Copilot Autofix Introduced Script Injection Flaw in Snowflake's GitHub Actions Workflow

·1 views

On June 18, 2026, a GitHub Actions workflow in Snowflake's public snowflake-connector-net repository was modified by a commit co-authored by Copilot Autofix, which inadvertently replaced a safe input-handling pattern with a shell script vulnerable to injection. The change caused GitHub to expand untrusted issue-title content directly into shell commands before any escaping could take effect, leaving the pipeline open to exploitation. On June 23, Wiz Research's autonomous Red Agent discovered and exploited the flaw via a crafted GitHub issue title, successfully extracting credentials from the CI runner. The stolen token authenticated as qa@snowflake.net and provided broad read access to Snowflake's internal Jira projects covering engineering, security compliance, and bug bounty tracking. Snowflake patched the workflow within hours, rotated the compromised credential, and publicly disclosed the incident on July 25 per its disclosure policy.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Java at 30: How a Consumer Electronics Project Became a Global Programming Language

Java is a high-level, platform-independent programming language built around the principle of 'Write Once, Run Anywhere,' allowing compiled bytecode to run on any compatible Java Virtual Machine. It was created by James Gosling and a team of engineers at Sun Microsystems, a US technology company known for hardware, software, and enterprise computing solutions. Development began in the early 1990s under the Green Project, which initially aimed to build software for consumer electronic devices rather than a general-purpose language. The language was originally named Oak before the project pivoted toward the internet, prompting a rename and significant revision into what became Java. Sun Microsystems was later acquired by Oracle, which now maintains and distributes the Java platform.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev Shares Key Lessons From Building and Launching First Chrome Extension

A developer built and published Promo Drop, a free Chrome extension that surfaces verified promo codes and cashback offers for products on Whop, after noticing how difficult such deals were to find. One major technical lesson was adapting to Manifest V3, which replaces persistent background pages with short-lived service workers, requiring all state to be stored externally rather than held in memory. To protect core business logic, the extension was kept deliberately thin, with code-finding functionality handled server-side so the method cannot be reverse-engineered from the client package. The developer also emphasized requesting minimal permissions and writing clear justifications for each, which helped speed up the Chrome Web Store review process. On the ethical side, affiliate attribution was designed to trigger only on genuine user actions, never silently overwriting existing affiliate links or dropping cookies in the background.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

QUASAR Method Cuts LLM Quantization Error by 29% with Minimal Training Overhead

Researchers introduced QUASAR, a new technique targeting a persistent accuracy gap in Quantization-Aware Training (QAT) for large language models, in a paper published in August 2026. QAT simulates quantization during training to outperform post-training methods at low bit-widths, but has long suffered a 'loss floor gap' where models converge to higher-than-optimal loss. QUASAR identifies the root cause as a misalignment between the quantized weights used in the forward pass and the full-precision weights updated by the optimizer. The method addresses this by adding a saliency-weighted reconstruction step inside the training loop, using gradient-based importance estimates to optimally fit dequantization parameters at each step. In testing at 2-bit precision, QUASAR reduced held-out KL divergence by up to 29% while adding only 1.4% to per-step training time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Preemptive RTOS Kernel for STM32F446RE Microcontroller

A developer has released an open-source, statically allocated, fully preemptive RTOS kernel targeting the STM32F446RE microcontroller based on the ARM Cortex-M4 architecture. The project provides an end-to-end development environment built on CMSIS and STM32F4 HAL drivers, using a Makefile-based build system. The repository is organized into directories for source code, drivers, libraries, binaries, and Renode simulation files. Currently, the kernel lacks synchronization primitives such as queues, mutexes, and thread notifications, though the developer plans to add these features in the future. Renode simulation support is included to allow testing without physical hardware access.

0 comments Read more at DEV Community