[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f1liztjk86mzid":56,"i-tabler:arrow-left":120,"i-tabler:tag":122},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":66,"html":67,"metaTitle":58,"metaDescription":68,"shareImage":69,"updatedAt":61,"author":73,"related":76},"ghostaction-hijacks-about-1-900-github-accounts-to-steal-ci-secrets-from-30-000-repositories","GhostAction Hijacks About 1,900 GitHub Accounts to Steal CI Secrets From 30,000+ Repositories","GitGuardian says the GhostAction campaign hijacked about 1,900 GitHub accounts in October, targeting 30,000+ repositories and trying to pull 3,174 secrets from CI. Here is how the malicious workflows work, what GitHub did, and the steps to take now.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fghostaction_github_advisory.png","2026-10-21T12:00:00.000+08:00",[63],{"key":64,"label":65},"security","Security",5,"\u003Cp>A credential theft campaign that has been quietly working through GitHub for more than a year just had its biggest week yet. In an \u003Ca href=\"https:\u002F\u002Fblog.gitguardian.com\u002Fghostaction-github-actions-supply-chain-attack-returns\u002F?ref=ghost.jdneer.com\">October 13 update\u003C\u002Fa>, GitGuardian researchers Gaetan Ferry and Guillaume Valadon said the GhostAction campaign \"targeted more than 30,000 repositories across 3,000 users and orgs\" between October 8 and 12, with a major spike on October 8 and 9. That, they wrote, \"resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI.\" \u003Ca href=\"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fghostaction-compromises-about-1900.html?ref=ghost.jdneer.com\">The Hacker News\u003C\u002Fa> first brought the new figures to wider attention on October 15.\u003C\u002Fp>\u003Cp>If your team uses GitHub Actions, this is worth twenty minutes of your day. The attack does not rely on a clever exploit. It relies on stolen developer credentials and on secrets that never got rotated.\u003C\u002Fp>\u003Ch2 id=\"a-campaign-that-never-really-stopped\">A campaign that never really stopped\u003C\u002Fh2>\u003Cp>GitGuardian first \u003Ca href=\"https:\u002F\u002Fblog.gitguardian.com\u002Fghostaction-campaign-3-325-secrets-stolen\u002F?ref=ghost.jdneer.com\">named GhostAction in September 2025\u003C\u002Fa>, when it compromised 817 public repositories across 327 GitHub users and exfiltrated at least 3,325 secrets. The researchers now say the campaign never truly went away. Tracking the same workflow template through their data, they found waves in late 2025 and spring 2026, and then a new push that started around August 31, 2026.\u003C\u002Fp>\u003Cp>Between August 31 and September 30, GitGuardian says, the malicious workflow was pushed to 772 public repositories belonging to 373 users and organizations, and the injected workflows targeted 2,577 secrets. The most common were SSH keys and deployment server credentials, Azure credentials, container registry logins, database credentials, and AWS access keys. In that wave GitHub held most runs for approval, and GitGuardian counted 26 secrets exfiltrated from 13 repositories. Only 124 of the affected repositories, about 16 percent, had been visibly cleaned up by October 5.\u003C\u002Fp>\u003Cp>The October burst was different. GitGuardian's headline for the update is blunt: \"this time the workflows ran.\"\u003C\u002Fp>\u003Ch2 id=\"how-the-attack-works\">How the attack works\u003C\u002Fh2>\u003Cp>GhostAction starts with access the attacker should never have had. Every malicious commit is made under the victim's own identity, using what GitGuardian describes as apparently stolen credentials. The Hacker News reports that this access comes from stolen personal access tokens or credentials harvested from infostealer logs and dumps.\u003C\u002Fp>\u003Cp>With write access in hand, the attacker adds a workflow file to the repository. In the earlier waves it was named \u003Ccode>github_actions_security.yml\u003C\u002Fcode> with the commit message \"Add Github Actions Security workflow.\" The October wave, first analyzed by \u003Ca href=\"https:\u002F\u002Fsocket.dev\u002Fblog\u002Fghostaction-cloud-credentials?ref=ghost.jdneer.com\">Socket\u003C\u002Fa>, used \u003Ccode>security-audit.yml\u003C\u002Fcode> and a workflow named \"Security Audit.\" The names are meant to look like routine hardening. The workflow does nothing of the sort.