GitHub is investigating unauthorized access to their internal repositories

You gotta do what you gotta do \_(ツ)_/

Pre-AI, having access to code (e.g. if it leaked or even just open source) could allow hackers to more easily discover exploits. I wonder if that threat is now much more severe in the age of AI. Thankfully GitHub have probably themselves run their code through many AI security tools so any vulnerabilities would have already been found and patched. Hopefully.

directionally, how bad is this ?

It's certainly not the right platform. It'd be one thing if they had any official communication on the matter anywhere else. Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement.

They announced this exclusively on X.com, which ranks barely above Pinterest in terms of usage. That's below Reddit, Snapchat, WeChat, and Instagram, and requires a user account to view profiles and posts. And that's ignoring all the reasons X is a divisive platform with an extreme political bent.

GitHub chose not to announce this on any other social media either (BlueSky, Facebook, TikTok, YouTube, LinkedIn, or Mastodon, as of this posting, and with no emails sent on the matter.)

It's been pretty common in the past for tech companies to announce outages and quick updates about them on twitter for decades. I'm sure their status page etc will be updated soon, but it's historically been the fastest way to get things out to the wider audience whilst bypassing the "official mail out" review by marketing etc.

Even if it's a wingnut dense place, there's good arguments for using a channel independent of your infra in a case like this. You (or Github themselves) don't know if their status page is pwned.

They should send messages directly to their customers as a first step in addition to posting an official article on their site. That’s the minimum. If they haven’t done that then it is hard to defend.

Beyond that, Twitter is the de facto default dissemination vehicle, due to its reach. Even if people are not on Twitter, they are likely to see things from people that are on Twitter.

I mean if you are going to use AI which was trained on code of statistically mediocre average at the best, have outages and major incidents every few days, why not go wild and start publishing incidents to twitter too? It checks out with the rest of the stuff.

It’s a very popular messaging platform for tech enthusiasts.

Probably the best option after sending a mass email when customers need to take action. The status page is for reliability issues impacting end users & the blog is for in-depth analysis.

watch it turn out to be that their twitter account is what was hacked, and github.com is actually fine

Are you from 2015? Companies have been announcing stuff on Twitter for a decade, and the rest of social media has been regurgitating Twitter posts for almost as long. Newspapers routinely quote Twitter. All that happened before they even renamed it to X.

I’m not saying it’s a good idea. I am saying it somehow became the single source of truth for the Internet with all that entails.

I don't see why this wouldn't fit on status.github.com.

Social media posts were literally called "status updates" at some point.

As a stock listed company is GitHub or Microsoft not required to disclose such security breaches to their shareholders? As in a stock market communication?

My understanding is that when it's something that requires user action they'd directly send comms to customers.

It reminds me of the famous "mistakes were made" Nixon quote.

"We are investigating unauthorized access" sounds much better than "we've been hacked"

> For a Fortune 100, to go out of your way to spook investors is the least desirable approach.

The company that had 40 million Azure servers compromised? This is a drop in the bucket, the investors clearly do not care about this.

https://www.microsoft.com/en-us/security/blog/2026/05/18/sto...

Letting people know promptly is also the right thing to do and probably mandated by (at least some) customer contracts. You can't tell just some people; it would leak anyway.

Part of this is likely driven by regulations. Github has plenty of clients that fall under DORA, NIS2 or both.

I don't remember the exact wording about what qualifies as "incident" or "major incident" but the TL;DR is that the regulated entities are required to notify their regulators of impactful supplier incidents within 24h with initial information and within 72h with more complete details.

Which in turn means that Github will have signed contracts that bind them to accommodating timelines.

The only way to 'harden your github actions' is to not use github actions.

Thanks for making me aware of zizmor, just ran and fixed all issues on our core repos.

Disabling vscode/cursor extensions auto-updates also makes sense

You also need to make sure you take care using PR titles and descriptions in your GHA because if they contain `text` it *may be executed lmfao.

edited: not "will", may depending on your GHA

This should be the defacto for all X links. For users who aren't signed in, X is such a hostile website you can't see anything.

I guess it's hostile to signed in users in a different way.

Join the club! I did as soon as the Microsoft acquisition realizing this would be only a matter of time… with more projects (finally) leaving that ecosystem, I might finally be able to delete my last account with Microsoft.

GitHub is like democracy - the least worst forge

If that’s true and they do intend on shredding their copy on sale, what stops GitHub from buying it back themselves? (through a proxy, obv)

Self hosted gitea for many years with ~25 devs. Yes, it's essentially a FOSS carbon copy of GitHub. CI/CD is also intercompatible, uses the same syntax and pulls the original GitHub Actions packages. Now with the Forgejo split, I would prefer Forgejo, as it has way more steam behind it with Codeberg and Blender as the big use-cases.

I prefer Forgejo, which is a Gitea fork. Forgejo is what runs Codeberg if I understand correctly.

I think AI has helped to a degree. I think a lot of people have known about massive gaps in security, but it's been a sort of "why would I?" and a gap that didn't feel worth hopping for attackers.

The gap is smaller now.

I've been talking about package worms for... fuck, a decade. Insane. I've even thought about publishing one to prove a point but, well, it's illegal obviously. And ethically questionable.

Someone just vibecoded up what we've all known was possible for a long, long time. Just like a lot of other vibe coded projects.

I remember talking to a malware author a long time ago and I think this would have been exactly what he would have loved. He liked building custom C2 protocols, tiny malware, etc, but when we discussed a particular idea for owning massive amounts of infrastructure his response was basically "that's a lot of effort to get a krebs article and FBI attention". Now it's not so much effort!

Also coincides with the time I started seeing Juniors installing "recommended extensions" into GitHub-hosted Visual Studio environments.. because there was a popup that helpfully suggested doing so, based on the programming languages used in the checked out repository.

Do you mean because more people are vibe coding, trusting the models' output, and putting code directly into production, so there are more security vulnerabilities created?

Or because there are more source code scanners which end up finding more vulnerabilities?

It's more likely that it isn't coincidental at all: software development-oriented LLMs became a lot better towards the end of 2025, and so there's a non-zero chance that people are using them to find new security exploits.

(People are not sleeping on this and it is not something people have failed to notice. I don't use LLMs at all and even I have noticed it - largely because there is approximately nobody that isn't talking about it.)

I heard an engineer at Anthropic was submitting 150 PRs per day. That's one PR every 5 to 10 minutes, so you can guess the level of review and quality control involved.

You know how Windows used to get a majority of the malware due to market share?

Now the market share is all the AI agent users.

I think it's more about the popularity than the capability. The chances you might accidentally put a Github access token into an undesired security context goes up dramatically when you actually create and use one on a regular basis. The developers at GH are certainly using these tools just like the rest of us.

Microsoft owned so many a CYA to explain why the liability insurance goes up to investors?

Before 2026 I hosted client code on GitHub, now it feels suboptimal, code is both an intellectual property asset and security risk. Especially if the company is software based, self-hosting your code just has a much better risk profile for almost no cost.

It's also one of those things that warms your team up and gets them ready for actual work, a team that has to self host their git and other infra, like self-hosting DNS servers with bind, will have a much better work ethic than engineers who click buttons on a SaaS and conflate their role as users of a system instead of admins of one.

Additionally, using github actions, and relying on Pull Requests (Tm) (R) (C) has always been (useful) vendor lock in (and a security risk in case of GH Actions). It wasn't enough to lock down a choice, but it tilts the balance in favour of less dependencies, which with the increase of CVEs and supply chain vulns, seems to be the name of the game for this new era. Build it in house, ignore the dogma.