There is no real fix to the security issues recently found in GitHub and other similar software
Summary: Truffle Security published findings that deleted forks in GitHub can still be accessed, allowing a malicious actor with a project key to view deleted forks and versions of any project on GitHub. GitHub told The Register this is expected and documented behavior inherent to how fork networks work, and there is no patch or fix, with the issue untested in GitLab or Bitbucket.
What's compelling: Truffle Security says a major tech company leaked a private key for an employee GitHub account and, despite deleting the repo, the key was still exposed and accessed by potentially malicious users - so any key you have ever published on GitHub should be assumed copied, rotated, and checked for misuse.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2018-0824
- Related
- CVE-2018-0824: Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Aug 05, 2024ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026