GitHub ‘Verified’ Commits Can Be Rewritten Into New Hashes Without Breaking Signatures
New research from Carnegie Mellon University PhD student Jacob Ginesin, also a cryptographic auditor at Cure53, reveals that GitHub's 'Verified' commit badge…
Tag: trivy-action
trivy-action: GitHub Action for Vulnerability Scanning
trivy-action is a GitHub Action for running Trivy vulnerability scans. It was compromised in a 2026 tag hijack attack, which this research…