Curated security research, vulnerabilities, advisories and tools for practitioners.

#github

Security coverage tagged github.

1.

CVE-2026-84636: Apple iOS/macOS SCDynamicStore Wi-Fi SSID Info Disclosure PoC

vulnerability | Medium | 2026-10-27 11:20 | CVE-2026-84636 | github.com | Original ↗ | .md | #data-exposure | #github | #red-team

2.

php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP

vulnerability | Critical | 2026-10-24 05:43 | github.com | Original ↗ | .md | #rce | #zero-day | #github

3.

php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations

research | Actively exploited | 2026-10-22 10:36 | CVE-2026-109618 | github.com | Original ↗ | .md | #active-exploitation | #rce | #github

4.

Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis

research | 2026-10-25 21:48 | github.com | Original ↗ | .md | #bug-bounty | #rce | #web3

5.

CVE-2026-106173: Fortinet FortiSIEM gRPC Path Traversal to Pre-Auth RCE PoC

vulnerability | Critical | 2026-10-20 12:43 | CVE-2026-106173 | github.com | Original ↗ | .md | #ai-security | #github | #authentication

6.

node2shell-scanner: High-Fidelity Remote Detection Tool for Node.js Brotli OOB Write (CVE-2026-111497)

tool | 2026-10-25 04:24 | CVE-2026-111497 | github.com | Original ↗ | .md | #rce | #github | #red-team

7.

ipatool (DrWhax Fork): App Store CLI with Native FairPlay Decryption Pipeline & MCP Integration

tool | 2026-10-25 00:22 | github.com | Original ↗ | .md | #ai-security | #github | #red-team

8.

Peach: Single-user, Local-first Personal Media Library and Management System

tool | 2026-10-24 06:06 | github.com | Original ↗ | .md | #cloud | #open-source | #github

9.

gpu-unlock-ada: Linux Kernel Module Unlocking Tensor Core Limits on RTX 40-Series GPUs

tool | 2026-10-23 21:00 | github.com | Original ↗ | .md | #ai-security | #github | #hardware-security

10.

Apple Private Cloud Compute (PCC) Security Source Code and Research Tools

tool | 2026-10-23 16:38 | github.com | Original ↗ | .md | #ai-security | #cloud | #github

11.

Assetnote Releases php2shell-scanner: High-Fidelity Scanner for CVE-2026-109618 & CVE-2026-109619

tool | 2026-10-22 03:53 | github.com | Original ↗ | .md | #rce | #github | #php

12.

SuperGhidra: High-Performance Python Suite for Accelerated Ghidra Reverse Engineering

tool | 2026-10-20 08:22 | github.com | Original ↗ | .md | #ai-security | #github | #red-team

13.

KillerLand: Weaponized BYOVD Process Killer Collection Bypassing PPL & EDR Protections

tool | 2026-10-18 05:49 | github.com | Original ↗ | .md | #ai-security | #github | #red-team

14.

The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub

research | 2026-09-29 12:42 | wiz.io | Original ↗ | .md | #cloud | #cloud-security | #aws

15.

[CVE-2026-94545] Remote Code Execution in next/og ImageResponse

advisory | Critical | 2026-09-22 17:03 | CVE-2026-94545 | github.com | Original ↗ | .md | #rce | #github | #poc

16.

Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps

blog | 2026-08-27 12:00 | wiz.io | Original ↗ | .md | #cloud | #supply-chain | #gitlab

17.

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

blog | 2026-08-13 15:04 | wiz.io | Original ↗ | .md | #cloud | #incident-response | #github

18.

Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain

blog | 2026-08-13 13:48 | wiz.io | Original ↗ | .md | #ai-security | #supply-chain | #appsec

19.

[CVE-2024-6100] CyberKimi Benchmarks: Autonomous Exploitation Traces & Evidence

research | 2026-08-09 15:35 | CVE-2024-6100 | github.com | Original ↗ | .md | #ai-security | #rce | #benchmark

20.

Rickrolling the World Cup, unleashing AI across Google, 0-click stored XSS on Next.js – ethical hacker roundup

blog | 2026-07-21 08:36 | yeswehack.com | Original ↗ | .md | #ai-security | #vulnerability-research | #github

21.

And another one. GitHub ships break-glass credential revocation

blog | 2026-07-01 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #incident-response | #credential-security

22.

VIPER: AI-Powered Adversary Simulation & Multi-Platform Red Teaming Platform

tool | 2026-05-31 08:45 | github.com | Original ↗ | .md | #ai-security | #github | #red-team

23.

How Borg pushes findings to Linear, Jira, and GitHub automatically

blog | 2026-06-01 00:00 | borghq.io | Original ↗ | .md | #cloud | #vulnerability-management | #remediation

24.

GitHub's VS Code Extension Breach Was a Developer-Device Failure, Not a GitHub-Only Story

blog | 2026-05-20 00:00 | bugbunny.ai | Original ↗ | .md | #ai-security | #supply-chain | #developer-security

25.

How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account

research | 2026-05-14 00:00 | hunt.io | Original ↗ | .md | #supply-chain | #threat-intelligence | #malware

26.

Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)

vulnerability | 2026-04-28 15:30 | CVE-2026-3854 | wiz.io | Original ↗ | .md | #rce | #vulnerability-research | #github

27.

Meet Repro-Bot, our GitHub issue triage agent

blog | 2026-04-10 00:00 | metabase.com | Original ↗ | .md | #ai-security | #open-source | #automation

28.

CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild

blog | 2026-01-15 15:00 | wiz.io | Original ↗ | .md | #cloud | #supply-chain | #aws

29.

Code to Cloud Attacks: From Github PAT to Cloud Control Plane

blog | 2025-12-09 13:00 | wiz.io | Original ↗ | .md | #cloud | #supply-chain | #cloud-security

30.

Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets

incident | 2025-11-24 10:27 | wiz.io | Original ↗ | .md | #supply-chain | #secrets | #malware