https://vulnpocalypse.dev/feeds/CI/CD advisories for GitHub Actions: rogue self-hosted runners, leaked workflow secrets and poisoned actions.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/github-issue-comment-injection-campaign/https://vulnpocalypse.dev/advisories/github-issue-comment-injection-campaign/Thu, 12 Nov 2026 12:00:00 +0000Hidden shell commands in GitHub issues, PRs and comments hit 61 repos, including Trivy and MLflow. Find workflows that put issue text into run steps.supply-chaingithub-actionsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/bufferzonecorp-go-rubygems-ci-stealer/https://vulnpocalypse.dev/advisories/bufferzonecorp-go-rubygems-ci-stealer/Thu, 12 Nov 2026 12:00:00 +0000BufferZoneCorp Go modules and knot-* gems stole SSH, cloud, npm, gh and kube credentials and tampered with GitHub Actions. Check go.mod and Gemfile.lock.supply-chaingithub-actionsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/Wed, 11 Nov 2026 12:00:00 +0000Malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 steal Swarm wallet files; check for them and rotate keys on any affected host.supply-chainnpmnodejsgithub-actionscryptoopen-sourcehttps://vulnpocalypse.dev/advisories/actions-cool-issues-helper-reenabled-malware/https://vulnpocalypse.dev/advisories/actions-cool-issues-helper-reenabled-malware/Wed, 11 Nov 2026 12:00:00 +0000Hijacked actions-cool/issues-helper and maintain-one-comment were re-enabled on 16 Sep 2026 with every tag still malicious. Remove them and rotate CI secrets.supply-chaingithub-actionsci-cdai-toolshttps://vulnpocalypse.dev/advisories/ai-coding-agents-ci-prompt-injection/https://vulnpocalypse.dev/advisories/ai-coding-agents-ci-prompt-injection/Wed, 11 Nov 2026 12:00:00 +0000Prompt injection in GitHub issues let attackers reach CI secrets through Claude Code, Gemini CLI and Codex. Upgrade, and keep untrusted input away from secrets.ai-toolsgithub-actionsai-toolsci-cdhttps://vulnpocalypse.dev/advisories/tanstack-nx-console-github-breach/https://vulnpocalypse.dev/advisories/tanstack-nx-console-github-breach/Wed, 11 Nov 2026 12:00:00 +0000Poisoned TanStack packages stole an Nx developer's GitHub token. A trojaned Nx Console release then hit GitHub and Grafana. Check installs, rotate tokens.supply-chainnpmgithub-actionsci-cdhttps://vulnpocalypse.dev/advisories/teampcp-trivy-litellm-supply-chain/https://vulnpocalypse.dev/advisories/teampcp-trivy-litellm-supply-chain/Wed, 11 Nov 2026 12:00:00 +0000Poisoned Trivy and KICS actions and images, LiteLLM 1.82.7/1.82.8 and Telnyx 4.87.1/4.87.2 stole CI and developer secrets. Check, then rotate.supply-chaingithub-actionspypici-cdai-toolshttps://vulnpocalypse.dev/advisories/shai-hulud-npm-worm/https://vulnpocalypse.dev/advisories/shai-hulud-npm-worm/Wed, 11 Nov 2026 12:00:00 +0000A self-replicating npm worm runs at install time, steals developer and CI secrets, and registers rogue GitHub runners. New waves hit from April to August 2026.supply-chainnpmgithub-actionshttps://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/https://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/Mon, 02 Nov 2026 12:00:00 +0000October 2026 brought unrelated incidents, including PHP2Shell, Node.js patches and a malicious LiteLLM 1.107.0; update runtimes and review credentials.ai-toolsphpnodejspypinpmgithub-actionsai-toolscryptocloudhttps://vulnpocalypse.dev/advisories/ghostaction-github-workflow-secret-theft/https://vulnpocalypse.dev/advisories/ghostaction-github-workflow-secret-theft/Mon, 02 Nov 2026 12:00:00 +0000Stolen GitHub accounts committed security-audit.yml or github_actions_security.yml to thousands of repos. Search all branches and forks, then rotate.supply-chaingithub-actionsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/hades-pypi-ensmallen-bioinformatics/https://vulnpocalypse.dev/advisories/hades-pypi-ensmallen-bioinformatics/Mon, 02 Nov 2026 12:00:00 +0000Hijacked releases of ensmallen and other graph ML, bioinformatics and AI packages stole CI secrets on import. Kill gh-token-monitor before revoking tokens.supply-chainpypigithub-actionsci-cdai-toolshttps://vulnpocalypse.dev/advisories/elementary-data-pypi-ghcr-backdoor/https://vulnpocalypse.dev/advisories/elementary-data-pypi-ghcr-backdoor/Mon, 02 Nov 2026 12:00:00 +0000elementary-data 0.23.3 on PyPI and its GHCR image ran a credential stealer via elementary.pth. Find 0.23.3, move to 0.23.4 or later, and rotate secrets.supply-chainpypigithub-actionsci-cdcloudhttps://vulnpocalypse.dev/advisories/wiz-reports-gheist-campaign-using-stolen-github-tokens-to-dump-actions-secrets/https://vulnpocalypse.dev/advisories/wiz-reports-gheist-campaign-using-stolen-github-tokens-to-dump-actions-secrets/Sun, 25 Oct 2026 12:00:00 +0000Wiz reports a campaign planting secret-dumping sync-check workflows via stolen GitHub tokens, hunt for ci-sync branches and rotate exposed secrets.ecosystemgithub-actionsci-cdcloud