Investigation update: GitHub Enterprise Server signing key rotation
GitHub Enterprise Server customers need to take immediate action.
Author
AW
Alexis Wales
6 articles by Alexis Wales.
6 articles by Alexis Wales.
GitHub Enterprise Server customers need to take immediate action.
How we validated, fixed, and investigated a critical vulnerability in under two hours, and confirmed no exploitation.
Treating exposures as full and complete can help you respond more effectively to focus on what truly matters: securing systems, protecting sensitive data, and maintaining the trust of stakeholders.
GitHub has identified a low-volume social engineering campaign that targets the personal accounts of employees of technology firms. No GitHub or npm systems were compromised in this campaign. We’re publishing this blog post as a warning for our customers to prevent exploitation by this threat actor.
Update to the latest version of Desktop and previous version of Atom before February 2.
On September 16, GitHub Security learned that threat actors were targeting GitHub users with a phishing campaign by impersonating CircleCI to harvest user credentials and two-factor codes. While GitHub itself was not affected, the campaign has impacted many victim organizations.