Security1 hSeptember 28, 2026, 02:05

GitHub kills SHA-1 for HTTPS and TLS on github.com

On September 15, 2026, GitHub permanently disabled SHA-1 in the TLS handshake for github.com and partner CDNs. Warnings began in April, with an 18-hour brownout on July 14. GitHub Enterprise Server is unaffected.

DEV Community

Open source

SHA-1 disabled for github.com, Enterprise Cloud and partner CDNs
An 18-hour brownout ran on July 14, 2026
GHES (self-hosted) is not affected
Users can test their TLS stack via curl against github.dev

#GitHub

Fake LastPass Authenticator installs Microsoft-signed driver that kills 145 security tools

ZGCM-1-7B releases full weights, data, and code for math and agentic search

Security

CERT Polska links 17 Android apps via a reused TLS certificate

Software

GitHub kills SHA-1 for HTTPS and TLS on github.com

Fake LastPass Authenticator installs Microsoft-signed driver that kills 145 security tools

ZGCM-1-7B releases full weights, data, and code for math and agentic search

CERT Polska links 17 Android apps via a reused TLS certificate

Android 17 adds Certificate Transparency checks for TLS certificates