Spyware via ads, kernel bugs on ARM, and GitHub's automation playbook

<p>In the fast-paced world of modern software development, continuous integration and continuous delivery (CI/CD) pipelines are the backbone of efficient workflows. GitHub

This week, the shadows moved faster than the patches. While most teams were still triaging last month’s alerts, attackers had already turned control panels into kill switches,

<p>In March, we experienced four incidents that resulted in degraded performance across GitHub services.</p> <p>The post <a

<p>If you use GitHub's merge queue and had a rough week around April 23rd, 2026, you were not imagining things. Your code actually disappeared. Not because of a bad commit, not

<p>In July, we experienced eight incidents that resulted in degraded performance across GitHub services.</p> <p>The post <a

<p>In May, we experienced nine incidents that resulted in degraded performance across GitHub services.</p> <p>The post <a

It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and

<p>GitHub malware advisories no longer stop at npm. Here's how we wired OpenSSF's malicious-packages data into the Advisory Database, and why we built the pipeline paranoid.</p>