🧰 git

The items that name it 40

• Artificial Intelligence (AI) in Cybersecurity, Part 30: Shannon – AI Pentester for Web Apps and APIs
  articleas tools2026-10-26It is written here as Git: used to clone the Juice Shop repository with --depth 1.
• eMudhra CA compromise: eight private keys, and one of them is 4
  articleas classification.technologies2026-10-22
• The OpenSourceMalware Show #25
  talkas affected products2026-10-15It is written here as Git (no built-in authentication or authorization; accepts any email address given to it).

  no built-in authentication or authorization; accepts any email address given to it

• My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale
  paperas classification.technologies2026-10-15
• GhostAction Attack Escalates By Targeting GitHub Users
  writeupas classification.technologies2026-10-09
• Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub
  paperas classification.technologies2026-10-08
• How to Investigate a GitHub Repo's Real History
  writeupas affected products2026-10-06It is written here as Git (CVE-2025-48384 via git clone --recursive).

  CVE-2025-48384 via git clone --recursive

• Top AI Coding Agent Security Resources — October 2026
  articleas classification.technologies2026-10-02
• https://github.com/praetorian-inc/gato
  toolas classification.technologies2026-10-02
• ​​Beyond source code: A path to the keys to the kingdom
  writeupas classification.technologies2026-09-29
• The OpenSourceMalware Show #20
  talkas classification.technologies2026-09-09
• GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, and Grok - Manifold Security
  writeupas classification.technologies2026-09-01
• The OpenSourceMalware Show #19
  talkas classification.technologies2026-08-28
• numasec
  repoas tools2026-08-27

  used to clone the numasec repository from GitHub for source builds

• Yet another RCE in Gogs, but it's fixed this time!
  writeupas classification.technologies2026-08-19
• How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
  writeupas classification.technologies2026-08-13
• Before the first prompt: Code execution paths in trusted coding-agent projects
  writeupas classification.technologies2026-08-03
• Kritt-ai/open-kritt
  repoas tools2026-08-02

  Required to clone the open-kritt repository

• SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
  writeupas classification.technologies2026-07-19
• SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts
  writeupas classification.technologies2026-07-19
• The OpenSourceMalware Show #13
  talkas classification.technologies2026-07-16
• Socket: npm v12 Ships With Install Scripts Off by Default
  articleas classification.technologies2026-07-15
• Cybersecurity Startup Publishes Infostealers to NPM
  writeupas classification.technologies2026-07-09
• Symlinks Are Still Scary (And Yes, You Can Commit Them to Git)
  articleas affected products2026-07-09

  Supports committing and recreating symlinks (file mode 120000); hardened in 2021-era CVEs against following symlinks to write outside the working tree/.git, but still vulnerable via CVE-2024-32002; on Windows leaves symlinks as plain text files unless core.symlinks is enabled.

• codfish/semantic-release-action GitHub Action has been compromised
  writeupas classification.technologies2026-07-01
• AI Security Briefing
  advisoryas classification.technologies2026-06-27
• Compromised Rust crate onering performs code exfiltration
  writeupas tools2026-06-10

  Version control tool queried by the malicious build script (git log, git diff) to gather commit metadata and the full diff of the most recent commit

• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeupas tools2026-06-01

  Suggested Git ref scan across all branches/tags to search for malicious code indicators before deletion

• HackTricks-wiki/hacktricks
  repoas classification.technologies2026-05-31
• From Cookies to Keys: The Threat of Session Hijacking
  articleas affected products2026-05-26It is written here as Git (.git-credentials, full .git folders).

  Harvested; full repo+history $100+, credentials $50-$300.

• Hack Skills
  repoas tools2026-05-13

  Used to clone the hack-skills repository for local use as a knowledge base

• matty69v/Bug-Bounty-Agents
  repoas tools2026-05-12

  Required for cloning and updating the repository

• Titus by Praetorian
  repoas classification.technologies2026-05-10
• GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog
  writeupas classification.technologies2026-04-28
• Security in the LLM Age - Greg Kroah-Hartman
  videoas technologies
• Sandyaa — open-source autonomous code auditor that proves bugs with working exploit PoCs
  repoas tools

  used by Sandyaa to clone remote targets; auto-installed on macOS/Linux if missing

• Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
  articleas tools

  Version control system whose core.fsmonitor configuration setting is the abused mechanism

• Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands
  articleas classification.technologies
• Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected
  writeupas tools

  Version control tool whose clone/checkout/fetch behavior is exploited to bypass SHA pinning

• capitalone/VulnHunter
  repoas classification.technologies

In every workspace you can read 93