News World That's Worth

GitHub CTO Reveals Surge in AI Code Commits Led to 7-Hour Outage, Accelerates Azure Migration GitHub has published a detailed technical post-mortem addressing its 7-hour major outage on August 17, 2026 . Expanding on initial reports that pointed to an Istio service mesh misconfiguration, GitHub Chief Technology Officer Vlad Fedorov clarified that the root cause was a systemic capacity failure triggered by unprecedented global traffic spikes. Fedorov explained that the incident was a direct continuation of infrastructure challenges highlighted in April. On August 17, incoming traffic reached record-breaking peaks that overwhelmed compute capacity in GitHub’s primary Central US data center region , initiating a cascading failure across interdependent microservices. Restoring the platform proved exceptionally difficult due to tightly coupled architectural dependencies: Cascading Outages: Core services collapsed sequentially as shared routing layers reached resource exhaustion. Thunderi...

GitHub Outage Breakdown: Istio Limits, Connection Loops, and VS Code Copilot Bug Cause 7-Hour Downtime GitHub experienced a major cascading outage lasting over seven hours, leaving millions of developers unable to push code or access repositories. Following the incident, the engineering team published a preliminary post-mortem detailing how a convergence of unexpected traffic spikes, misconfigurations, and a client-side retry bug in VS Code triggered the prolonged disruption. The incident originated in the Central US region when an influx of user traffic coincided with a hidden configuration bottleneck in GitHub's internal Istio service mesh. When the auto-scaling mechanism triggered, it failed to account for Istio sidecar proxy limits. As new instances scaled up, sidecar allocation hit hard system caps, causing the primary HAProxy load balancers to crash sequentially until the entire regional gateway went offline. The outage was severely amplified by aggressive internal and e...

GitHub Rolls Out Stacked Pull Requests Preview to Streamline Complex Code Reviews GitHub has officially introduced its Stacked Pull Requests feature in public preview, enabling developers to split large codebases or multi-stage features into a series of smaller, sequential Pull Requests (PRs). This approach allows reviewers to examine code changes incrementally rather than processing massive, monolithic PRs at once, while giving project maintainers the flexibility to merge individual parts of a stack independently. The feature spent several months in a closed testing phase with select open-source projects and enterprise teams. Developers working on high-profile projects like Next.js were early adopters, noting that stacking made reviewing large architectural updates significantly more manageable. Despite the workflow improvements, GitHub acknowledged that the preview version still has minor edge cases and bugs. For instance, if an earlier PR in a stack is merged using a squash merge...

Ex-GitHub CEO Thomas Dohmke Launches 'Entire': A Decentralized Git Solution Built to Withstand the AI Agent Influx In a major disruptive move within the developer ecosystem, Thomas Dohmke  who served as the CEO of GitHub from 2021 to 2025 has departed the Microsoft-owned platform to launch a trailblazing startup named Entire . Marketed as a next-generation development platform tailored exclusively for the era of autonomous AI agents, Entire has officially unveiled its inaugural core product: a Distributed Git Hosting infrastructure engineered to cure the vulnerabilities of centralized version control systems. According to Entire, while Git was architected fundamentally as a distributed system, modern industry practices have forced it into a rigid, highly centralized model where a master repository acts as a single point of truth. Developers clone small fractions of code, make swift modifications, and push changes back to the central server. Entire argues that this conventional...

Supply Chain Attack: 32 Red Hat npm Packages Infected with 'Shai-Hulud' Malware via GitHub Actions Exploit Cloud security firm Wiz has uncovered a sophisticated software supply chain attack targeting Red Hat . Investigators revealed that 32 malicious npm packages under Red Hat’s official @redhat-cloud-services scope had been compromised and injected with info-stealing malware. Red Hat’s security team has since moved swiftly to unpublish and remove nearly all affected packages from the public npm registry. The Payload: 'Shai-Hulud' Targets Cloud API Credentials The embedded malware family has been identified as Shai-Hulud , a notorious strain engineered specifically for credential harvesting. Once an infected npm package is bundled into a developer's project or an enterprise application, the malware activates to scan the local environment, targeting high-value cloud API keys, including access tokens for Google Cloud Platform (GCP) and Microsoft Azure . The Attack...

