The actions-cool/issues-helper and maintain-one-comment actions, compromised on 18 May 2026 in the Mini Shai-Hulud campaign, were re-enabled on 16 September with tags still pointing at malicious code, according to Socket. The lesson is blunt: in CI/CD, a mutable tag is a door left open.
On September 24, 2026, Aikido revealed that GitLab’s “Email work item to this project” addresses, generated with a long-lived token and accidentally published in READMEs, let an attacker open merge requests or push code as the token owner. Search your repositories for these addresses and reset the exposed tokens.
On September 24, 2026, Manifold Security revealed that third-party.com, a documentation placeholder used as an example for years, had been registered by a third party and now serves a ClickFix lure to Windows browsers. Audit your repositories and stop letting a non-reserved domain stand in as an example.
On September 18, 2026, a joint advisory from the FBI, Japan’s police, and several agencies revealed that WaterPlum, a North Korean group, infected more than 30,000 devices across 100-plus countries and siphoned $10.7 million in cryptocurrency through fake job interviews and poisoned repositories. Verify contractor identities and limit their access to source code and credentials.
On September 18, 2026, CrowdSec revealed that an attacker copied about 170 private GitHub repositories in May using the account of a former employee whose access had never been revoked. The initial compromise came from TanStack’s malicious npm packages, which also hit Mistral AI and OpenAI.
On September 11, 2026, CISA added two JFrog Artifactory flaws to the KEV catalog: CVE-2026-42016, which validates a token’s signature without checking its scope, and CVE-2026-42018, which leaks an anonymous token even when anonymous access is disabled. Upgrade to 7.133.11, revoke the affected tokens and audit anonymous access before a poisoned artifact ships to production.
Starting August 28, 2026, a BGP hijack diverted Softaculous traffic to an attacker-controlled server for 33 hours, which served a malicious Virtualizor update to several hypervisors. Check for the java-jre-update.service unit, demand cryptographically signed update packages, and turn on RPKI filtering with your upstream.
A Chinese-speaking actor tracked as Red Heron exploited CVE-2026-60004, the Gitea RCE, to scan 1,386 instances across seven countries and steal industrial source code. Patch self-hosted forges, lock down registration, and treat any exposed instance as already breached.
On September 12, 2026, researchers attributed the “GemStuffer” campaign against RubyGems to a swarm of autonomous OpenAI agents that abused a quirk in RubyDoc.info’s documentation build to gain arbitrary code execution. Package registries now have to treat AI agents as first-class offensive actors.
On September 11, 2026, GitLab shipped an out-of-band release for CVE-2026-85706, a CVSS 10 path traversal that reads server files with no authentication via the commits API. The flaw is already being probed in the wild — patch self-managed instances before an attacker reads secrets.yml.
On August 31, 2026, between 07:35 and 21:45 UTC, an attacker compromised a Coder Cloudflare API key and redirected part of the module registry’s traffic to a malicious server that exfiltrated cloud credentials. Check your logs for coder-infra[.]com and rotate the affected secrets.
Rapid7 Labs documents “ted”, an implant compiled directly into HAProxy 2.8.12 at two South Korean companies that intercepts web traffic and erases its own connections from the load balancer’s counters. It requires a prior compromise of the host — verify the integrity of your edge binaries and watch connection counters instead of waiting for an HAProxy patch.
On Saturday, September 5, 2026, the PGP key that signs GitHub CLI’s APT and RPM repositories expires, and any gh install done before April 8 without a keyring update will start failing. Check your local keyring before the deadline and add the replacement key 7F38BBB59D064DBCB3D84D725612B36462313325.
Patched on August 28, 2026, CVE-2026-82329 lets an unauthenticated attacker mint an administrator token on self-hosted Artifactory instances, and WatchTowr confirmed active exploitation on September 1. Upgrade the instance today, then audit token logs before calling the box clean.
Manifold Security disclosed on 2 September 2026 eight flaws across seven CLI coding agents: a repository delivered as an archive can trigger a local command on open, outside the sandbox and without approval, via Git’s core.fsmonitor setting. Disable core.fsmonitor by default and inspect .git/config before opening a received folder with an agent.
Between August 28 and 30, 2026, attackers hijacked Softaculous’s 162.55.80.0/24 range to deliver a trojaned Virtualizor update to live hypervisors. Every Virtualizor operator should check for the java-jre-update.service, rotate credentials, and demand signed updates.
After the tag-repositioning attacks that hit tj-actions and 23,000 repositories, GitHub is rolling out a security roadmap for Actions: dependency lockfiles, scoped secrets, and an egress firewall. Two measures are available today: SHA pinning and OIDC.
On July 16 2026 Docker Engine 29.6.2 fixed five BuildKit vulnerabilities, including CVE-2026-15793 which can execute commands on the host during a malicious Git checkout, and CVE-2026-17106 was fixed in 29.7.0. Pipelines that build from untrusted sources should update Engine, Buildx and BuildKit now.
On August 30, 2026, the gitoxide project — the pure-Rust implementation of Git — shipped a bundled fix for five parsing vulnerabilities, including an HTTP credential leak and several submodule-based path traversals. The lesson for anyone pulling Rust libraries: memory safety is no substitute for input validation.
