Is GitHub Still Safe? What the 18-Minute Breach Means
18 minutes. That's all it took to breach GitHub.
On May 18, 2026, a poisoned VS Code extension — Nx Console v18.95.0 — sat live on the Visual Studio Marketplace for just 18 minutes. In that window, attackers harvested GitHub tokens, AWS credentials, 1Password vaults, and Anthropic Claude Code configurations off a GitHub employee's machine — and walked out with ~3,800 of GitHub's internal repositories. The breach was claimed by TeamPCP (UNC6780) as part of the Mini Shai-Hulud supply chain campaign that also hit OpenAI and Grafana.
In this video, Zack Perry breaks down exactly what happened, whether your repos are at risk, and why developers like Mitchell Hashimoto are quietly walking away from GitHub. Then we tour the three self-hosted Git alternatives every homelabber should know in 2026 — Gitea, Forgejo, and GitLab CE — and show you how to deploy them with Docker Compose.
Gitea- https://about.gitea.com/
Forgejo- https://forgejo.org/
GitLab CE- https://gitlab.com/rluna-gitlab/gitla...
Build your HomeLab with us:
HL15 Beast: https://store.45homelab.com/configure...
HL15 2.0: https://store.45homelab.com/configure...
X15 Signature Server: https://store.45homelab.com/products/304
Stay Connected Follow Us on Social:
Instagram: / 45homelab
Facebook: / 45homelab-61577345404910
X: https://www.x.com/45homelab
To be the first to receive 45HomeLab announcements, news, and events, subscribe to the 45HomeLab newsletter here: https://45homelab.com/#footer-heading.
Hey everyone, almost 80% of you watch our videos but aren’t subscribed yet! If you’re enjoying the content, hit Subscribe and turn on the bell. It really helps us stay connected
#github #githubhacked #homelab #opensource #opensourcecommunity #selfhosted #tech #technews