GitHub issue and PR payloads hit 61 repos including Trivy, Brave and MLflow in a 43-minute workflow injection campaign
GitHub Actions workflows in public repositories
Radware found a coordinated campaign on Sept 1 2026: 83 issues, pull requests and comments, posted from 74 GitHub accounts (many likely compromised), aimed at 61 public repositories including Trivy, Brave, MLflow, Google LangExtract, CopilotKit, podman, cilium and Homebrew Cask. 77 of them landed within 43 minutes. Each carried a $() shell command that runs if a GitHub Actions workflow pastes the issue or PR text into a shell step, collecting the job's environment variables and sending them to an attacker server. The item doesn't need to be merged or even stay open. Run logs show the command executed in two cases; whether any tokens with write access were stolen or code changed is unknown. Maintainers were notified and most repos were fixed.
Why this severity: Command execution confirmed in 2 workflow runs; no confirmed repo takeover or poisoned release so far
- Started
- Sep 1, 2026
Affected
- Public GitHub repositories whose Actions workflows interpolate issue, pull request or comment text (titles, bodies, comments) directly into shell run steps
Fixed in
No fixed release yet
Timeline3
Radware publishes the campaign. Targets include agno-agi/agno, ToolJet, google/langextract, aquasecurity/trivy, CopilotKit, podman, QwenLM/qwen-code, mlflow, discord.js, cilium, brave/brave-browser, dotnet/maui, Homebrew/homebrew-cask, github/docs, apache/doris and PX4-Autopilot. Run logs show the command executed in two cases; Radware can't say whether the attacker got write access or changed any code. Maintainers were notified and most repos were closed or fixed, but not all are confirmed.
Radware verifies 83 malicious items (59 issues, 24 pull requests; 31 payloads in titles, 17 in bodies, 35 in comments) across 61 repositories from 74 named accounts, many with legitimate histories and likely compromised. 29 issues and 6 PRs were still open at the time.
Between 11:26:51 and 12:10:00 UTC, 77 issues, pull requests and comments carrying a shell command payload hit public GitHub repositories, followed by a second wave of six about two minutes long later that day. The payloads target workflows that paste issue or PR text straight into shell scripts, so the $() command runs inside GitHub Actions and tries to send the job's environment variables to an attacker-controlled server.
News & write-ups2
Notes & caveats
Radware's research, shared with The Register as an exclusive. Not linked to GhostAction or Gheist by any source; don't present it as the same actor. patchStatus partial: most targeted repos closed or fixed the workflows, but Radware can't confirm all of them, and 29 issues and 6 PRs were still open on Oct 13.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
