pwn.watch: GitHub incident updates https://pwn.watch/t/github Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 16:23:59 GMT [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: OpenSourceMalware finds a second stage in 94 repos: VS Code tasks.json autoruns a stealer hidden in a fake Font Awesome .woff2 and installs a 5-minute cron. https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-16:OpenSourceMalware finds a second stage in 94 repos: VS Code tasks.json autoruns a stealer hidden in a fake Font Awesome .woff2 and installs a 5-minute cron. Fri, 16 Oct 2026 00:00:00 GMT high Source: https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file Status: live, partial [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: GitGuardian update: Oct 8-12 wave targeted 30,000+ repos across ~3,000 users/orgs from ~1,900 compromised accounts; 3,174 secrets targeted. https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-13:GitGuardian update: Oct 8-12 wave targeted 30,000+ repos across ~3,000 users/orgs from ~1,900 compromised accounts; 3,174 secrets targeted. Tue, 13 Oct 2026 00:00:00 GMT high Source: https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/ Status: live, partial [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: Phishing kit on my-github.com steals password + 2FA and silently authorizes an OAuth app with repo/workflow scopes. https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-11:Phishing kit on my-github.com steals password + 2FA and silently authorizes an OAuth app with repo/workflow scopes. Sun, 11 Oct 2026 00:00:00 GMT high Source: https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html Status: live, partial [critical] SubQuery @subql/common 5.8.3 published with credential stealer + backdoor: SubQuery maintainer: compromised token deleted, security review started. https://pwn.watch/i/subql-common-npm-backdoor subql-common-npm-backdoor:2026-10-10:SubQuery maintainer: compromised token deleted, security review started. Sat, 10 Oct 2026 00:00:00 GMT critical Source: https://github.com/subquery/subql/issues/3047 Status: closed, patched [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: Socket counts 500+ accounts committing the workflow to tens of thousands of repos; GitHub starts preventing the workflow from running; my-github.com registered. https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-09:Socket counts 500+ accounts committing the workflow to tens of thousands of repos; GitHub starts preventing the workflow from running; my-github.com registered. Fri, 09 Oct 2026 00:00:00 GMT high Source: https://socket.dev/blog/ghostaction-cloud-credentials Status: live, partial [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: Accounts of pyxel author Takashi Kitao (27 repos, 13:20 UTC) and henrywoo (318 repos in 16 min, incl. uber/athenadriver) push security-audit.yml; run logs confirm exfiltration. https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-08:Accounts of pyxel author Takashi Kitao (27 repos, 13:20 UTC) and henrywoo (318 repos in 16 min, incl. uber/athenadriver) push security-audit.yml; run logs confirm exfiltration. Thu, 08 Oct 2026 00:00:00 GMT high Source: https://www.stepsecurity.io/blog/ghostaction-returns Status: live, partial [critical] tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token: 0.5.144 published via the project’s release workflow. https://pwn.watch/i/tensorlake-npm-shai-hulud-worm tensorlake-npm-shai-hulud-worm:2026-10-08:0.5.144 published via the project’s release workflow. Thu, 08 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token: StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke. https://pwn.watch/i/tensorlake-npm-shai-hulud-worm tensorlake-npm-shai-hulud-worm:2026-10-08+:StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke. Thu, 08 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token: Malicious commits land on tensorlakeai/tensorlake main. https://pwn.watch/i/tensorlake-npm-shai-hulud-worm tensorlake-npm-shai-hulud-worm:2026-10-07:Malicious commits land on tensorlakeai/tensorlake main. Wed, 07 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] SubQuery @subql/common 5.8.3 published with credential stealer + backdoor: GMO Flatt Security publishes payload analysis and response guidance. https://pwn.watch/i/subql-common-npm-backdoor subql-common-npm-backdoor:2026-10-06:GMO Flatt Security publishes payload analysis and response guidance. Tue, 06 Oct 2026 00:00:00 GMT critical Source: https://flatt.tech/research/posts/subql-common-npm-supply-chain-attack/ Status: closed, patched [critical] SubQuery @subql/common 5.8.3 published with credential stealer + backdoor: Malicious @subql/common 5.8.3 published via the repo's GitHub Actions trusted publisher (canary 5.8.3-onf-rt1 published ~32 min earlier). https://pwn.watch/i/subql-common-npm-backdoor subql-common-npm-backdoor:2026-10-05T11:56Z:Malicious @subql/common 5.8.3 published via the repo's GitHub Actions trusted publisher (canary 5.8.3-onf-rt1 