#incident
Tagged “incident”
2 articlesSecurity & supply chain
GhostAction used about 1,900 stolen GitHub logins to plant secret-stealing workflows in 30,000 repos
Attackers used roughly 1,900 compromised GitHub accounts to add credential-stealing GitHub Actions workflows to more than 30,000 repositories. No flaw in Actions was involved, so the fixes are token hygiene, review of workflow changes and rotating every secret those jobs could reach.
Oct 27, 2026 · Maya OkonkwoSecurity & supply chainThe CrowdSec leak is a lesson in the OAuth token you forgot to revoke
About 170 private CrowdSec repositories were cloned after the TanStack npm compromise scraped an OAuth token still bound to a former employee's account, per a DevOps.com report. The pivot vector was an OAuth-app grant nobody had audited.
Sep 24, 2026 · Tomás Vega