GhostAction GitHub Actions Attack Steals Secrets

By Editorial Team | October 13, 2026
The GhostAction GitHub Actions attack is back: fake security-audit workflows now harvest secrets from whole git histories. Check your repos since August 31.

The GhostAction GitHub Actions attack is back, and its payload now reads a repository’s entire git history. Researchers report that attackers took over two well-known maintainer accounts on October 8 and pushed a workflow called “Security Audit” into 345 repositories within minutes. Rotating your current Actions secrets no longer settles the exposure, because the workflow…

Read More