The proof of concept shows it's possible to upload malicious PyTorch releases to GitHub by exploiting insecure misconfigurations in GitHub Actions.

Many open-source repositories contain privileged GitHub Actions workflows that execute untrusted code and can be triggered by attackers to expose credentials and access tokens, as MITRE and Splunk ...

A sophisticated cascading supply chain attack has compromised multiple GitHub Actions, exposing critical CI/CD secrets across tens of thousands of repositories. The attack, which originally ...

Researchers say compromised tool in the GitHub CI/CD environment stole credentials; infosec leaders need to act immediately.

The company described Gemini CLI GitHub Actions as a free, beta-stage AI teammate that lives within a GitHub repo, capable of acting as an autonomous agent and an on-demand collaborator.