[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftaFEC7-UuPDViUCokLtu5B96f6iubnmwpl19kv1dP9E":3},{"article":4,"iocs":54,"watch_terms":66,"solutions":67,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"da3ef47a-6ae3-470f-9197-697607a1d8f1","Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI\u002FCD Secrets","hackers-target-61-github-repositories-with-command-injection-attacks-to-steal-ci-eca283","Hackers targeted 61 public GitHub repositories in a coordinated command injection campaign designed to steal data from automated development systems. Radware researchers identified 83 malicious issues, pull requests, and comments posted on September 1, 2026, with evidence that injected commands executed inside two GitHub Actions workflows. The findings show how routine project discussions can become […] The post Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI\u002FCD Secrets appeared first on Cyber Security News.","A coordinated campaign targeted 61 public GitHub repositories using command injection attacks within GitHub Actions workflows to steal CI\u002FCD secrets. Attackers posted malicious issues, pull requests, and comments containing Bash command substitution expressions, which were executed by vulnerable workflows. While Radware researchers did not confirm stolen secrets, the attack exploited a common vulnerability in how user-controlled text is handled in shell scripts, highlighting risks to software build systems.","Hackers targeted 61 GitHub repos with command injection to steal CI\u002FCD secrets.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-target-61-github-repositories\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FHackers-Target-61-GitHub-Repositories-With-Command-Injection-Attacks-to-Steal-CI_CD-Secrets.webp","2026-11-02T04:21:41+00:00","2026-11-02T05:00:37.310322+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"GitHub Actions","product",{"name":21,"type":22},"GitHub","vendor",{"name":24,"type":22},"Radware",{"name":26,"type":19},"Google LangExtract",{"name":28,"type":19},"Trivy",{"name":30,"type":19},"Brave Browser","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,63],{"type":56,"value":57,"context":58},"ip","54.205.16.142","IP address used for C2 communication",{"type":60,"value":61,"context":62},"mitre_attack","T1059.004","Command and Scripting Interpreter: Unix Shell",{"type":60,"value":64,"context":65},"T1552.001","Credentials In Plain Text: Access Token\u002FPassword",[21,24,18],{"controls":68,"vendors":152},[69,97,126],{"slug":70,"name":71,"problem":72,"products":73},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[74,81,89],{"vendor_slug":75,"vendor_name":21,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":98,"name":99,"problem":100,"products":101},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":127,"name":128,"problem":129,"products":130},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[131,138,144],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":132,"product_name":135,"url":136,"description":137},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":139,"product_name":140,"url":142,"description":143},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[153],{"slug":75,"name":21,"logo_path":76,"roles":154},[155],"affected",{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":168},"command-injection-in-github-actions-exposes-cicd-secrets-across-61-repositories","Command Injection in GitHub Actions Exposes CI\u002FCD Secrets Across 61 Repositories","Attackers exploited a widespread misconfiguration in GitHub Actions workflows where user-controlled input—such as issue titles, pull request bodies, and comments—was passed directly into shell scripts without sanitization, enabling command injection. This campaign targeted 61 public repositories, demonstrating that insecure CI\u002FCD pipeline design is a systemic, not isolated, problem. The attack vector is particularly dangerous because CI\u002FCD environments often hold highly privileged secrets such as API keys, deployment credentials, and cloud access tokens. Compromising these secrets can cascade into full supply chain attacks, potentially affecting downstream users of the targeted software.",[161,162,163,164,165,166,167],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":169,"MITRE ATT&CK T1566: Phishing":170,"NIST SP 800-53 SI-2: Flaw Remediation":171,"CIS Control 16: Application Software Security":172,"OWASP A06:2021 Vulnerable and Outdated Components":173,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":174,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":175},"NIS2 requires organizations to implement security measures covering incident handling and supply chain security; the targeting of software build pipelines to steal secrets directly threatens the integrity of the software supply chain that NIS2 mandates be protected.","Attackers used social-engineering-adjacent vectors—malicious issues, pull requests, and comments—as the delivery mechanism to trigger vulnerable workflows, paralleling phishing techniques that abuse trusted communication channels.","The vulnerable workflow patterns are documented and known; a structured process for identifying and remediating known-vulnerable code patterns in CI\u002FCD pipelines would have reduced exposure across all 61 repositories.","Command injection is a classic input validation failure; secure software development practices requiring sanitization of all user-controlled input before use in shell contexts would have blocked the attack vector.","Insecure use of GitHub Actions expression interpolation represents a misconfigured component in the build pipeline; treating pipeline dependencies and workflow patterns under a component security review would have flagged this risk.","The insecure interpolation pattern in GitHub Actions workflows is a documented technical vulnerability; a formal vulnerability management process covering CI\u002FCD infrastructure would have identified and remediated it before exploitation.","The root cause was an insecure default pattern in workflow configuration; enforcing secure-by-default pipeline templates and configuration standards would have prevented raw user input from reaching shell commands."]