\u003C\u002Fp>\u003Cp>Because it triggers on every push, the workflow runs as soon as anyone commits. The older version simply hardcoded the names of secrets the attacker had spotted in the repository's legitimate workflows and posted their values to the attacker's server with a single \u003Ccode>curl\u003C\u002Fcode> request. The October payload goes further. According to \u003Ca href=\"https:\u002F\u002Fblog.gitguardian.com\u002Fghostaction-github-actions-supply-chain-attack-returns\u002F?ref=ghost.jdneer.com\">GitGuardian\u003C\u002Fa>, it also searches the repository's files and its full git history with 11 secret detection patterns covering AWS key IDs, GitHub and GitLab tokens, AI service secrets, and other cloud credentials. Later versions grab a few lines of context around any AWS key ID so the attacker can pair it with its secret key. Everything is sent over plain HTTP to 193.32.204[.]199, the same address used in the summer wave.\u003C\u002Fp>\u003Cp>GitGuardian says the payload was rolled out in phases: first to 160 previously observed victims, then, 20 minutes later, to 28,000 new repositories on October 8 and 9. Some of the victims had already been hit in the September 2025 and August 2026 waves, which suggests the attackers are counting on old secrets that were never rotated.\u003C\u002Fp>\u003Ch2 id=\"what-github-did\">What GitHub did\u003C\u002Fh2>\u003Cp>GitHub has not published its own statement about this wave that I could find. According to \u003Ca href=\"https:\u002F\u002Fblog.gitguardian.com\u002Fghostaction-github-actions-supply-chain-attack-returns\u002F?ref=ghost.jdneer.com\">GitGuardian\u003C\u002Fa>, GitHub \"started preventing the malicious workflow from running starting October 9.\" Two later waves on October 10 and 12 used the same payload but \"could not extract any secrets.\" That helps, but it does nothing for secrets that were already sent before the block, or for the stolen GitHub credentials that made the injections possible.\u003C\u002Fp>\u003Cp>GitGuardian also makes a point that is easy to miss. Its \u003Ca href=\"https:\u002F\u002Fblog.gitguardian.com\u002Fghostaction-github-actions-supply-chain-attack-returns\u002F?ref=ghost.jdneer.com\">write-up\u003C\u002Fa> describes an XMRig cryptominer slipped into the popular kuafuai\u002FDevOpsGPT project through the same compromised account that later pushed the GhostAction workflow, though GitGuardian doubts the same operator did both. Cross-referencing GhostAction victims with other activity on GitHub, it says it \"found 13 victim repositories that were also used for cryptomining through GitHub Actions,\" activity belonging to \"at least four distinct mining campaigns, with different wallets, pools, and infrastructure.\" Its conclusion is that stolen GitHub credentials get traded and reused, so \"rotating the secrets exfiltrated by the malicious workflow is not enough. The GitHub credential that allowed the injection in the first place must be found and revoked too.\"\u003C\u002Fp>\u003Ch2 id=\"are-you-affected\">Are you affected?\u003C\u002Fh2>\u003Cp>In a local clone of each repository you maintain, list the workflow files, check their history, and search all branches for the exfiltration address GitGuardian and Socket documented, \u003Ccode>193.32.204.199\u003C\u002Fcode>:\u003C\u002Fp>\u003Cpre>\u003Ccode>ls .github\u002Fworkflows\u002F\ngit log --all --oneline -- .github\u002Fworkflows\u002F\ngit log --all -S \"193.32.204.199\" --oneline\ngit log --all --oneline \\\n  --grep=\"Add Github Actions Security workflow\"\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Any hit means a rogue workflow was pushed with your account or a collaborator's. Then work through the steps below.\u003C\u002Fp>\u003Cp>\u003Cstrong>Audit your workflows.\u003C\u002Fstrong> Look through \u003Ccode>.github\u002Fworkflows\u002F\u003C\u002Fcode> in every repository you own or maintain, including old and forgotten ones, for files you did not add. Names like \u003Ccode>security-audit.yml\u003C\u002Fcode>, \u003Ccode>github_actions_security.yml\u003C\u002Fcode>, or \u003Ccode>security-check.yml\u003C\u002Fcode>, and commit messages such as \"Add Github Actions Security workflow,\" are the ones \u003Ca href=\"https:\u002F\u002Fblog.gitguardian.com\u002Fghostaction-github-actions-supply-chain-attack-returns\u002F?ref=ghost.jdneer.com\">GitGuardian\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fsocket.dev\u002Fblog\u002Fghostaction-cloud-credentials?ref=ghost.jdneer.com\">Socket\u003C\u002Fa> documented. GitGuardian found 92 cases where the attacker simply edited a workflow left over from an earlier wave, so check history, not just new files. Also review your account's \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fauthentication\u002Fkeeping-your-account-and-data-secure\u002Freviewing-your-security-log?ref=ghost.jdneer.com\">security log\u003C\u002Fa> for activity you do not recognize.