GitHub Hit by Multi-Tier Supply Chain Attack: Hacker Group Compromises 3,800 Internal Repositories via Rogue VS Code Extension In a chilling reminder of the volatility within modern software development pipelines, GitHub has confirmed a security breach affecting its internal infrastructure. A threat actor has successfully infiltrated and exfiltrated data from approximately 3,800 internal repositories . The incident highlights an incredibly sophisticated, multi-tiered Supply Chain Attack that weaponized trusted, mainstream development tools against GitHub’s own engineers. The Three-Tier Poisoning Chain Breakdown The anatomy of this attack reveals a meticulously executed domino effect spanning three distinct layers of the software ecosystem: The Root Infiltration (The TanStack NPM Compromise): The breach originated at the foundational package level, where malicious actors managed to poison a widely used TanStack package hosted on the public npm registry. The Intermediate Carrier (Nx...

The Worm Returns: "Mini Shai-Hulud" Malware Targets Premier Tech Packages in Massive Supply Chain Attack Cybersecurity firm Socket has sounded the alarm after detecting a resurgence of the "Mini Shai-Hulud" malware across the npm and PyPI ecosystems. Named after the giant sandworms of Dune , this malware first gained notoriety in late 2025. Following a series of high-profile breaches in late April 2026 involving SAP, Intercom, and Lightning, the attackers have now set their sights on a new wave of essential developer tools. High-Profile Targets Identified The latest wave of infected packages includes critical software from several industry leaders: TanStack: Popular web development suite (npm) UiPath: Robotic Process Automation (npm) Mistral: Large Language Model (LLM) library (PyPI) Guardrails AI: AI safety framework (PyPI) OpenSearch: Search and analytics suite (npm) Squawk: Database linter (npm) Inside the Attack: Cache Poisoning on GitHub Actions This...

GitHub CTO Issues Apology After Multiple Outages, Citing "The AI-Driven Coding Explosion" Vladimir Fedorov , Chief Technology Officer at GitHub , has formally apologized to the developer community following a series of service instabilities that saw the platform suffer two major outages within a single week. These incidents have raised significant concerns among top-tier developers, notably leading to the creator of Ghostty announcing a migration away from the platform. The Anatomy of the Outages The platform faced two distinct technical failures: April 23: A failure in the merge queue system disrupted repositories and hampered merge requests. April 27: A major search functionality outage triggered by a crash in the Elasticsearch infrastructure. The "AI Impact": A 30x Capacity Challenge Fedorov explained that the root cause lies in a fundamental shift in how software is developed. The rise of AI-powered coding assistants has led to an unprecedented surge in pl...

Mitchell Hashimoto Departs GitHub : Why the Creator of Ghostty is Moving Away Mitchell Hashimoto , the renowned software developer and creator of the popular open-source terminal emulator Ghostty , has announced that he will be migrating the project’s source code away from GitHub. This marks a significant departure for a developer who has been an integral part of the GitHub community since its earliest days. The "Breaking Point" Hashimoto, who joined GitHub in February 2008 as user #1299 , has been a daily active user for nearly two decades. However, he cites a growing frustration with GitHub’s reliability: Unacceptable Downtime: Hashimoto noted that recent service outages have become too frequent, with many lasting for extended periods. Operational Friction: For a project like Ghostty, which demands serious, consistent maintenance, these outages have become a major bottleneck. Hashimoto stated that GitHub no longer feels like a reliable "home" for mission-critica...

  GitHub Copilot Overhauls Pricing: Moving to a Token-Based "Credit" System Following last week’s surprise announcement regarding a temporary freeze on new GitHub Copilot customer onboarding, GitHub has officially unveiled a complete overhaul of its AI pricing model. The platform is moving away from its previous "Request-Based" system in favor of a more granular, usage-based model powered by GitHub AI Credits . From PRUs to Token-Based Credits Previously, GitHub Copilot utilized Premium Request Units (PRUs) , which applied different multipliers based on the model used. However, this structure had a significant flaw: simple conversational queries and complex, long-running coding tasks were often treated as a single "request." While this made Copilot an attractive, budget-friendly alternative to token-based competitors, it created scaling challenges for GitHub’s backend. Starting June 1, 2026 , the new system will: Account for Every Token: Usage will be me...

