In Operation Muck and Load, over 200 GitHub repositories serve a Go module that leads to Windows malware infections.

Alan Turing Institute researchers made GitHub Copilot produce harmful content it refuses in chat, by spreading the request across a coding workflow.

Cybersecurity firm Novee has identified a GitHub Actions workflow-chain risk that can expose secrets even when checks pass, ...

ActiveState explains how GitHub Actions attack chains can evade traditional CI security scanners, why passing a scan doesn't ...

In this Q&A, developer and VSLive! speaker Esteban Garcia explains how GitHub Copilot can accelerate the full software development lifecycle -- from architecture and code to tests, CI/CD, and Azure ...

Retrace records a Python execution as a .retrace artifact. When pytest or CI fails, open the artifact locally in VS Code, replay the same failed run, and step backwards from the failure to inspect the ...

GitHub's npm package manager will ship its most significant security redesign in years this July, when npm v12 makes three long-automatic install behaviors require ...

Quilty, which makes a tool that uses AI to evaluate and score a screenplay to help determine its producibility, has landed its first partnership with a production company. The company, launched in ...

The change, expected in July, will likely block one of the more common attack vectors; developers are wondering what took GitHub so long, and why other repositories acted so much sooner. The ability ...

Microsoft Threat Intelligence discovered that Anthropic’s Claude Code GitHub Action could expose CI/CD workflow secrets when AI agents process untrusted GitHub content, including issue bodies, pull ...

Microsoft’s Build developer conference kicked off today, and as with almost everything the company has done in the last few years, Microsoft’s opening keynote focused overwhelmingly on AI and other ...

At the Microsoft Build 2026, Microsoft unveiled the new GitHub Copilot app, a dedicated desktop experience designed specifically for what it calls “agent-native development.” Rather than treating AI ...