Security & supply chainGhostAction used about 1,900 stolen GitHub logins to plant secret-stealing workflows in 30,000 repos
Attackers used roughly 1,900 compromised GitHub accounts to add credential-stealing GitHub Actions workflows to more than 30,000 repositories. No flaw in Actions was involved, so the fixes are token hygiene, review of workflow changes and rotating every secret those jobs could reach.