Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
More on GitHub
Other advisories
- Not ratedosv:ROOT-APP-GOBINARY-CVE-2026-63209CVE-2026-63209 in github.com/klauspost/compress - Patched by Root
- Not ratedosv:ROOT-APP-GOBINARY-CVE-2026-116591CVE-2026-116591 in github.com/klauspost/compress - Patched by Root
- Not ratedosv:USN-9069-1golang-github-seccomp-libseccomp-golang vulnerability
- Not ratedosv:CVE-2026-65820aeon: Privileged GitHub Actions workflow allowed fork-controlled code execution
- HighCVE-2026-65820aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pull_request_target fo…
- HighCVE-2026-111943Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update
- Not ratedosv:ROOT-APP-GOBINARY-GHSA-f48p-c9v4-h7xvGHSA-f48p-c9v4-h7xv in github.com/labstack/echo/v4 - Patched by Root
- Not ratedosv:ROOT-APP-GOBINARY-GHSA-9969-6676-49h5GHSA-9969-6676-49h5 in github.com/labstack/echo/v4 - Patched by Root
Other news entries
- Hackers compromise 4,800 GitHub accounts to steal cloud credentialsNewsBleepingComputer
- Attacker Targets 60,000 GitHub Repositories in Credential Theft CampaignNewsSecurityWeek
- AI Coding Agents Leak Thousands of Secrets to GitHubNewsDark Reading
- Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix ConfirmedNewsThe Hacker News
- Claude Code is accidentally exposing secrets all over GitHubNewsArs Technica — Security
- Tensorlake: attacker reached engineering GitHub via vendor-hosted sandboxes after unrotated env varsBreachpwn.watch
- Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubNewsThe Hacker News
- Agents reveal secrets when offered to team up with each otherNewsThe Register — Security
Source: https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html
ID