#GitHub Actions
All CosmicBytez Labs articles tagged #GitHub Actions, across news, security advisories, how-to guides, and projects.
- News
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
GhostAction hijacked pyxel's and Uber athenadriver's maintainer accounts, pushing credential-stealing workflows to hundreds of repos in a 500-account wave.
- News
GitHub Actions Re-Enabled With Mini Shai-Hulud Payload Still Active
Socket found actions-cool's GitHub Actions ran live Mini Shai-Hulud malware for roughly 9 days after a no-cleanup restore, exposing ~15,000 repos.
- News
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Two actions-cool GitHub Actions, compromised in May 2026, silently reactivated their credential-stealing payload after repos were restored uncleaned.
- Security
CVE-2026-55158: Conflibot Command Injection via Pull Request Branch Name
Conflibot before 1.2.1 interpolates attacker-controlled PR branch names into shell commands, enabling RCE with repo secrets and a write-scoped GitHub token.
- Security
CVE-2026-82856: @hulumi/policies GitHub OIDC Trust Policy Bypass
hulumi/policies before 1.3.2 missed set-qualified IAM operators, letting wildcard GitHub Actions OIDC conditions slip past guardrails.
- Security
CVE-2026-11325: Cloudflare pages-action GitHub Actions RCE
High-severity RCE in cloudflare/pages-action exposes CI/CD credentials. Migrate to wrangler-action before Sept 18, 2026 sunset.
- Security
CVE-2026-44359: Meshtastic CI/CD Workflow Exposes Repository Secrets (CVSS 10.0)
A critical GitHub Actions misconfiguration in the Meshtastic open-source mesh networking project allows attacker-controlled fork code to execute with...
- News
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
The Miasma supply chain malware family — an evolution of Mini Shai-Hulud and linked to the Hades worm — has compromised hundreds of npm packages, abused...
- News
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
Novee Security researchers have identified a critical exploitable CI/CD workflow pattern dubbed Cordyceps that enables attackers to hijack GitHub Actions...
- News
Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking
Security researchers have disclosed a class of exploitable flaws in CI/CD pipeline configurations that allow unauthenticated attackers to take full...
- News
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
GitHub released actions/checkout v7 on June 18, 2026, adding default protections that refuse to fetch fork PR code inside pull_request_target workflows —...
- Newsletter
June 23 Digest: FortiBleed, Klue/Salesforce Supply Chain, Squidbleed, GitHub Actions Fix
A Russian IAB harvests 110M credentials from FortiGate firewalls; the Icarus group drains hundreds of Salesforce orgs via Klue OAuth tokens; a 29-year-old...
- Newsletter
May 26 Digest: SharePoint RCE, Megalodon CI/CD Blitz
Microsoft patches a CVSS 8.8 SharePoint RCE; the Megalodon campaign poisons 5,561 GitHub repos in six hours; 7-Eleven's ShinyHunters breach hits 185,000; and a.
- Newsletter
May 20 Digest: Exchange Zero-Day, Verizon DBIR, GitHub
A Microsoft Exchange zero-day is being exploited with no patch in sight; Verizon DBIR 2026 marks a landmark shift — vulnerability exploitation now...
- News
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials
Threat actors have compromised the widely-used actions-cool/issues-helper GitHub Action, redirecting every existing tag to a malicious imposter commit...
- Security
CVE-2026-44246: nnU-Net Agentic Workflow Injection via GitHub Actions Issue Triage
A high-severity agentic workflow injection vulnerability in nnU-Net's GitHub Actions issue triage workflow allows attackers to inject and execute...
- News
Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft
A new supply chain attack campaign dubbed BufferZoneCorp has been observed using sleeper packages in RubyGems and Go module registries to push...
- News
Chainguard Unveils Factory 2.0 to Automate Hardening the Software Supply Chain
The rebuilt Chainguard Factory platform adds deeper security automation designed to continuously reconcile open source artifacts across containers,...
- HOWTO
Container Security Scanning with Trivy: Images, IaC, and CI/CD
Learn how to use Trivy to scan container images, Dockerfiles, Kubernetes manifests, and Terraform for vulnerabilities and misconfigurations — then...
- News
Trivy Supply Chain Attack Targets CI/CD Secrets
The open-source Trivy security scanner was weaponized by threat actor TeamPCP in a supply chain attack that hijacked 75 release tags to deploy an...
- News
Trivy Vulnerability Scanner Breached to Push Infostealer
The Trivy open-source vulnerability scanner was compromised in a supply chain attack by the threat group TeamPCP, which hijacked 75 release tags and...
- News
Trivy Security Scanner GitHub Actions Breached — 75 Tags
Trivy, Aqua Security's widely used open-source vulnerability scanner, was compromised a second time in a month. Attackers hijacked 75 GitHub Actions tags...
- HOWTO
How to Secure GitHub Actions Workflows with OIDC, SHA
Harden your CI/CD pipeline by replacing long-lived secrets with OIDC short-lived tokens, pinning third-party actions to commit SHAs, enforcing...
- Project
CI/CD Pipeline with GitHub Actions and Azure
Build a secure CI/CD pipeline with GitHub Actions deploying to Azure. Covers build, test, security scanning (SAST/DAST), and deployment with OIDC...