Loading story…
Researchers and maintainers disclosed multiple GitHub Actions security issues that could let attackers steal credentials or gain code execution in CI/CD pipelines. Sansec and Packagist warned that older Composer releases could print raw GITHUB_TOKEN values into GitHub Actions logs after rejecting GitHub’s newer hyphenated token format, creating a supply-chain risk for PHP projects, especially public repositories and older repositories where the default token still had write access. Composer issued fixes in versions 2.9.8, 2.2.28, and 1.10.28, while GitHub rolled back the token format rollout to reduce immediate exposure.
Separate disclosures showed how workflow design and cache handling can turn limited CI access into broader repository compromise. A newly assigned CVE-2026-42603 affects OWASP BLT before 2.1.2, where a privileged pull_request_target workflow checked out and executed code from an attacker-controlled fork, enabling remote code execution with repository write permissions. Earlier research on GitHub Actions cache poisoning described "Actions Cache Blasting," a technique that abuses client-controlled cache keys, cache eviction, and lingering runtime tokens to replace cached artifacts used by more privileged workflows, potentially leading to secret disclosure, release-signing compromise, and tampered build outputs without visible changes in source code or workflow logs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Packagist and security researchers warned PHP projects to urgently update Composer, review recent CI logs, and investigate suspicious token activity. The guidance emphasized that GitHub's rollback reduced but did not eliminate the need to patch vulnerable Composer installations.
Composer maintainers released fixes in versions 2.9.8, 2.2.28, and 1.10.28 for a flaw that could print raw GitHub Actions GITHUB_TOKEN values into CI logs when validating newer token formats. The bug created supply-chain risk for public repositories and older repositories with read/write default token permissions.
After the Composer compatibility issue surfaced, GitHub temporarily rolled back deployment of the new token format to reduce immediate exposure risk. The rollback was described as a temporary mitigation while users updated affected Composer versions.
CVE-2026-42603 was recorded for the OWASP BLT GitHub Actions vulnerability affecting versions before 2.1.2. The issue was assigned a high-severity CVSS score and linked to a GitHub security advisory.
OWASP BLT fixed a GitHub Actions workflow flaw in version 2.1.2 where `.github/workflows/pre-commit-fix.yaml` used `pull_request_target` while checking out and executing untrusted fork code. The issue could allow remote code execution with repository write permissions.
GitHub started rolling out the new GitHub token format, causing some GitHub Actions workflows using older Composer versions to reject and print tokens in CI logs. The issue particularly affected PHP CI pipelines that registered GITHUB_TOKEN in Composer auth configuration.
GitHub announced a new GitHub App installation token format that included hyphens. This format change later exposed compatibility problems in Composer's token validation logic.
Adnan Khan published research on 'Actions Cache Blasting,' describing how attackers with code execution in a default-branch workflow could steal cache credentials, evict caches, and poison them for more privileged downstream workflows. The write-up included demonstrations against repositories such as angular/angular, mdn/content, hyperledger/besu, google/temporian, and chainguard-dev/terraform-provider-cosign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesansec.io
Open sourcesocket.dev
Open sourceblog.packagist.com
Open sourcegithub.com
Open sourcecvefeed.io
Open sourceadnanthekhan.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors compromised the popular GitHub Actions repositories `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` by moving version tags to imposter commits outside the normal commit history, causing workflows that referenced those tags to fetch and run malicious code. Researchers said the payload downloaded the **Bun** JavaScript runtime, read memory from the GitHub Actions `Runner.Worker` process to recover decrypted secrets, and exfiltrated the data over HTTPS to the attacker-controlled domain `t.m-kosche[.]com`; workflows pinned to a known-good full commit SHA were not affected. GitHub later disabled access to the repository for a terms-of-service violation, while StepSecurity added the action to its Compromised Actions Policy and blocked the exfiltration domain through Harden-Runner. The incident highlights a broader GitHub Actions supply-chain risk in which CI/CD trust can be subverted through mutable references and weak integrity controls. Separate research showed that a modified Maven wrapper in a pull request could achieve code execution on GitHub-hosted runners and, if merged, later expose release secrets such as Maven publishing credentials and GPG material, underscoring the need for checksum validation on wrapper scripts and immutable pinning to trusted commit SHAs for third-party actions. StepSecurity also linked the same exfiltration infrastructure to the recent **Mini Shai-Hulud** activity targeting npm packages in the `@antv` ecosystem, suggesting the GitHub Actions compromise may be part of a wider supply-chain campaign.
Jun 29, 2026
A critical flaw in **Gitea `act_runner`** and a separate compromise of popular **GitHub Actions** highlighted how CI/CD platforms can be turned into high-impact attack paths. In Gitea, **`CVE-2026-58053`** allows a user with workflow execution privileges to escape a Docker-backed job container and gain **root access on the host** by abusing unsafe Docker options merged from `container.options`, including `--pid=host`, `--cap-add`, and `--security-opt`. The issue affects Docker-backed `act_runner` deployments through version `0.262.0`, putting source code, build systems, and deployment credentials at risk. In the GitHub ecosystem, attackers compromised tags for **`tj-actions/changed-files`** and several **reviewdog** actions in a supply-chain campaign tracked as **`CVE-2025-30066`** and **`CVE-2025-30154`**, causing CI/CD secrets to be written into workflow logs and potentially exposed, especially in public repositories. Reporting tied the activity to an intrusion that likely began with Coinbase-related targets before expanding more broadly. Defenders were urged to upgrade vulnerable Gitea runners, restrict workflow container options, audit workflows and logs, remove affected actions, rotate exposed secrets, preserve and then delete compromised logs, and pin GitHub Actions to full commit hashes.
Jul 7, 2026The widely used GitHub Action **`tj-actions/changed-files`** was compromised after an attacker gained write access to the repository and retargeted release tags to a malicious orphaned commit, causing workflows pinned to tags rather than immutable SHAs to run attacker-controlled code. The backdoor downloaded and executed a remote payload that scraped decrypted GitHub Actions secrets from process memory and printed them into workflow logs, exposing repositories that executed the action and creating acute risk for public projects where logs were openly accessible. The incident was detected after anomalous outbound network activity was observed, and the maintainer removed the malicious changes soon afterward. Follow-on analysis found the blast radius was substantial because the action was referenced across roughly **23,000 repositories** and many workflows were not pinned to a full commit hash. GitGuardian reported that among workflows executed during the compromise window, hundreds showed signs of exploitation and **603 secrets** were exposed in logs, including temporary GitHub tokens, DockerHub credentials, AWS keys, GitHub personal access tokens, Jira tokens, and cloud.gov credentials. Organizations using the action were urged to review workflow runs from March 14 onward, delete affected logs, rotate any exposed credentials, audit dependencies and commits, and pin third-party GitHub Actions to full commit SHAs to reduce future supply-chain risk.
Jun 29, 2026