GitHub's security breach affecting 3

GitHub confirmed that a malicious VS Code extension allowed attackers to exfiltrate approximately 3,800 internal repositories. The TeamPCP threat group exploited the extension's permissions to steal source code, tokens, and credentials. This represents one of 2026's most significant DevOps platform security incidents.

GitHub announced the release of GitHub Security Lab Taskflow Agent, an open-source AI framework for security research. The agent is effective at finding authentication bypasses, token leaks, and high-impact vulnerabilities in Actions and JavaScript projects, marking a significant advancement in AI-assisted vulnerability discovery.

GitLab patched high-severity vulnerabilities including CVE-2026-7481 (XSS in analytics dashboards) and multiple unauthenticated DoS flaws affecting CI/CD pipelines. Versions 18.11.3, 18.10.6, and 18.9.7 address these critical issues that could enable session hijacking and pipeline disruption.

GitLab introduced AI-powered false positive detection for SAST security scans. When a SAST scan runs, GitLab Duo automatically analyzes vulnerabilities to determine likelihood of false positives, providing confidence scores and contextual reasoning to reduce security noise for development teams.

Microsoft announced Azure DevOps Server GA after transitioning from Release Candidate phase. The on-premises solution now operates under Modern Lifecycle Policy and includes critical security patches for group membership issues. Self-hosted organizations can now deploy production-ready DevOps infrastructure.

Atlassian's May 19 security bulletin addresses 39 high-severity vulnerabilities and 3 critical third-party vulnerabilities across Jira, Confluence, and Bitbucket Data Center. Organizations must upgrade to latest versions to mitigate risks from authentication bypasses and data exposure flaws.

Atlassian expanded data security policies to block downloading of files attached to Confluence and Jira when data export rules are active. The change affects organizations using Atlassian Guard Standard and aims to prevent both data exports and attachment downloads under unified policy controls.