pwn.watch: GitHub Actions incident updates https://pwn.watch/s/github-actions Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 12:59:41 GMT [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: OpenSourceMalware finds a second stage in 94 repos: VS Code tasks.json autoruns a stealer hidden in a fake Font Awesome .woff2 and installs a 5-minute cron. https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-16:OpenSourceMalware finds a second stage in 94 repos: VS Code tasks.json autoruns a stealer hidden in a fake Font Awesome .woff2 and installs a 5-minute cron. Fri, 16 Oct 2026 00:00:00 GMT high Source: https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file Status: live, partial [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: GitGuardian update: Oct 8-12 wave targeted 30,000+ repos across ~3,000 users/orgs from ~1,900 compromised accounts; 3,174 secrets targeted. https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-13:GitGuardian update: Oct 8-12 wave targeted 30,000+ repos across ~3,000 users/orgs from ~1,900 compromised accounts; 3,174 secrets targeted. Tue, 13 Oct 2026 00:00:00 GMT high Source: https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/ Status: live, partial [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: Phishing kit on my-github.com steals password + 2FA and silently authorizes an OAuth app with repo/workflow scopes. https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-11:Phishing kit on my-github.com steals password + 2FA and silently authorizes an OAuth app with repo/workflow scopes. Sun, 11 Oct 2026 00:00:00 GMT high Source: https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html Status: live, partial [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: Socket counts 500+ accounts committing the workflow to tens of thousands of repos; GitHub starts preventing the workflow from running; my-github.com registered. https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-09:Socket counts 500+ accounts committing the workflow to tens of thousands of repos; GitHub starts preventing the workflow from running; my-github.com registered. Fri, 09 Oct 2026 00:00:00 GMT high Source: https://socket.dev/blog/ghostaction-cloud-credentials Status: live, partial [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: Accounts of pyxel author Takashi Kitao (27 repos, 13:20 UTC) and henrywoo (318 repos in 16 min, incl. uber/athenadriver) push security-audit.yml; run logs confirm exfiltration. https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-08:Accounts of pyxel author Takashi Kitao (27 repos, 13:20 UTC) and henrywoo (318 repos in 16 min, incl. uber/athenadriver) push security-audit.yml; run logs confirm exfiltration. Thu, 08 Oct 2026 00:00:00 GMT high Source: https://www.stepsecurity.io/blog/ghostaction-returns Status: live, partial [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: 2026 resurgence: 772 public repos and 2,577 secrets targeted between Aug 31 and Sep 30; new exfil IP 193.32.204.199 in use from ~Sep 4. https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-08-31:2026 resurgence: 772 public repos and 2,577 secrets targeted between Aug 31 and Sep 30; new exfil IP 193.32.204.199 in use from ~Sep 4. Mon, 31 Aug 2026 00:00:00 GMT high Source: https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/ Status: live, partial [critical] TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions: Trivy compromise disclosed; Microsoft guidance published. https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain teampcp-trivy-checkmarx-supply-chain:2026-03:Trivy compromise disclosed; Microsoft guidance published. Sun, 01 Mar 2026 00:00:00 GMT critical Status: closed, patched [critical] TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions: Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates). https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain teampcp-trivy-checkmarx-supply-chain:2026-03:Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates). Sun, 01 Mar 2026 00:00:00 GMT critical Status: closed, patched [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: GitGuardian first documents GhostAction: 817 repos, 327 users, 3,325+ secrets stolen. (Earlier campaign, for context.) https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2025-09:GitGuardian first documents GhostAction: 817 repos, 327 users, 3,325+ secrets stolen. (Earlier campaign, for context.) Mon, 01 Sep 2025 00:00:00 GMT high Source: https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/ Status: live, partial