Anthropic Scales Back DMCA Takedowns: A Tactical Retreat After 8,100 GitHub Repositories Were Blocked Following the accidental leak of Claude Code source code via an NPM package, Anthropic initiated a massive legal response under the Digital Millennium Copyright Act (DMCA) . The company’s initial filing targeted the original source, a repository under the user nirholas/claude-code , along with all subsequent forks that had proliferated across the platform. The Great GitHub Purge Anthropic’s broad enforcement led GitHub to preemptively disable approximately 8,100 repositories . This "carpet-bombing" approach to copyright protection sparked significant discussion within the developer community, as it affected thousands of users who had mirrored or forked the code during the initial leak window. The Tactical Reversal In a surprising turn of events, Anthropic has since requested that GitHub withdraw the majority of these takedowns . The company has now limited its legal claim t...

GitHub Silences Copilot "Spammy" Pull Request Footers After Developer Backlash GitHub has officially disabled a controversial feature that appended promotional suggestions to the end of GitHub Copilot pull request (PR) messages. The decision comes after a wave of complaints from the developer community, who reported seeing tens of thousands of automated "spam" messages cluttering their workflows. The Escalation of Automated Messaging Martin Woodward , Vice President of Developer Relations at GitHub, confirmed that the feature has been deactivated. While Copilot has included footer suggestions for some time, the issue escalated recently. Previously, these messages only appeared in PRs fully authored by Copilot. However, a recent update caused Copilot to inject these footers into every pull request where the AI was mentioned, leading to an exponential increase in automated noise. Indirect Advertising Concerns The backlash was further intensified by the content of t...

  OpenAI Rumored to Develop "GitHub Rival" as Relationship with Microsoft Fractures According to a report from The Information , OpenAI is reportedly developing its own internal source code management system to rival GitHub . The decision stems from growing frustrations within OpenAI regarding GitHub’s recent performance issues and frequent service outages, which have reportedly hampered development workflows. From Internal Tool to Potential Market Competitor While the software does not yet have an official name, it is expected to remain in development for several more months. Sources suggest that while the project was initially intended solely for internal use , there have been high-level discussions within OpenAI about eventually offering the platform as a service to external customers . Such a move would position OpenAI as a direct competitor in the version control market. Strained Ties: The Microsoft-AWS Friction The move away from GitHub is seen as another sign of the d...

Mitchell Hashimoto’s "Vouch": A New Human-Centric Filter for the AI-Code Era. Mitchell Hashimoto , the renowned developer behind the popular open-source terminal emulator Ghostty , has announced a new contribution tier called "Vouch" This system is designed to help maintainers identify trusted contributors and filter through the increasing noise of external pull requests. How the Vouch System Works The Vouch system functions as a decentralized reputation database stored within the project as a VOUCHED.td file. While the file can be edited manually, its primary automation relies on GitHub Actions that monitor comments in GitHub issues.

cURL Scraps Bug Bounty Program: Creator Cites AI-Generated "Noise" as Primary Reason cURL the ubiquitous command-line tool for transferring data, has officially announced the termination of its vulnerability reporting program on HackerOne . The project will accept its final bug reports through the platform on January 31, 2026 . Moving forward, security researchers must report issues directly via the project's GitHub repository. The "AI Fatigue" Factor

NSA open page 32 of the code released to the public. Most security programs for organizations, projects, archive logs. Some open source projects for a long time, such as SELinux, SIMP released since 2015, or Nifi. Other interesting projects such as •GoSecure: VPN for enterprise. Running through Raspberry Pi makes use easy. •CASA: CA in the machine monitoring system throughout the organization whether or not foreign CA. •SIMON AND SPECK: a cryptographic system blocking (block cipher) low resource usage for IoT. Most of the drop code any use because it is a work created by federal personnel.