GitHub mitigates Actions, Pages and Webhooks degradation
Root-cause investigation continues after errors also hit code search and live updates.
32
Product
GitHub Actions
- Mentions · 7d9
- Mentions · 30d30
- All mentions42
- First seenAug 17, 2026
- Last mentioned8h ago
Timeline
42 articles · newest firstGhostAction GitHub campaign slows after hitting tens of thousands of repos
GitGuardian says the operator pushed 72,000 commits to 23,000 public repositories from October 13 to 21.
68
Gheist harvests secrets through malicious GitHub Actions workflows
Wiz tracked more than 13,500 malicious branches on over 850 accounts since September 15, including private enterprise repositories.
76
Attackers hit 42 GitHub repos with files too large to search
Oversized wrappers and a native addon hid one CI-publisher payload while an npm worm stole tokens and spread through Actions.
76
Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz recovered over 13,500 planted branches from 850-plus accounts; GitHub’s public-repo hold does not cover private repos.
74
Gheist used stolen GitHub tokens to steal secrets from 850 accounts
Workflows on more than 13,500 branches logged secrets; public runs were held, while private and Enterprise Server runs completed.
74
GitHub Actions pwn-request fixes still leave checkout gaps
Old actions/checkout SHA pins and triggers such as issue_comment can still run fork code with secrets.
64
Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz found over 13,500 planted branches from more than 850 accounts; GitHub held public runs but not private ones.
76
Gheist abuses stolen GitHub tokens to dump repository secrets
Wiz found more than 13,500 planted branches on over 850 accounts; public runs are held, but private and enterprise repos still execute.
76
GitHub delays pull requests, webhooks, and Actions
GitHub says event-streaming hotspots are still slowing pull request updates, webhook deliveries, and audit log events.
36
GhostAction workflows in 790 GitHub repos hunt cloud and AI keys
OpenSourceMalware's count through October 9 is validated public repos, not proof that every one leaked secrets.
74
GhostAction plants malicious workflows in 790 GitHub repositories
October payloads mine full Git history for cloud and AI keys and post them over HTTP to 193.32.204.199.
76
GitHub Actions, Pages, and Webhooks hit by degraded availability
GitHub said customers may see delays in workflow runs, site builds, and webhook delivery while it investigates.
28
GhostAction plants font-disguised stealer in 94 GitHub repositories
Phishing via my-github.com steals GitHub passwords, 2FA, and OAuth tokens, then a VS Code task runs a credential stealer.
64
Roundup cites infostealers, malicious packages and ClickFix as rising malware trends
Immersive says Lumma Stealer, StealC and RisePro now account for 75% of stolen credentials sold for initial access.
34
GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories
GhostAction hid credential-stealing Node.js malware in fake font files across 94 GitHub repositories.
76
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
GhostAction compromised about 1,900 GitHub accounts and pushed malicious workflows to steal CI secrets from tens of thousands of repositories.
82
AI-generated changes create review bottlenecks in software delivery
JetBrains finds most DevOps teams run CI/CD, while AI-generated changes slow code reviews.
34
Over 1,500 npm packages exposed by Trusted Publishing validation flaw
A now-fixed npm Trusted Publishing flaw exposed over 1,500 packages to repository-name hijacks.
74
Incident with Actions, Pull Requests and Issues
GitHub mitigated degraded Actions, Issues, and Pull Requests, with notification delays still being fixed.
7
Python 3.15.0 added to actions/python-versions
Python 3.15.0 is now available in GitHub Actions python-versions for CI test matrices.
6
GhostAction Hackers Compromise 500+ GitHub Accounts to Steal Cloud and AI API Credentials
GhostAction compromised 500-plus GitHub accounts and planted workflows that steal cloud and AI API credentials.
80
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
GhostAction compromised maintainer accounts to plant credential-stealing GitHub Actions workflows in tens of thousands of repositories.
82
New GhostAction Attack Compromises Hundreds of GitHub Repos to Steal Secrets
GhostAction hit 346 GitHub repositories, including Uber's, with malicious Actions workflows that stole CI secrets.
82
GhostAction Supply Chain Campaign Uses Malicious GitHub Actions to Steal CI/CD Credentials
GhostAction hit 772 GitHub repositories with malicious Actions workflows that stole CI/CD secrets.
78
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
ChainDrop and North Korea-linked PolinRider use blockchain C2 to steal cloud and CI/CD credentials.
78
Hackers Abuse GitHub Actions to Steal SSH Keys, Cloud Credentials and Access Tokens
GhostAction abused GitHub Actions workflows to steal SSH keys and cloud credentials from public repositories.
74
GitHub Incident with Git Operations, Pull Requests and Actions
GitHub reported a short outage degrading Git operations, pull requests, Actions, webhooks, and issues.
6
GitHub Actions Has Problems
GitHub Actions is degraded by delays assigning hosted runners and starting workflows.
6
Hackers Are Turning Trusted Software Updates Into Credential-Stealing Malware
Supply-chain worms in npm packages, including Nx, steal developer credentials and can enlist local AI coding tools.
76
GitHub Actions re-enabled with Mini Shai-Hulud payload still active
Two compromised GitHub Actions stayed live for nine days still serving the Mini Shai-Hulud payload.
78
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Re-enabled GitHub Actions again executed Mini Shai-Hulud payloads that stole CI/CD credentials.
78
GitHub App keys can still enable takeovers long after they are forgotten
GitGuardian found 474 still-valid leaked GitHub App keys that can enable repository access and organization takeovers.
73
Hundreds of Leaked GitHub App Keys Still Authenticate
GitGuardian found 474 leaked GitHub App private keys still authenticate, some with organization admin rights.
76
Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
Compromised MemTensor packages on npm and PyPI deliver a cross-platform credential stealer, using stolen GitHub Actions tokens for distribution.
80
Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign
Attackers abused npm trusted publishing to ship the GHAPPIER loader via a legitimate package in the North Korea-linked PolinRider campaign.
72
AI Coding Tools Now a Prime Target for Threat Actors, Google Warns
Google Threat Intelligence Group warns threat actors increasingly target AI coding tools and proprietary AI data, with UNC6780's Dustmaker enabling large-scale supply chain compromises.
75
Extortion crews have their eyes on high-value AI data, Google warns
Google's Mandiant warns extortion crews now steal proprietary AI models, prompts, and research for ransom, while threat actors automate attacks with agentic AI.
70
Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means
GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.
55
50,000 Stripe Secrets Leaked in Public Code
Over 50,000 Stripe merchant API keys leaked via public code and logs; 659 merchant accounts' data offered on trading forum.
60
Appears with
- GitHubvendor · 31
- GitHuborganization · 18
- GitGuardianorganization · 12
- npmproduct · 10
- Socketorganization · 10
- GhostActionthreat actor · 10
- Wizorganization · 6
- GitHub Enterprise Serverproduct · 5
- Shai-Huludmalware · 5
- StepSecurityorganization · 5
- PyPIproduct · 5
- GitHubproduct · 4
- PolinRidermalware · 4
- Microsoftvendor · 3
- Visual Studio Codeproduct · 3
- GhostActionmalware · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.