git hosting platform that bundles organization and repository management, merge requests, and an integrated AI reviewer called Athena that leaves inline comments and verdicts on every merge request. It also supports running existing GitHub Actions workflows unchanged, hosting OCI artifacts like container images, Helm charts, SBOMs and WASM in the same namespace as code, and offers CLI, API and MCP access using one token and permission model.
rickub.com
· 2026-09-18
LastPass and Delphos Labs identified a malware campaign that uses SEO-optimized GitHub repositories impersonating LastPass and at least 39 other companies to distribute a previously unseen infostealer called Rapuncel. Victims searching for tools like LastPass Authenticator are led to fake repos where oversized ZIP files hide a renamed Microsoft debugger that sideloads the malicious payload and a Microsoft-signed kernel driver capable of killing 145 different antivirus and EDR products.
bleepingcomputer.com
· 2026-09-18
CrowdSec disclosed that a leak of its private source code repositories occurred in May 2026 and was reported to the company on September 16. The exposed material includes SaaS console code, AWS routines, connectors, and CI/CD tokens, but excludes CrowdSec's public Security Engine software. The company found no evidence of leaked credentials, customer data, or login information, and believes the Tanstack supply-chain compromise was the likely entry point.
crowdsec.net
· 2026-09-17
A developer flagged two recurring GitHub interface bugs: one that overcounts pull requests in the repository tab, especially after merges, even though the correct count appears elsewhere on the same page, and another affecting a pop-up window for org membership selection that fails to properly paginate, blocking access to org pages beyond the first. The user worked around the pagination issue by using JavaScript to force navigation within the pop-up, since Chrome wouldn't allow manual editing of its address bar.
chuckgreenman.com
· 2026-09-16
A developer's essay critiques how services report reliability using uptime percentages like 99.72% or 98.98%, arguing these numbers look deceptively similar to non-experts even though they represent vastly different amounts of actual downtime. The author references Jason Gorman's observation that reliability gains become exponentially harder near 100%, comparing uptime metrics to earthquake magnitude scales where small numeric differences hide huge real-world impact. The proposed fix: status pages should show actual downtime duration (e.g., '12 hours affected in the last 30 days') alongside or instead of raw percentages.
blog.jim-nielsen.com
· 2026-09-16
CloudX built and released cloudx-io/setup-go, a drop-in replacement for GitHub's official actions/setup-go, after finding that the official action caused parallel jobs to interfere with each other and repeatedly pull stale cache data. In backtests on CloudX's monorepo running lint, test, and build jobs in parallel, the new action eliminated an estimated 86% of unnecessary work performed by the default setup, cutting test job runtimes by 69%.
cloudx.ai
· 2026-09-16
Security firm Strix ran an unauthenticated scan against Baseten's public infrastructure and within 25 minutes uncovered a live GitHub personal access token with admin rights to Baseten's core product repo, GitOps repo, and Homebrew tap. The token, tied to a container image built in March 2023, had gone unnoticed for over three years and still granted read/write access to private customer repositories when discovered in July 2026. Baseten's security team confirmed the issue as critical and rotated the token within a day of disclosure.
strix.ai
· 2026-09-15
Intel archived the GitHub repository for its One Mono developer typeface earlier this week as part of a broader trimming of open-source projects, then reversed course and reinstated the project. Reports indicate the company may keep maintaining it going forward.
tomshardware.com
· 2026-09-13
A Coinbase engineer created 'Stonkfly,' an open-source simulation of a male fruit fly's brain and eyes containing 166,700 neurons and 25.6 million synaptic connections, and set it loose reading candlestick charts to buy, sell or hold cryptocurrencies. The virtual fly perceives price charts as raw pixel data through simulated photoreceptors, acts roughly every 500 milliseconds, and receives a dopamine-like reward signal for profitable trades and an aversive signal for losses, with trading fees also counted as losses.
tomshardware.com
· 2026-09-12
A review examines three widely cited benchmark resources: the sirupsen/napkin-math GitHub project used for computer performance estimation interviews, a senior-level SWE-Bench coding evaluation, and standardized winter tire test ratings. The piece walks through each dataset's numbers and methodology, inviting readers to form their own estimates before revealing where the figures may be misleading or inconsistent.
danluu.com
· 2026-09-11
GoKawiil