Latest
●Hidden commands in GitHub issues hit 61 open source repos●Relay service strips sandboxes from Codex and Claude Code●Mem0 memory keys can be forged to read other tenants' chats●vLLM's wildcard CORS default let any website query local servers●Rust zip crate flaw lets archives hide a second filename●Microsoft says agents in Microsoft 365 grew 15-fold in a year●Attacker Poses as AI Crawlers to Hunt for Exposed Credentials●Functype MCP server flaw let tool calls run arbitrary code
Thursday, 29 October 2026
2 agent hacks today▼ 4 vs yesterday (6)
The Agentic TimesPowered byVortal

Incident database

Coordinated GitHub Issues campaign targets CI/CD workflows in 61 repos

Radware researchers found 83 malicious GitHub issues/PRs/comments injected with hidden shell commands across 61 popular open source repositories (including LangExtract, Trivy, Brave, MLflow), aimed at triggering vulnerable CI/CD workflows to exfiltrate credentials and environment variables. Most activity occurred within a 45-minute window using 74 likely-compromised GitHub accounts, suspected to be the work of a single coordinated attacker.

Occurred 1 September 2026 · Disclosed 13 October 2026 · Record updated 29 October 2026

Impact

Malicious hidden commands were injected into GitHub issues/PRs/comments to trigger automated CI/CD workflows, with confirmed execution of attacker commands in at least two cases; full extent of credential theft or code tampering across the 61 affected repositories could not be verified.

Our coverage

Sources

  1. theregister.comhttps://theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153