GitHub reported an incident where a private RSA key used as a host key for accessing GitHub repositories over SSH was mistakenly published in a publicly accessible repository. The leak only affected the RSA key; ECDSA and Ed25519 host SSH keys remain secure. The exposed host SSH key does not allow access to GitHub's infrastructure or user data but can be used to intercept Git operations performed over SSH.
To prevent potential interception of SSH sessions to GitHub in the event that the RSA key falls into the hands of malicious actors, GitHub has initiated the key replacement process. Users need to remove the old GitHub public key (ssh-keygen -R github.com) or manually replace the key in the file ~/.ssh/known_hosts, which may disrupt the operation of automatically executed scripts.
Source: opennet.ru
