GitHub Abuse Flaw Shows Why We Can’t Shrug Off Abuse Vulnerabilities in Security
Summary: A researcher found a GitHub abuse flaw that lets attackers create a repository issue with Markdown-formatted, official-looking lures, which GitHub then emails to victims from notifications@github.com, bypassing email security controls that trust the domain. GitHub's HackerOne response called it an abuse issue rather than a security vulnerability and pointed to its dedicated spam team, while the researcher cited figures showing 68% of breaches originate from human-element exploitations such as phishing.
What's compelling: The phishing email arrives from notifications@github.com, a sender your mail gateway is configured to trust because developers need those notifications to work - and GitHub has classified the mechanism as abuse, not a vulnerability, so no patch is coming.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026