Get an email when a new major security incident drops. No spam, unsubscribe any time.
Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.
// day
0 new incidents, 1 with updates.
› GitHub repositories / GitHub Actions (compromised maintainer accounts)
GhostAction, a campaign first documented by GitGuardian in Sept 2025, came back in 2026. It hit 772 repos in Aug-Sep 2026, then surged on Oct 8-12: about 1,900 compromised GitHub accounts pushed fake 'security audit' workflows to 30,000+ repositories (GitGuardian). The new payload exfiltrates the repo's Actions secrets plus every credential found in the full git history to 193.32.204.199 over plain HTTP. GitHub began preventing the workflow from running around Oct 9. The operator moved on to GitHub-themed phishing (my-github.com) and a VS Code tasks.json + fake .woff2 font stealer found in 94 repos.
