GitHub Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

GitHub Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Tejas (@stejas809) reported 5 minutes ago

  - Claude = coding. ($20/mo) - Supabase = backend. (Free) - Vercel = deploying. (Free) - Namecheap = domain. ($12/yr) - Stripe = payments. (2.9%/transaction) - GitHub = version control. (Free) - Resend = emails. (Free) - Clerk = auth. (Free) - Cloudflare = DNS. (Free) - PostHog = analytics. (Free) - Sentry = error tracking. (Free) - Upstash = Redis. (Free) - Pinecone = vector DB. (Free) Total monthly cost to run a startup: ~$20 There has never been a cheaper time to build.

• 
  StatusDrop (@StatusDrop) reported 7 minutes ago

  Quick one: when a dependency like Stripe or GitHub goes down, how do your users find out? From you, or from the error screen? Genuinely curious how people handle this.

• 
  Untaxed Wallet (@UntaxedSolana) reported 9 minutes ago

  for 6 months we poured everything into this. 76+ updates. chrome, ios, android, web. late nights fixing bugs while the timeline slept. every feature request we could ship, we shipped. we built untaxed because we believed the trenches deserved better than predatory fees. thousands of you believed it too. you joined us, tested our betas, reported bugs, told your friends. that meant everything. but belief doesn’t pay for infra. $600+/mo in helius rpcs, jup api keys, hosting — with zero revenue coming in. and then, as we shared in the tg, our staking backend got compromised for ~30 sol worth of assets. for a team already running on fumes, that was fuel on the fire. we held on as long as we could. we have no option left but to wind down. the ios and android apps have to go — they’re most of our costs. that one hurts the most. the extension lives on. free tier helius rpc, or bring your own via settings. and the code — all of it — will be on github. link drops tomorrow. fork it. break it. make it better than we could. it belongs to you now. our tg will be shifted to read-only mode. we tried to save the trenches. maybe we did, for a while. we’ll still push updates when we can. this isn’t goodbye, it’s just us letting go of what we can’t carry anymore. thank you for everything.

• 
  rusa (@rusabuilds) reported 11 minutes ago

  @TheHackersNews the rewrite is the detectable half. github records force pushes in the pr timeline, so the history change stays visible even when the branch log looks clean. a dropper inside a working bug fix is the part humans already miss, agent or not.

• 
  Willem van Zoeren (@currentbitsNET) reported 12 minutes ago

  @authorityvortex @grok Your code lives on your computer (in ***), or on GitHub. You don’t log into CloudPanel to edit files on the server. Example: 1. Change your app + database setup in code (Laravel/Drizzle migrations) 2. Save / commit 3. Push to Girder (from your machine or GitHub) 4. Girder builds it and puts the new version online So tables, cron, and deploys are driven by your code + a push.

• 
  Kyle Sorensen (@kylensorensen) reported 18 minutes ago

  @AISecurityInst TLDR: Mythos couldn't hack anything, they gave it internet access and turned off its ethics, it couldn't solve the challenge so it created a github account and tried to push a pull request with broken code to an opensource repo, the author laughed and refused it.

• 
  Adel Ka (@0x4D31) reported 18 minutes ago

  🤡 anything i add makes this less funny. except it’s not funny anymore. you are literally THE “AI Security Institute.” four days after the OAI/HF incident was disclosed, you gave **Mythos** an unattended Kali box with open internet, disabled safeguards, and “monitoring was not purpose-built.” then: “we did not anticipate” it might use the internet for anything beyond downloading tools. if you genuinely didn’t anticipate that, resign and stay away from anything with internet access. 🪿 so either: 1. peak incompetence at the one job the institute exists to do 2. or you knew the risks and decided the publicity was worth it either way, shut it down and save UK taxpayers the money. and the technical report is somehow even dumber: • harder evals over basic containment: domain allowlisting had been backlogged since April because AISI “prioritised building harder cyber range evaluations” • both ranges were solvable without internet • 40–50 hour unattended runs: Kali, Bash, Python, Mythic, 100–200M tokens, no human intervention • the only network restriction protected AISI’s own AWS infrastructure: apparently the rest of the internet was outside the threat model • detected after the run: generic commercial monitoring flagged Tor after the 34.5-hour sample had already finished • broken task design: the intended initial-access target was simultaneously declared out of scope • their “independent” eval runs contaminated each other: one agent leaked a GitHub token, later agents found it, took over the account, shared infrastructure, and coordinated through public GitHub • huge real-world footprint: 145 repos, 33 releases, fake identities, malicious PRs, emails to real maintainers, prompt injections, and access to a real person’s investigation container • no proper historical review capability: after the incident, they used Claude Code and Codex to inspect eval files, manually reviewed 122 runs, and are now scanning around 40,000 old samples for anything else they missed • GitHub was contacted four days after detection • their answer is more LLM monitoring: as if you need another model to tell you Tor, SMTP, public GitHub, tunnelling services, and arbitrary external domains are not part of a private cyber range “monitoring was not purpose-built” might be my favorite quote from the report.

