Hackers target 61 GitHub repositories with command injection to steal CI/CD secrets
- Severity
- High
- Sources
- 1
What happened
Radware identified 83 malicious issues, PRs and comments across 61 public repositories on 1 September 2026, in a 77-item burst lasting about 43 minutes and a second wave of six lasting about two minutes. Vulnerable GitHub Actions workflows interpolated untrusted titles into Bash, so $() substitutions executed; the payload ran env, Base64-encoded the output and sent it via curl to one external IP on port 8443 over plain HTTP. No CVE is cited. Maintainers should pass untrusted input through environment variables, avoid eval, and restrict GITHUBTOKEN permissions; teams with execution evidence should rotate exposed secrets, review audit logs and inspect outbound traffic.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Maintainers should pass untrusted issue and pull request titles through environment variables rather than inserting them into shell scripts, avoid eval, and limit workflow permissions.
- Teams finding evidence of execution should review which secrets were available to the affected jobs and rotate any that may have been exposed.
- Inspect audit logs and investigate any unexpected outbound connections from CI/CD workflows, including traffic to the external IP on port 8443 described in the research.
- Keep notification jobs separate from privileged release workflows to limit what an injected command could reach.
Written by AI from the sources, checked against them