GitHub's Source Code Leaked 🐙 & Your Browser May Be a Bot 🤖

Two major security stories broke today that every developer, IT admin, and regular internet user should know about. Whether you use GitHub at work or just browse the web, these threats are closer to home than you might think.

🐙 GitHub Hacked: 3,800+ Internal Repos Stolen via Poisoned VS Code Extension

A hacker group called TeamPCP has claimed they broke into GitHub itself — not through a fancy zero-day, but by slipping a malicious extension into a developer's copy of VS Code. That single compromised device was enough to give them access to over 3,800 of GitHub's internal repositories, including source code for some of its most critical tools: Copilot, Actions, CodeQL, and Dependabot. To make matters worse, the notorious LAPSUS$ group is reportedly now helping sell the stolen code, and the same attackers also poisoned a popular Microsoft Python package to steal cloud credentials from anyone who installed it. GitHub has rotated its secrets and is investigating the full scope — but the supply chain implications here are serious. If code that powers your CI/CD pipelines or AI coding assistant has been tampered with, the fallout could reach far beyond GitHub's own walls.

Read more →

🤖 Google Accidentally Published Exploit Code That Can Turn Your Browser Into a Bot

In an embarrassing slip, Google accidentally made public the proof-of-concept code for a serious, still-unpatched bug in Chromium — the engine that powers Chrome, Edge, Brave, Opera, Vivaldi, and Arc. The flaw lets any website you visit silently turn your browser into a bot that can be used for DDoS attacks, traffic proxying, and monitoring your activity — all without you knowing. The attack works by triggering a persistent background process called a service worker, and it's especially stealthy on Microsoft Edge. Firefox and Safari users are in the clear, but everyone else should keep a close eye on browser update notifications. Until a patch lands, there's unfortunately not much you can do other than stay on top of updates.

Read more →

Stay ahead of threats with GOCO Security at gocosecurity.com.