Radware

Hackers target 61 GitHub repositories with command injection to steal CI/CD secrets

Radware◼ observed 83 malicious issues, pull requests and comments across 61 public GitHub repositories on 1 September 2026, with injected commands executing in two GitHub Actions◆ workflows. The workflows inserted user-controlled titles into Bash shell scripts, so $() substitutions ran, and the payload dumped environment variables, Base64-encoded them and attempted an HTTP POST. Radware did not confirm stolen secrets, repository write access or compromised releases, and some participating accounts may have been hijacked.