An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A GitHub safeguard that pauses
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
About this summary. This is a short excerpt from the description that The Hacker News published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html
Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-97631: Pre-boot RCE in EDK II PXE driver
Posted by Valtteri Vuorikoski on Oct 28 Ars Technica reported on this yesterday so let's have it here too. Copied from the advisory on the edk2 repo: Summary While a…
Upwind secures $400 million to protect AI across endpoints, code, and cloud
Upwind Security has raised $400 million in Series C funding to expand its cloud and AI security platform, bringing the company’s total funding to more than $800 million…
From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolves
Executive Summary In May, Cyble Research & Intelligence Labs (CRIL) documented JOMANGY, a PHP webshell generation deployed by INJ3CTOR3 with self-healing persistence…
Merkle-Tree-Based Verifiable Public Data Auditing for Cloud Object Storage Using Smart Contracts
arXiv:2610.36001v1 Announce Type: new Abstract: Owners of data in cloud object storage cannot directly check whether the provider still keeps every object unchanged…
Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol
arXiv:2610.36108v1 Announce Type: new Abstract: LLM agents increasingly access external tools through the Model Context Protocol (MCP), but the natural-language metadata…
Byte Debt: From an HTTP Header Typo to Cross-User Session Fixation
 # Byte Debt: From an HTTP Header Typo to Cross-User Session Fixation Recently, a…