While not a bug or vulnerability, Commit Stomping exploits Git’s flexibility to rewrite the timeline of code changes, posing significant risks to software supply chain security, incident response, and code audits. Inspired by “timestomping,” a tactic used in offensive cyber operations to alter file metadata, Commit Stomping involves falsifying the timestamps of Git commits to mislead observers about when changes were made. A lesser-known feature of Git, Dubbed “Commit Stomping,” this technique allows users to manipulate commit timestamps, potentially disguising malicious or unauthorized changes in a repository’s history. As software becomes a critical part of the security perimeter, treating Git’s commit history as immutable is no longer safe. In a world where code tells a story, Commit Stomping lets bad actors rewrite the plot. Commit Stomping isn’t a traditional security flaw there’s no patch coming.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 16 May 2025 06:24:57 +0000