Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

← Live incidents

Mar 14, 2025

1 new incident, 0 with updates.

Started

  • ClosedCriticalPatched

    tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs

    Attackers repointed the version tags of the popular tj-actions/changed-files GitHub Action to a commit that dumped runner memory, printing CI/CD secrets into workflow logs. It started with the compromise of reviewdog/action-setup and was aimed at Coinbase's agentkit repo first. Over 23,000 repositories used the action.

    tj-actions/changed-files GitHub ActionClosed Mar 20, 2025

Sponsored

Buy sponsor slot · $149/mo