published ~32 min earlier). Mon, 05 Oct 2026 00:00:00 GMT critical Source: https://www.stepsecurity.io/blog/subql-ecosystem-compromised Status: closed, patched [critical] SubQuery @subql/common 5.8.3 published with credential stealer + backdoor: StepSecurity opens security issue #3047 in subquery/subql. https://pwn.watch/i/subql-common-npm-backdoor subql-common-npm-backdoor:2026-10-05T12:14Z:StepSecurity opens security issue #3047 in subquery/subql. Mon, 05 Oct 2026 00:00:00 GMT critical Source: https://github.com/subquery/subql/issues/3047 Status: closed, patched [critical] SubQuery @subql/common 5.8.3 published with credential stealer + backdoor: GitHub publishes malware advisory GHSA-9333-3c4x-x3h5; version removed from npm (~50 minutes live); 'latest' back to 5.8.2. https://pwn.watch/i/subql-common-npm-backdoor subql-common-npm-backdoor:2026-10-05T12:46Z:GitHub publishes malware advisory GHSA-9333-3c4x-x3h5; version removed from npm (~50 minutes live); 'latest' back to 5.8.2. Mon, 05 Oct 2026 00:00:00 GMT critical Source: https://github.com/advisories/GHSA-9333-3c4x-x3h5 Status: closed, patched [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: 2026 resurgence: 772 public repos and 2,577 secrets targeted between Aug 31 and Sep 30; new exfil IP 193.32.204.199 in use from ~Sep 4. https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-08-31:2026 resurgence: 772 public repos and 2,577 secrets targeted between Aug 31 and Sep 30; new exfil IP 193.32.204.199 in use from ~Sep 4. Mon, 31 Aug 2026 00:00:00 GMT high Source: https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/ Status: live, partial [critical] CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages): keyv/cacheable malicious releases observed; worm begins propagating. https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august shai-hulud-chaindrop-npm-keyv-august:2026-08-04:keyv/cacheable malicious releases observed; worm begins propagating. Tue, 04 Aug 2026 00:00:00 GMT critical Status: closed, partial [critical] CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages): Microsoft, Elastic, JFrog publish analyses; 400+ packages listed. https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august shai-hulud-chaindrop-npm-keyv-august:2026-08-04/06:Microsoft, Elastic, JFrog publish analyses; 400+ packages listed. Tue, 04 Aug 2026 00:00:00 GMT critical Status: closed, partial [critical] TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions: Trivy compromise disclosed; Microsoft guidance published. https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain teampcp-trivy-checkmarx-supply-chain:2026-03:Trivy compromise disclosed; Microsoft guidance published. Sun, 01 Mar 2026 00:00:00 GMT critical Status: closed, patched [critical] TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions: Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates). https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain teampcp-trivy-checkmarx-supply-chain:2026-03:Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates). Sun, 01 Mar 2026 00:00:00 GMT critical Status: closed, patched [critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS: GitHub privatizes malicious repos; public count drops to ~300 https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-26:GitHub privatizes malicious repos; public count drops to ~300 Wed, 26 Nov 2025 00:00:00 GMT critical Source: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack Status: closed, patched [critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS: PostHog publishes its post-mortem https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-26:PostHog publishes its post-mortem Wed, 26 Nov 2025 00:00:00 GMT critical Source: https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem Status: closed, patched [critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS: First compromised package published (03:10 UTC) https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-24:First compromised package published (03:10 UTC) Mon, 24 Nov 2025 00:00:00 GMT critical Source: https://panther.com/blog/a-data-driven-analysis-of-the-sha1-hulud-2-0-campaign Status: closed, patched [critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS: PostHog SDKs compromised (04:11 UTC); removed and tokens revoked by 09:30 UTC https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-24:PostHog SDKs compromised (04:11 UTC); removed and tokens revoked by 09:30 UTC Mon, 24 Nov 2025 00:00:00 GMT critical Source: https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem Status: closed, patched [critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS: Postman unpublishes 17 infected packages (51 versions) https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-24:Postman unpublishes 17 infected packages (51 versions) Mon, 24 Nov 2025 00:00:00 GMT critical Source: https://blog.postman.com/engineering/shai-hulud-2-0-npm-supply-chain-attack/ Status: closed, patched [critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS: