GitHub Posts About a Security Breach

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately. 2/ Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far. 3/ We moved quickly to reduce risk. Critical secrets were rotated yesterday and overnight with the highest-impact credentials prioritized first. 4/ We continue to analyze logs, validate secret rotation, and monitor for any follow-on activity. We will take additional action as the investigation warrants. 5/ We will publish a fuller report once the investigation is complete.

A screenshot shows five consecutive GitHub posts describing an investigation into unauthorized access, a poisoned VS Code extension, stolen repositories, and rotated secrets. The joke is the deadpan corporate crisis-update thread, which can be shared as an absurd reaction to suddenly serious or alarming news. EN: A screenshot shows five consecutive GitHub posts describing an investigation into unauthorized access, a poisoned VS Code extension, stolen repositories, and rotated secrets. The joke is the deadpan corporate crisis-update thread, which can be shared as an absurd reaction to suddenly serious or alarming news.

• @pokupkabitka / 56120 2026-05-20