Post · bonfire.mavnn.eu

@[email protected] · 19 hours ago

info on the github breach appears to only be available on xitter 🙄 , I fished it out for you.

post from github on May 20th, 2026:

We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.

Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far. — post from github on May 20th, 2026: We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately. Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.

0

tatiana :witches_town:

@[email protected] · 19 hours ago

@0xabad1dea wth is 'directionally consistent'

@[email protected] · 19 hours ago

@tati operational speak for "looks like it's probably correct"

@[email protected] · 19 hours ago

@0xabad1dea here’s a xcancel link: https://xcancel.com/i/status/2056949168208552080

GitHub (@github)

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.