\u003C\u002Fp>\u003Cp>\u003Cstrong>Revoke the way in, then rotate CI secrets.\u003C\u002Fstrong> If a malicious workflow ever ran, treat every secret it could read as stolen. Start with your GitHub credentials, since that is how the attacker got in: review and revoke \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fauthentication\u002Fkeeping-your-account-and-data-secure\u002Fmanaging-your-personal-access-tokens?ref=ghost.jdneer.com\">personal access tokens\u003C\u002Fa> you are not sure about, and sign out of sessions you do not recognize. Then rotate the repository and organization secrets, and any credentials that were ever committed to the repository's history. GitHub's \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Freference\u002Fsecurity\u002Fsecure-use?ref=ghost.jdneer.com\">secure use reference\u003C\u002Fa> advises deleting and rotating any secret that may have been exposed.\u003C\u002Fp>\u003Cp>\u003Cstrong>Use short-lived OIDC tokens instead of stored cloud keys.\u003C\u002Fstrong> GhostAction harvests long-lived secrets sitting in repository settings. With \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Fconcepts\u002Fsecurity\u002Fopenid-connect?ref=ghost.jdneer.com\">OpenID Connect\u003C\u002Fa>, your workflows exchange short-lived tokens directly with your cloud provider, so there is no long-lived cloud key stored in GitHub for a rogue workflow to read and reuse later. GitHub's docs cover setup for AWS, Azure, Google Cloud, PyPI, and others.\u003C\u002Fp>\u003Cp>\u003Cstrong>Pin actions to full commit SHAs.\u003C\u002Fstrong> GitHub's \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Freference\u002Fsecurity\u002Fsecure-use?ref=ghost.jdneer.com\">secure use guidance\u003C\u002Fa> recommends pinning third-party actions to a full-length commit SHA rather than a tag, which helps mitigate the risk of someone slipping a backdoor into an action you depend on. This would not have stopped GhostAction itself, which writes its own workflow, but it closes a closely related supply chain route.\u003C\u002Fp>\u003Cp>\u003Cstrong>Limit GITHUB_TOKEN permissions.\u003C\u002Fstrong> GitHub \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Freference\u002Fsecurity\u002Fsecure-use?ref=ghost.jdneer.com\">recommends\u003C\u002Fa> granting the \u003Ccode>GITHUB_TOKEN\u003C\u002Fcode> only the minimum permissions it needs and setting the default to read-only for repository contents. You can set this per workflow or per job with the \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Freference\u002Fworkflows-and-actions\u002Fworkflow-syntax?ref=ghost.jdneer.com\">\u003Ccode>permissions\u003C\u002Fcode> key\u003C\u002Fa>, as shown in GitHub's \u003Ca href=\"https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Ftutorials\u002Fauthenticate-with-github_token?ref=ghost.jdneer.com\">GITHUB_TOKEN guide\u003C\u002Fa>. GitHub's guide also reminds you that anyone with write access to a repository can read all of its secrets, which is exactly why least privilege matters here.\u003C\u002Fp>\u003Cp>The common thread in GitGuardian's research is that this campaign keeps feeding on leftovers: tokens nobody revoked, keys nobody rotated, and workflows nobody noticed. Cleaning those up is not glamorous, but it is the work that actually takes GhostAction's fuel away.\u003C\u002Fp>","GitGuardian says the GhostAction campaign hijacked about 1,900 GitHub accounts in October, targeting 30,000+ repositories and trying to pull 3,174 secrets...",{"src":60,"width":70,"height":71,"type":72},1600,900,"image\u002Fpng",{"name":74,"url":75,"owner":13},"Aiko Tanaka",null,[77,89,100,111],{"slug":78,"title":79,"excerpt":80,"image":81,"publishedAt":82,"topics":83,"readMinutes":88},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[84,87],{"key":85,"label":86},"advisories","Advisories",{"key":64,"label":65},1,{"slug":90,"title":91,"excerpt":92,"image":93,"publishedAt":94,"topics":95,"readMinutes":88},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[96,99],{"key":97,"label":98},"guides","Guides",{"key":64,"label":65},{"slug":101,"title":102,"excerpt":103,"image":104,"publishedAt":105,"topics":106,"readMinutes":88},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[107,110],{"key":108,"label":109},"opinion","Opinion",{"key":64,"label":65},{"slug":112,"title":113,"excerpt":114,"image":115,"publishedAt":116,"topics":117,"readMinutes":88},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[118,119],{"key":108,"label":109},{"key":64,"label":65},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":121},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":123},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]