Security experts Ben Cox explained that the official Github repositories of the UK Government, Spotify, and Python were accessed using compromised SSH keys. It seems that the keys were compromised by exploiting a flaw in the Debian OpenSSL random number generator seed, which was discovered and fixed in May 2008. The likely compromised keys have been revoked this month, they were managed to access high profile repositories after threat actors have scraped nearly 1.4 million SSH keys from Github. The impact could be devastating because according to Cox about two thirds of Github accounts utilize.”]
Source: https://securityaffairs.co/wordpress/37459/cyber-crime/compromised-ssh-keys.html