Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
Teaser from the source
'The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully'
This is the RSS-feed teaser. Read the full article at the original source.
Read at The Register — SecurityMore on GitHub
Other advisories
- Not ratedosv:CLEANSTART-2026-NH89673package github
- Not ratedosv:CVE-2026-58412Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow
- Not ratedosv:CLEANSTART-2026-KK78460flaw was found in github
- Not ratedosv:CLEANSTART-2026-SY25766Memory-safety vulnerability in github
- Not ratedosv:CLEANSTART-2026-JP29765Memory-safety vulnerability in github
- Not ratedosv:CLEANSTART-2026-XG38692denial-of-service vulnerability exists in github
- Not ratedosv:CLEANSTART-2026-OP23814Versions of the package github
- Not ratedosv:CVE-2026-119290Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run
Other news entries
- Hugging Face malware campaign returns to hijack GPUs for crypto miningNewsBleepingComputer
- Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto MinersNewsThe Hacker News
- Gut getarnt: Automatisch startender Wurm bei GitHub ist schwer zu findenNewsheise Security
- GitHub Launches npm Firewall to Block Malicious Packages Before InstallationNewsThe Hacker News
- GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHubNewsDark Reading
- Gheist turns GitHub Actions into a secret extraction serviceNewsCSO Online
- Attackers compromised 42 GitHub repositories by using files too large to be searchedNewsCSO Online
- Worm armed 42 GitHub repos by hiding a payload too big to failNewsThe Register — Security
ID