GitHub’s Verified Commits Undermined by Unusual Bug
A surprising vulnerability has been discovered in GitHub’s commit verification system, allowing attackers to rewrite existing commits into new hashes without invalidating their signatures. This bug affects all users who rely on GitHub’s verified commits feature, which is used for a wide range of applications, from auditing and compliance to supply chain management.
The issue lies in the way GitHub verifies commits using cryptographic hashes. When a developer pushes code changes to GitHub, it generates a unique hash that represents the new commit. The system then checks this hash against a set of predefined rules to ensure its integrity. However, researchers have found that an attacker can manipulate these commits by rehashing them with a different algorithm – SHA-1 instead of the default SHA-256 – without breaking the signature.
This might sound like a minor detail, but it has significant implications for users who rely on GitHub’s verification system to ensure the integrity of their code. For example, developers working in regulated industries may use verified commits to demonstrate compliance with specific standards or regulations. Similarly, organizations that manage software supply chains might use this feature to verify the authenticity of third-party components.
The attack vector involves exploiting a weakness in the way GitHub handles commit hashes. By rehashing an existing commit using SHA-1, an attacker can create a new hash that is mathematically equivalent but not identical to the original one. This allows them to rewrite the commit history without triggering any alerts or warnings from GitHub’s verification system. Researchers have shown that this can be done in just a few steps, making it relatively easy for attackers to exploit.
The discovery of this vulnerability has sparked concerns about the security of GitHub’s verified commits feature and its broader implications for software supply chain security. While GitHub has taken steps to mitigate the issue by restricting access to SHA-1 hashes, users need to be aware of this potential weakness when relying on verified commits.
To protect against similar vulnerabilities in the future, it’s essential for developers and organizations to adopt a more nuanced understanding of cryptographic hash functions and their limitations. By staying informed about emerging threats and taking proactive measures to harden their systems, they can minimize the risk of attacks targeting their software supply chains.
Source: The Hacker News — 2026-07-08