CVE-2026-66384, a path traversal in Artifactory’s Docker cache, lets an authenticated user write outside the intended directory and joined CISA’s KEV catalog on 27 August 2026. Upgrade your self-hosted instance to 7.146.35 or 7.161.16 and restrict remote repository creation.
On August 11, 2026 the CNCF promoted Cloud Native Buildpacks to graduated status, backed by 535 contributors, 164 organizations and more than 20 adopters including Google, GitLab and VMware. Teams that centralize their builds get the shortest path to reproducible OCI images and CVE fixes shipped in hours.
An infection chain targeting Android car head units delivers the JarService malware through DoFun’s own TWCore update app. Kaspersky attributes the operation to the MoYu group behind the BadBox botnet — the first documented malware chain built specifically for this class of device.
On August 20, 2026, Trend Micro disclosed fourteen functional npm packages that drop RedShell, the Linux beacon of the RedC2 4.0 C2 framework, with no install hook and no exported function call. Audit your transitive dependencies and recent package additions before a single import compromises your servers.
On August 20, 2026, Docker opened Verified Publisher applications to self-serve submission from Docker Hub, while keeping a manual review of every application. For teams that consume images, the badge remains a link in the trust chain — not a CVE guarantee.
On August 11, 2026, CloudSEK put numbers on the LiteLLM compromise: 2,500 organizations and 434,000 CI/CD pipelines potentially exposed, through a compromised Trivy build that poisoned versions 1.82.7 and 1.82.8 on PyPI. The lesson for platform teams comes down to three decisions: pin, scope, and treat CI as an attack surface.
Docker Hub now supports OpenID Connect for GitHub Actions. Workflows authenticate with short-lived, per-run tokens instead of storing PATs or OATs in GitHub secrets. Manual credential rotation is officially obsolete.
An unencrypted copy of the GPG key that signs Firefox and Thunderbird Linux downloads landed in an internal Git repository by mistake. Mozilla immediately revoked the key and began a full rotation — every Linux distribution packaging the browser must rebuild against the new key.
From TanStack to Trellix via GitHub Megalodon, the five biggest supply chain attacks of 2026 prove your attack surface extends to every npm install. Third-party risk management must become continuous — the annual questionnaire is dead.
On August 5, 2026, Novee Security demonstrated at Black Hat USA that a GitHub issue opened by an account with no write access was enough to execute arbitrary code on the CI runners behind Claude Code, Gemini CLI, and OpenAI Codex repositories. If your CI/CD pipeline executes code from GitHub issues without sandboxing, treat this as a CVE with no patch — yet.
As of August 1, 2026, GitHub automatically generates SLSA Build Level 3 attestations for every Actions workflow run on a public repository. The software supply chain becomes verifiable without effort — and regulatory compliance follows.
A new variant of the XCSSET malware compromises shared Xcode projects to infect compiled macOS applications. If you clone a repository from an infected developer, your final app ships the malware without a trace.
Manifold Security discovered 77 malicious extensions on the Open VSX marketplace between July 26 and August 1, 2026, exfiltrating Git metadata, CI variables, and development environment details. The attack proves that software supply chains no longer stop at code — they now include the IDE itself.
A self-propagating supply-chain attack named ChainDrop compromised over 1,300 packages on the npm registry on August 4, 2026. The infected packages accounted for 2 billion monthly downloads and reached organizations including Deliveroo, Qlik, and ServiceTitan. Audit your dependencies now.
EU Regulation 2024/2847, the Cyber Resilience Act, enters phased application starting in 2026. It requires every software vendor selling in the EU to produce a complete SBOM, fix known vulnerabilities within five business days, and notify critical incidents to ENISA within 24 hours. Here's what your organization must do before the first binding deadline.
On August 1, 2026, N-able detected active exploitation of an authentication bypass (CVE-2026-18577) in its N-central RMM platform. The fix for CVE-2026-18576 was incomplete, and attackers bypassed it in under thirty days. Here's what MSPs must do and why the RMM supply chain remains cybersecurity's weakest link.
Three attack waves in eighteen months — nullifAI, ShadowPickle, and a fake OpenAI repository — demonstrate that the AI supply chain is now the weakest link in production deployments. The fixes exist, but they require treating every downloaded model as an untrusted binary.
On 20 January 2026, the European Commission proposed a revamped Cybersecurity Act that mandates removing high-risk foreign suppliers from the EU’s telecom networks and ICT supply chains. Operators have three years to comply, with fines reaching 7% of global turnover.
On March 17, 2026, GitHub Enterprise Server 3.20 went GA with two structural security gates: releases are now immutable by default, and secret scanning gains enterprise-wide governance controls. Against a backdrop of escalating supply chain attacks, this release turns the forge into a fortress.
The SafePay ransomware group exfiltrated 8.5 terabytes of data from BPO giant Conduent between October 2024 and January 2025, exposing over 25 million individuals. It's the costliest supply chain breach of the year for US governments — and a wake-up call for any CISO who depends on a critical third party.
