Brave
Security incidents tagged Brave. Newest first.
1 Brave incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 0
- Days without an incident
- 0
- Longest quiet run: 41 days (Sep 2–Oct 12)
Show 1 older incident1 older incident
September 2026 1
- MediumPartly patched
GitHub issue and PR payloads hit 61 repos including Trivy, Brave and MLflow in a 43-minute workflow injection campaign
Radware found a coordinated campaign on Sept 1 2026: 83 issues, pull requests and comments, posted from 74 GitHub accounts (many likely compromised), aimed at 61 public repositories including Trivy, Brave, MLflow, Google LangExtract, CopilotKit, podman, cilium and Homebrew Cask. 77 of them landed within 43 minutes. Each carried a $() shell command that runs if a GitHub Actions workflow pastes the issue or PR text into a shell step, collecting the job's environment variables and sending them to an attacker server. The item doesn't need to be merged or even stay open. Run logs show the command executed in two cases; whether any tokens with write access were stolen or code changed is unknown. Maintainers were notified and most repos were fixed.
GitHub Actions workflows in public repositoriesSince Sep 1, 2026
