Continue reading the full briefing.
Open the original NIST National Vulnerability Database record
Tame Dependabot: Group your updates, slow the cadence, keep security fast
Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project. The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog.
Why it matters: GitHub Security Blog participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.
What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.
Operational focus: Identify whether untrusted repository content can reach privileged runners, tokens, or deployment tools.
Disrupting supply chain attacks on npm and GitHub Actions
Explore the changes we've shipped across npm and GitHub Actions over the past few months to disrupt supply chain attack techniques and limit their impact. The post Disrupting supply chain attacks on npm and GitHub Actions appeared first on The GitHub Blog.
Why it matters: GitHub Security Blog participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.
What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.
Operational focus: Check dependency reachability and fixed versions before blocking or approving a release.
GitHub restructures public and VIP bug bounty payouts
GitHub says reports submitted from July 27 use a new static public payout table, while qualified VIP researchers receive higher rates and closer program access.
Why it matters: GitHub Bug Bounty Program participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.
What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.
Operational focus: Reduce persistent credentials and keep build jobs isolated from production management paths.
CVE-2026-67427: Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
## Summary The capability policy denies the `env.get` and `env.load_dotenv` modules by default, with the stated reason that they read arbitrary host environment variables (API keys, DSNs) and are a secret-exfil risk. But the workflow engine's variable resolver expands `${env.VAR}` for any environment variable with no allowlist and no policy check, so the exact capability the denylist blocks…
Why it matters: GitHub Advisory Database flyto-core participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.
What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.
Operational focus: Identify whether untrusted repository content can reach privileged runners, tokens, or deployment tools.
CVE-2026-54574: `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive
**Repository:** `termux/proot-distro` **Component:** `proot_distro/commands/install.py` → `_extract_plain_tar()`; also `helpers/docker.py` → `_apply_layer()` — ## Affected Versions | Component | Version | |—————|——————————| | proot-distro | 5.0.2 (confirmed vulnerable) | | Termux app | 0.119.0-beta.3 | | Device / ABI | Samsung Galaxy A23 / aarch64 | | Python (host) | 3.13 | — ## Vulnerability Description `proot-distro install` extracts a…
Why it matters: GitHub Advisory Database proot-distro participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.
What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.
Operational focus: Check dependency reachability and fixed versions before blocking or approving a release.
DevSecOps response plan
Protect the path from source code to production. Review what untrusted input can reach, which identities a runner can use, and whether secrets survive in logs, caches, or artifacts.
- Review current GitHub advisories against dependencies used by builds and internal services.
- Protect pull-request workflows from untrusted code execution and over-scoped tokens.
- Rotate secrets exposed in logs, artifacts, caches, or compromised runner workspaces.
- Use reviewed branches, isolated runners, pinned actions, and least-privilege deployment identities.
- Validate container base images and package lock files after security updates.
Build and release signals
Review trust boundaries at pull requests, runners, package resolution, artifact storage, credentials, and deployment approval.
- Identify whether untrusted repository content can reach privileged runners, tokens, or deployment tools.
- Check dependency reachability and fixed versions before blocking or approving a release.
- Reduce persistent credentials and keep build jobs isolated from production management paths.
Release decision
The secure release path minimizes inherited trust: isolated runners, short-lived identities, reviewed dependencies, reproducible artifacts, and explicit production approval.
References used in this briefing
- GitHub Advisory Database: CVE-2025-4318: AWS Amplify Studio UI Component Properties Has an Input Validation Issue
- GitHub Advisory Database: CVE-2026-67426: Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
- NIST National Vulnerability Database: CVE-2026-15791: A crafted message in the BuildKit low-level build API can be used…
- GitHub Security Blog: Tame Dependabot: Group your updates, slow the cadence, keep security fast
- GitHub Security Blog: Disrupting supply chain attacks on npm and GitHub Actions
- GitHub Security Blog: GitHub restructures public and VIP bug bounty payouts
- GitHub Advisory Database: CVE-2026-67427: Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
- GitHub Advisory Database: CVE-2026-54574: `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive
Related briefings
Live DevOps Security Brief for July 30, 2026: Pipelines, Dependencies, and Secrets
Live DevSecOps coverage for build systems, source control, dependencies, automation agents, containers, and credential exposure. Updated for July…
Read More
Live DevOps Security Brief for July 29, 2026: Pipelines, Dependencies, and Secrets
Live DevSecOps coverage for build systems, source control, dependencies, automation agents, containers, and credential exposure. Updated for July…
Read More
Live DevOps Security Brief for July 28, 2026: Pipelines, Dependencies, and Secrets
Live DevSecOps coverage for build systems, source control, dependencies, automation agents, containers, and credential exposure. Updated for July…
Read MoreNeed to add context to this briefing?
Send corrections, security tips, source updates, or collaboration notes through the contact page so the editorial team can review them properly.