Last compromised package seen (~17:00-18:00 UTC) https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-24:Last compromised package seen (~17:00-18:00 UTC) Mon, 24 Nov 2025 00:00:00 GMT critical Source: https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/ Status: closed, patched [critical] Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: CISA alert: widespread supply chain compromise impacting npm (500+ packages) https://pwn.watch/i/shai-hulud-npm-worm-september-2025 shai-hulud-npm-worm-september-2025:2025-09-23:CISA alert: widespread supply chain compromise impacting npm (500+ packages) Tue, 23 Sep 2025 00:00:00 GMT critical Source: https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem Status: closed, patched [critical] Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: Largest burst, nearly 100 packages, including @crowdstrike scope https://pwn.watch/i/shai-hulud-npm-worm-september-2025 shai-hulud-npm-worm-september-2025:2025-09-16:Largest burst, nearly 100 packages, including @crowdstrike scope Tue, 16 Sep 2025 00:00:00 GMT critical Source: https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages Status: closed, patched [critical] Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: Worm discovered; @ctrl/tinycolor and ~40 packages found compromised https://pwn.watch/i/shai-hulud-npm-worm-september-2025 shai-hulud-npm-worm-september-2025:2025-09-15:Worm discovered; @ctrl/tinycolor and ~40 packages found compromised Mon, 15 Sep 2025 00:00:00 GMT critical Source: https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages Status: closed, patched [critical] Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: First compromised versions published (17:58 UTC) https://pwn.watch/i/shai-hulud-npm-worm-september-2025 shai-hulud-npm-worm-september-2025:2025-09-14:First compromised versions published (17:58 UTC) Sun, 14 Sep 2025 00:00:00 GMT critical Source: https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages Status: closed, patched [high] GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos: GitGuardian first documents GhostAction: 817 repos, 327 users, 3,325+ secrets stolen. (Earlier campaign, for context.) https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2025-09:GitGuardian first documents GhostAction: 817 repos, 327 users, 3,325+ secrets stolen. (Earlier campaign, for context.) Mon, 01 Sep 2025 00:00:00 GMT high Source: https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/ Status: live, partial [critical] s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed: Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-28/29:Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens Thu, 28 Aug 2025 00:00:00 GMT critical Source: https://www.wiz.io/blog/s1ngularity-supply-chain-attack Status: closed, patched [critical] s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed: GitHub disables attacker-created s1ngularity repositories (09:00 UTC) https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-27:GitHub disables attacker-created s1ngularity repositories (09:00 UTC) Wed, 27 Aug 2025 00:00:00 GMT critical Source: https://www.wiz.io/blog/s1ngularity-supply-chain-attack Status: closed, patched [critical] s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed: Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-26:Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening Tue, 26 Aug 2025 00:00:00 GMT critical Source: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c Status: closed, patched [critical] s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed: Attacker exploits the workflow and exfiltrates the npm token https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-24:Attacker exploits the workflow and exfiltrates the npm token Sun, 24 Aug 2025 00:00:00 GMT critical Source: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c Status: closed, patched [critical] s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed: A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-21:A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx Thu, 21 Aug 2025 00:00:00 GMT critical Source: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c Status: closed, patched [high] reviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability: CISA added CVE-2025-30154 to the KEV catalog (due 2025-04-14). https://pwn.watch/i/reviewdog-action-setup-github-action-cve-2025-30154 reviewdog-action-setup-github-action-cve-2025-30154:2025-03-24:CISA added CVE-2025-30154 to the KEV catalog (due 2025-04-14). Mon, 24 Mar 2025 00:00:00 GMT high Status: closed, patched [critical] tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs: tj-actions and reviewdog maintainers finish remediation https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066 tj-actions-changed-files-supply-chain-cve-2025-30066:2025-03-20:tj-actions and reviewdog maintainers finish remediation Thu, 20 Mar 2025 00:00:00 GMT critical Source: https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/ Status: closed, patched [critical] tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs: CISA adds CVE-2025-30066 to KEV; reviewdog actions found compromised too https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066 tj-actions-changed-files-supply-chain-cve-2025-30066:2025-03-18:CISA adds CVE-2025-30066 to KEV; reviewdog actions found compromised too Tue, 18 Mar 2025 00:00:00 GMT critical Status: closed, patched [critical] tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs: GitHub removes the action, then restores a cleaned repository https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066 tj-actions-changed-files-supply-chain-cve-2025-30066:2025-03-15:GitHub removes the action, then restores a cleaned repository Sat, 15 Mar 2025 00:00:00 GMT critical Source: https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised Status: closed, patched [critical] tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs: Coinbase agentkit runs the malicious action and leaks a write token (15:10 UTC) https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066 tj-actions-changed-files-supply-chain-cve-2025-30066:2025-03-14:Coinbase agentkit runs the malicious action and leaks a write token (15:10 UTC) Fri, 14 Mar 2025 00:00:00 GMT critical Source: https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/ Status: closed, patched [critical] tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs: All tj-actions/changed-files tags replaced with malicious commits (16:57 UTC); StepSecurity detects it https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066 tj-actions-changed-files-supply-chain-cve-2025-30066:2025-03-14:All tj-actions/changed-files tags replaced with malicious commits (16:57 UTC); StepSecurity detects it Fri, 14 Mar 2025 00:00:00 GMT critical Source: https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised Status: closed, patched [critical] tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs: Malicious commit pushed to reviewdog/action-setup v1 tag https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066 tj-actions-changed-files-supply-chain-cve-2025-30066:2025-03-11:Malicious commit pushed to reviewdog/action-setup v1 tag Tue, 11 Mar 2025 00:00:00 GMT critical Reverted about two hours later. Source: https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/ Status: closed, patched [high] Ultralytics PyPI releases backdoored with a crypto miner: PyPI publishes its analysis: 8.3.41, 8.3.42, 8.3.45 and 8.3.46 affected and removed https://pwn.watch/i/ultralytics-pypi-supply-chain-attack ultralytics-pypi-supply-chain-attack:2024-12-11:PyPI publishes its analysis: 8.3.41, 8.3.42, 8.3.45 and 8.3.46 affected and removed Wed, 11 Dec 2024 00:00:00 GMT high Source: https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/ Status: closed, patched [high] Ultralytics PyPI releases backdoored with a crypto miner: Issue #18027: published 8.3.41 wheel differs from GitHub and runs an XMRig miner https://pwn.watch/i/ultralytics-pypi-supply-chain-attack ultralytics-pypi-supply-chain-attack:2024-12-05:Issue #18027: published 8.3.41 wheel differs from GitHub and runs an XMRig miner Thu, 05 Dec 2024 00:00:00 GMT high Source: https://github.com/ultralytics/ultralytics/issues/18027 Status: closed, patched [high] Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link: Public disclosure by Wiz and Microsoft https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023 microsoft-ai-research-sas-token-38tb-exposure-2023:2023-09-18:Public disclosure by Wiz and Microsoft Mon, 18 Sep 2023 00:00:00 GMT high Source: https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers Status: closed, patched [high] Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link: Microsoft revokes the SAS token https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023 microsoft-ai-research-sas-token-38tb-exposure-2023:2023-06-24:Microsoft revokes the SAS token Sat, 24 Jun 2023 00:00:00 GMT high Source: https://msrc.microsoft.com/blog/2023/09/microsoft-mitigated-exposure-of-internal-information-in-a-storage-account-due-to-overly-permissive-sas-token/ Status: closed, patched [high] Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link: Wiz reports the exposure to Microsoft https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023 microsoft-ai-research-sas-token-38tb-exposure-2023:2023-06-22:Wiz reports the exposure to Microsoft Thu, 22 Jun 2023 00:00:00 GMT high Source: https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers Status: closed, patched [medium] GitHub's RSA SSH host key briefly exposed in a public repo: GitHub replaces its RSA SSH host key; users must update known_hosts https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023 github-rsa-ssh-host-key-exposed-2023:2023-03-24:GitHub replaces its RSA SSH host key; users must update known_hosts Fri, 24 Mar 2023 00:00:00 GMT medium Source: https://github.blog/news-insights/company-news/we-updated-our-rsa-ssh-host-key/ Status: closed, patched