Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz recovered over 13,500 planted branches from 850-plus accounts; GitHub’s public-repo hold does not cover private repos.
74
Organization
Wiz Research
- Mentions · 7d3
- Mentions · 30d4
- All mentions8
- First seenAug 26, 2026
- Last mentioned3d ago
Timeline
8 articles · newest firstGheist uses stolen GitHub tokens to harvest cloud secrets
Wiz counts more than 13,500 malicious branches on over 850 accounts, still active as of October 24.
76
Gheist abuses stolen GitHub tokens to dump repository secrets
Wiz found more than 13,500 planted branches on over 850 accounts; public runs are held, but private and enterprise repos still execute.
76
PHP patches two leaked critical core RCE flaws after early disclosure
Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; watchTowr reports no observed attacks.
86
Securing the Kubernetes Supply Chain: Introducing WizOS Helm Charts
Wiz releases hardened WizOS Helm charts after finding supply-chain risks in 61 popular chart repositories.
46
Hackers Exploit JFrog Artifactory Flaws to Bypass Authentication and Gain Admin Access
Wiz Research observes multiple attackers exploiting three JFrog Artifactory flaws, including default-configuration authentication bypass CVE-2026-82329, to gain admin access and deploy backdoors.
84
Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
Wiz Research confirms in-the-wild exploitation of three JFrog Artifactory vulnerabilities, chained to gain administrative control, deploy Groovy plugins, and install Rust backdoors.
85
The State of Cloud Risk 2026: Most Security Findings Aren’t Real Attacker Opportunities
Wiz Research's 2026 cloud risk report finds most high-severity findings lack a viable path to compromise, urging exposure-based prioritization.
35
Related CVEs
by mentions- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-420169%8.8Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory
- CVE-2026-4201810%7.5Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- Wizvendor · 4
- GitHubvendor · 3
- GitHub Actionsproduct · 2
- GitHub Enterprise Serverproduct · 2
- JFrog Artifactoryproduct · 2
- JFrogvendor · 2
- Gheistmalware · 2
- PolinRidermalware · 1
- WizOSproduct · 1
- Meilisearchproduct · 1
- Kubernetesproduct · 1
- watchTowrorganization · 1
- Gheistthreat actor · 1
- PHPvendor · 1
- Rust backdoormalware · 1
- Artifact Huborganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.