Executive Summary
In July 2026, researcher Jacob Ginesin identified a vulnerability in GitHub's commit verification process, revealing that signed Git commits can be altered to produce new hashes without invalidating their signatures. This flaw allows attackers to replicate commits with identical content, authorship, and timestamps, yet different hashes, while still displaying a 'Verified' status on GitHub. Consequently, systems relying on commit hashes for security measures, such as blocklists and provenance logs, are susceptible to evasion tactics. (thehackernews.com)
This discovery underscores the critical need for robust verification mechanisms in software development platforms. As supply chain attacks become more sophisticated, ensuring the integrity and authenticity of code commits is paramount to maintaining trust and security in open-source ecosystems.
Why This Matters Now
The ability to alter commit hashes without breaking signatures poses a significant risk to software supply chains, potentially allowing malicious code to bypass security measures undetected. Addressing this vulnerability is urgent to prevent exploitation and maintain the integrity of software repositories.
Attack Path Analysis
An attacker exploits the malleability of Git commit signatures to create a duplicate commit with a different hash but the same content and valid signature. This allows the attacker to bypass hash-based security measures, potentially leading to unauthorized code inclusion in repositories. The attack progresses through the stages of initial compromise, privilege escalation, lateral movement, command and control, exfiltration, and impact.
Kill Chain Progression
Initial Compromise
Description
The attacker identifies a repository with signed commits and exploits the malleability of Git commit signatures to create a duplicate commit with a different hash but the same content and valid signature.
MITRE ATT&CK® Techniques
Subvert Trust Controls: Code Signing
Data Manipulation: Stored Data Manipulation
Valid Accounts
Modify Authentication Process: Domain Controller Authentication
Use Alternate Authentication Material: Pass the Hash
Steal or Forge Kerberos Tickets: Kerberoasting
Unsecured Credentials: Credentials in Files
Unsecured Credentials: Credentials in Registry
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Change Control Processes
Control ID: 6.4.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Security Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical supply-chain vulnerability in Git commit verification enables sophisticated code tampering attacks, compromising software integrity and development workflows across organizations.
Financial Services
GitHub signature bypass threatens financial software development security, enabling malicious code injection in payment systems while maintaining apparent regulatory compliance verification.
Health Care / Life Sciences
Commit hash manipulation vulnerability compromises medical software supply chains, potentially enabling unauthorized changes to HIPAA-compliant applications without detection mechanisms.
Government Administration
Federal agencies face significant supply-chain risks as attackers can rewrite verified commits in government systems while maintaining cryptographic signatures.
Sources
- GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatureshttps://thehackernews.com/2026/07/github-verified-commits-can-be.htmlVerified
- Analysis of Commit Signing on Githubhttps://arxiv.org/abs/2604.14014Verified
- Anomalicious: Automated Detection of Anomalous and Potentially Malicious Commits on GitHubhttps://arxiv.org/abs/2103.03846Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it can limit the attacker's ability to exploit Git commit signature malleability, thereby reducing the potential for unauthorized code inclusion and subsequent lateral movement within the development environment.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit Git commit signature malleability would likely be constrained, reducing the potential for unauthorized code inclusion.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges through unauthorized code inclusion would likely be constrained, reducing the risk of further compromise.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the development environment would likely be constrained, reducing the risk of further system compromise.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control over the environment would likely be constrained, reducing the risk of sustained malicious activities.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data would likely be constrained, reducing the risk of data loss.
The attacker's ability to achieve their objectives would likely be constrained, reducing the overall impact of the attack.
Impact at a Glance
Affected Business Functions
- Software Development
- Code Review
- Version Control
Estimated downtime: N/A
Estimated loss: N/A
Potential for unauthorized commit modifications leading to trust issues in code integrity.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access and prevent unauthorized code inclusion.
- • Enhance Threat Detection & Anomaly Response capabilities to identify and respond to unusual commit activities.
- • Utilize Multicloud Visibility & Control to monitor and manage commit activities across different environments.
- • Apply Inline IPS (Suricata) to detect and prevent exploitation attempts targeting commit signature malleability.
- • Regularly review and update security policies to address emerging threats related to commit signature verification.
