GitHub Confirms Breach, 4K Internal Repos Stolen

darkreading

May 20, 2026 at 8:51 PM

Actively Exploited

Overview

GitHub has confirmed that it experienced a significant data breach resulting in the theft of approximately 4,000 internal repositories. The hacker group TeamPCP has claimed responsibility for the attack, raising concerns about the security of open source projects hosted on the platform. This incident affects not only GitHub but also the developers and organizations that rely on these repositories for their software projects. The stolen data could potentially expose sensitive code and vulnerabilities, which may lead to further exploitation. Users and companies utilizing GitHub should review their security practices and be vigilant about any unusual activity related to their accounts.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: 4,000 internal GitHub repositories
Action Required: Users should review their security practices and monitor their accounts for unusual activity.
Timeline: Newly disclosed

Original Article Summary

Open source software giant GitHub confirmed a data breach this week involving the theft of thousands of repos. One threat actor — TeamPCP — took credit.

Impact

4,000 internal GitHub repositories

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should review their security practices and monitor their accounts for unusual activity.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Data Breach.

Read Original Article

Related Coverage

CISA Security Leak

Schneier on Security

A contractor for the Cybersecurity & Infrastructure Security Agency (CISA) accidentally exposed sensitive credentials in a public GitHub repository. This leak included access details for several highly privileged AWS GovCloud accounts and internal CISA systems, along with documentation on how the agency builds and deploys software. Security experts have labeled this incident as one of the most serious data leaks involving government information in recent years. The exposure raises significant concerns about the security of sensitive government operations and the potential for misuse of the leaked credentials. It underscores the importance of maintaining strict access controls and oversight for contractors handling sensitive data.

May 22, 2026

Drupal: Critical SQL injection flaw now targeted in attacks

BleepingComputer

Drupal has issued a warning about a significant SQL injection vulnerability that is currently being targeted by hackers. This flaw, which was announced earlier in the week, poses a serious risk to websites running on the Drupal content management system. Attackers can exploit this vulnerability to gain unauthorized access to databases, potentially leading to data breaches or site compromises. Users and administrators of Drupal sites are urged to take immediate action to secure their systems, as the risk of exploitation is high. It is crucial for affected parties to stay vigilant and apply any available patches to mitigate this threat.

May 22, 2026

Ubiquiti patches three max severity UniFi OS vulnerabilities

BleepingComputer

Ubiquiti has rolled out security updates to address three high-severity vulnerabilities in its UniFi OS. These flaws can be exploited by remote attackers without needing any special permissions, which raises significant security concerns for users. The vulnerabilities could potentially allow unauthorized access to sensitive systems, putting networks at risk. Ubiquiti’s prompt action to patch these issues is crucial, as it helps protect users from potential exploitation. Companies and individuals using UniFi OS should ensure they apply the updates as soon as possible to safeguard their devices.

May 22, 2026

CISA’s new KEV nomination form opens reporting to vendors and researchers

Help Net Security

The Cybersecurity and Infrastructure Security Agency (CISA) has introduced a new nomination form that allows researchers, vendors, and industry partners to report known exploited vulnerabilities. This initiative aims to enhance collaboration between CISA and the cybersecurity community by providing a direct channel for submitting vulnerabilities for consideration in the Known Exploited Vulnerabilities (KEV) catalog. While the new form streamlines reporting, organizations can still use email to submit vulnerabilities if they prefer. This move is significant as it encourages more proactive engagement from the cybersecurity community, which is essential for identifying and mitigating threats more effectively.

May 22, 2026

TrendAI Patches Apex One Zero-Day Exploited in the Wild

SecurityWeek

TrendAI has addressed a serious vulnerability in its Apex One security software, identified as CVE-2026-34926. This flaw is a directory traversal issue that could be exploited by attackers to gain unauthorized access to files on the system. The vulnerability specifically affects the on-premise version of Apex One, which is used by various organizations for endpoint security. Given that this vulnerability has been exploited in the wild, it poses a significant risk to users who have not yet applied the necessary updates. Companies using Apex One should prioritize applying the latest patches to safeguard their systems against potential breaches.

May 22, 2026

Grafana Says Codebase and Other Data Stolen via TanStack Supply Chain Attack

SecurityWeek

Grafana recently reported that hackers accessed its GitHub repositories, stealing code and other sensitive data. This breach occurred due to a compromised token linked to the TanStack supply chain attack, which was not rotated in time to mitigate the threat. As a result, attackers gained unauthorized access to Grafana's internal resources. This incident raises concerns about the security of software development processes and the potential risks associated with supply chain vulnerabilities. Companies using Grafana's software should be vigilant and review their security practices to prevent similar attacks in the future.

May 22, 2026