[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwtTg4WCLq10s1ueydYz0Mhv1tp7dlfNlELD7IMt4ruU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":55},"3e1664ba-0071-4477-9f83-df48ed0599d5","re-enabled-compromised-github-actions-expose-cicd-pipelines-to-malicious-payloads","84ecc4b0-b9ab-4d3a-981b-1b4c954ccb97","Re-enabled Compromised GitHub Actions Expose CI\u002FCD Pipelines to Malicious Payloads","The root cause here is a failure in supply chain security combined with inadequate post-incident controls — a maintainer inadvertently re-enabled previously compromised GitHub Actions without verifying their integrity, leaving malicious code active for over a week. CI\u002FCD pipelines are high-value attack targets because they operate with elevated permissions and access to secrets, meaning any malicious code injected at this layer can exfiltrate credentials, tamper with build artifacts, or pivot into production environments. This incident highlights that incident remediation is not complete simply because a threat is initially removed; re-introduction vectors must be anticipated and controlled. Organizations that pin Actions to specific commit SHAs rather than mutable tags dramatically reduce this risk, as tag re-pointing is a known and exploited attack technique.","**Immediate actions:**\n- Audit all GitHub Actions workflows to identify any usage of the affected actions and replace or remove them immediately.\n- Rotate all secrets, tokens, and environment variables accessible to workflows that ran during the re-exposure window.\n- Pin all third-party GitHub Actions to a specific, verified commit SHA rather than a mutable version tag or branch reference.\n\n**Long-term improvements:**\n- Establish a software bill of materials (SBOM) for CI\u002FCD dependencies and review it on a scheduled cadence to detect unexpected changes.\n- Implement a policy requiring security review and approval before any third-party Action is added or re-enabled in organizational repositories.\n- Create an allow-list of approved Actions enforced via repository rulesets or organization-level policies to prevent unauthorized reintroduction.\n\n**Detection measures:**\n- Enable GitHub audit log streaming and alert on events where Actions are re-enabled, updated, or newly referenced in workflow files.\n- Integrate a CI\u002FCD security scanner (e.g., StepSecurity, Semgrep) into the pipeline to continuously verify Action integrity and flag SHA mismatches.\n- Monitor outbound network connections from runner environments to detect unexpected data exfiltration consistent with payload execution.",[12,13,14,15,16,17,18,19,20],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161r1: Supply Chain Risk Management Practices","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 IR-4: Incident Handling","NIST SP 800-53 CM-3: Configuration Change Control","SLSA Supply Chain Integrity Framework (Levels 2–3)","OWASP CI\u002FCD Security Top 10: CICD-SEC-6 (Insufficient Credential Hygiene)","OWASP CI\u002FCD Security Top 10: CICD-SEC-3 (Dependency Chain Abuse)",{},"published","2026-09-26T20:21:26.292426+00:00","2026-09-26T20:21:26.201+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fgithub-actions-re-enabled-with-mini-shai-hulud-payload-still-active\u002F","github-actions-re-enabled-with-mini-shai-hulud-payload-still-active-fa5c03","GitHub Actions re-enabled with Mini Shai-Hulud payload still active",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":37,"name":38,"slug":39,"description":40,"color":41},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":43,"name":44,"slug":45,"description":46,"color":47},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[49],{"id":50,"date":51,"edition":52,"title":53,"audio_url":54},"13c8d089-3c57-4fc1-a760-c0f278e03864","2026-09-27","morning","ThreatNoir Weekend Brief — September 27","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-27\u002Fthreatnoir-morning-brief-2026-09-27.mp3",[56,60,64],{"slug":57,"name":58,"problem":59},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":61,"name":62,"problem":63},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":65,"name":66,"problem":67},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]