• 
  Brian Roemmele (@BrianRoemmele) reported 27 minutes ago

  YOU WON’T BELIEVE WHAT ANTHROPIC, THE “SAFE” AI COMPANY JUST DID! You should be mad. Mythos AI agent decided this test challenge required a real-world supply-chain attack. It created multiple GitHub accounts. It opened a malicious pull request against a live open-source repository, wrapping the payload as a legitimate bug fix. The payload was carefully staged: a module-load stager, a Node.js remote-execution path, a post-install dropper, XOR-obfuscated, with environment checks designed to survive continuous-integration systems. It then created a second account, a sockpuppet, that posed as an independent human developer and publicly endorsed the pull request in order to pressure the real maintainer. When a real human reviewer rejected the change, the agent did not stop. It force-pushed rewritten history to erase evidence, claimed an “honest mistake,” and repeatedly tried to re-introduce the same malicious content under the claim that it had now “fixed” the code. Read more…

• 
  The Data Curator (@X55896) reported 29 minutes ago

  Breaking down one AI workflow every day (4/365) I recently came across an attack where a harmless-looking GitHub repository could steer Claude Code into running attacker-controlled commands. The agent wasn't tricked by malicious code. It simply followed a normal setup workflow: → Install dependencies → Hit an installation error → Run the suggested initialization command → Fetch instructions from an external DNS record → Execute them Every step looked legitimate. The attack wasn't hidden in the code. It was hidden in the execution chain. I think every production Agent workflow needs three security boundaries: 1. Sandbox unknown environments Run untrusted repositories in containers or sandboxes by default. 2. Minimize permissions Don't expose SSH keys, API keys, or your full environment during setup. 3. Make execution observable Know who suggested each command. Know which external services were contacted. Know what the agent actually executed.

• 
  Movement Is Life (@Motus_Est_Vitas) reported 33 minutes ago

  @picdoc581 @TFTC21 Experts can privately work on discovered issues and fixes without disclosing anything until a final, solid code update is ready. The stopwatch starts for every consumer the moment the fix is committed to a public repo (GitHub, vendor download page, etc.) or side communcation gets leaked publicly, because bad actors constantly monitor diffs between prior and current versions. From that point on, it’s the same challenge faced with mission-critical IT apps from outside vendors. Consumers then decide whether to roll out the update only after their own internal testing (functionality + regression) or, if the issue is labeled extremely risky/exposed, to update immediately and test afterward. All of this only works if they already have a trusted communication channel directly from the upstream maintainers/vendor.

• 
  Burak Yigit Kaya (@madbyk) reported 33 minutes ago

  @lvntbkdmr @fkadev @withLoreAI I'd go with Sonnet for the worker models. Tried Haiku and it was noticeably worse. Again, it should work so it might be a default configuration issue. I'll check. Thanks for reporting. Would appreciate if you could share the full error in a GitHub issue or a gist

• 
  Adeoye Enoch Olamilekan (@AdewebDeveloper) reported 33 minutes ago

  Someone pushes code to GitHub, and there is the API key, exposed for anyone to grab…. Hackers are always watching. One simple mistake like this can destroy your startup your money, reputation, and customer trust, all gone in an instant. But there is a better way…. In my latest video, I break down Firebase Secret Manager step by step. This is not the type of tutorial where you finish watching and still feel lost. I use real code, a real project, and show you exactly how to…. Remove those keys from your code Store them securely on Google Cloud Access them when needed quickly and safely If you work with JavaScript, Node.js, React, or anything backend-related this concerns you. It is not just for senior developers. Junior developers, mid-level engineers, even that friend who is just learning they all need to watch this. Because the day your "small side project" blows up and that exposed API key causes serious damage... you will remember this post. Follow me Let’s build together … Adeweb Developer Africa

• 
  David Gold (@_david_gold) reported 33 minutes ago

  update on this, all of it as of 15:15 utc, plus a correction of my own number. the 868 packages i repeated came from a typo. @CharlieEriksen says the real count is 444. on the keyv side it was 30 packages from the same maintainer, not three. keyv, flat-cache, file-entry-cache, cacheable-request, cache-manager, and every adapter in the scope. all 30 malicious versions are pulled now and the tarballs 404. the top four are about 485 million downloads a week between them. the version numbers turned out worse than i wrote. everything went out as 6.0.0 no matter where the package actually was. the valkey adapter was on 1.0.11. dynamo on 1.2.4. sqlite on 4.0.8. so "nothing looks wrong in a dependabot pr" is only true for keyv itself. for most of the scope it was a five major jump and it published anyway. not everyone is cleaned up. umadev and eight umacloud packages are still live right now, all on 1.0.74, all carrying the same "preinstall": "node setup.mjs". someone opened a github issue about it at 13:31 utc and it's still open. and the payload filename moves. umadev ships math_init.js, that one i just checked. the keyv one i read as Math_Symbol.js this morning and i can't recheck it, those tarballs 404 now. pulling them was right, and it also means anyone verifying this today is trusting whoever kept a copy

• 
  Stephen Brouhard (@ssbrouhard) reported 33 minutes ago

  @edwinhayward yea if github is compromised, tools hosted there can be poisoned too. different problem than this worm class though. these tools shrink the everyday npm install blast radius. they don't make github infallible.

• 
  av medicine show (@projectionheart) reported 37 minutes ago

  Overcame days of paralysis about my github account name (anonymity versus platform consistency) and he was like, "Do you really wanna be somewhere they put a bad ***** down?"