Experimental News Clipping Site

Tag: GitHub Action

  • Hacker News: Show HN: Formal Verification for Machine Learning Models Using Lean 4

    —

    by

    Kurt Seifried
    in

    Source URL: https://github.com/fraware/leanverifier Source: Hacker News Title: Show HN: Formal Verification for Machine Learning Models Using Lean 4 Feedly Summary: Comments AI Summary and Description: Yes Summary: The project focuses on the formal verification of machine learning models using the Lean 4 framework, targeting aspects like robustness, fairness, and interpretability. This framework is particularly relevant…

  • Schneier on Security: Critical GitHub Attack

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.schneier.com/blog/archives/2025/03/critical-github-attack.html Source: Schneier on Security Title: Critical GitHub Attack Feedly Summary: This is serious: A sophisticated cascading supply chain attack has compromised multiple GitHub Actions, exposing critical CI/CD secrets across tens of thousands of repositories. The attack, which originally targeted the widely used “tj-actions/changed-files” utility, is now believed to have originated from an…

  • Alerts: CISA Adds Two Known Exploited Vulnerabilities to Catalog

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/03/18/cisa-adds-two-known-exploited-vulnerabilities-catalog Source: Alerts Title: CISA Adds Two Known Exploited Vulnerabilities to Catalog Feedly Summary: CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability CVE-2025-30066 tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability These types of vulnerabilities are frequent…

  • Alerts: Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066 Source: Alerts Title: Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066 Feedly Summary: A popular third-party GitHub Action, tj-actions/changed-files (tracked as CVE-2025-30066), was compromised. This GitHub Action is designed to detect which files have changed in a pull request or commit. The supply chain compromise allows for information disclosure of secrets including,…

  • The Register: Google acquisition target Wiz links fresh supply chain attack to 23K pwned GitHub repos

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/03/18/wiz_github_supply_chain/ Source: The Register Title: Google acquisition target Wiz links fresh supply chain attack to 23K pwned GitHub repos Feedly Summary: Ad giant’s cloudy arm to pay $30B in security shop deal Wiz security researchers think they’ve found the root cause of the GitHub supply chain attack that unfolded over the weekend, and…

  • Hacker News: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised Source: Hacker News Title: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos Feedly Summary: Comments AI Summary and Description: Yes Summary: A critical security incident has been identified involving the tj-actions/changed-files GitHub Action, which has been compromised to leak sensitive CI/CD secrets. This incident underscores the urgency for security and…

  • Hacker News: Popular GitHub Action tj-actions/changed-files is compromised

    —

    by

    Kurt Seifried
    in

    Source URL: https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/ Source: Hacker News Title: Popular GitHub Action tj-actions/changed-files is compromised Feedly Summary: Comments AI Summary and Description: Yes Summary: Semgrep is a security tool that facilitates collaboration between security teams and developers, promoting a shift-left approach in software development. It emphasizes the importance of delivering actionable security insights without disrupting the development…