Hackers target 61 GitHub repositories with command injection to steal CI/CD secrets
VULNERABILITYredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Radware observed 83 malicious issues, pull requests and comments across 61 public GitHub repositories on 1 September 2026, with injected commands executing in two GitHub Actions workflows. The workflows inserted user-controlled titles into Bash shell scripts, so $() substitutions ran, and the payload dumped environment variables, Base64-encoded them and attempted an HTTP POST. Radware did not confirm stolen secrets, repository write access or compromised releases, and some participating accounts may have been hijacked.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Maintainers should pass untrusted issue and pull request titles through environment variables rather than inserting them into shell scripts, avoid eval, and limit workflow permissions.
- Teams finding evidence of execution should review which secrets were available to the affected jobs and rotate any that may have been exposed.
- Inspect audit logs and investigate any unexpected outbound connections from CI/CD workflows, including traffic to the external IP on port 8443 described in the research.
- Keep notification jobs separate from privileged release workflows to limit what an injected command could reach.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News