Latest
●Prompt injection turns up in website HTTP headers, study finds●Nezha dashboard can be crashed by any low-privilege member●MCP Python SDK kept sessions forever, letting memory run out●Nginx UI flaws let MCP tools skip config security checks●Bank of America adds 1,000 contractors to fix Mythos-found bugs●UK stops short of AI rules in Cyber Security Bill●GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos●Attackers target critical Langflow flaw in 1,423 exploit attempts
Friday, 16 October 2026
1 agent hack today▼ 7 vs yesterday (8)
The Agentic TimesPowered byVortal

Incident database

GitHub Actions re-enabled with Mini Shai-Hulud payload still active

Two third-party GitHub Actions previously compromised in a 'Mini Shai-Hulud' supply-chain campaign were re-enabled by their maintainer while still pointing to malicious code, remaining accessible on the GitHub Marketplace for more than a week.

Disclosed 26 September 2026 · Record updated 1 October 2026

Impact

Malicious payload from a supply-chain compromise remained active in re-enabled GitHub Actions for over a week, posing risk to any CI/CD pipelines that used them.

Our coverage

Sources

  1. bleepingcomputer.comhttps://bleepingcomputer.com/news/security/github-actions-re-enabled-with-mini-shai-hulud-payload-still-active