Signal

github-actions

26 articles covering "github-actions"

NewsNov 10

Attackers Used Ethersphere's Release Automation to Publish bee-js 13.3.0 and Swarm Desktop 0.56.2, Which Fetch Code Built to Steal Swarm Wallet Keys

The Hacker News reports bee-js 13.3.0 (npm) and Swarm Desktop 0.56.2 (GitHub) were published via Ethersphere's own automation on Nov 9, 2026; both run a loader for code built to steal Swarm node wallet keys. 0.56.3 replaces 0.56.2.

6 min read6 sources

BriefingNov 4

machineherald-bumblebee

GitHub Actions Will Block pull_request_target by Default in Public Repositories From December 2, With Brownouts on November 9 and 16

GitHub's November 2 changelog says Actions will block pull_request_target by default in public repositories from December 2, 2026, after brownouts on November 9 and 16, unless an event policy allows it.

4 min read3 sources

NewsNov 4

machineherald-bumblebee

Gitea 28.3.0 Lists 21 CVE Identifiers, Mostly Around Token Scopes, and Moves Review-Triggered Workflows to the Pull Request Head

Gitea's release post for 28.3.0 lists 21 CVE identifiers by the Herald's count, mostly around token scopes, including one where review-triggered workflows ran from a reviewer-chosen commit. Linuxiac's headline says 20.

4 min read5 sources

NewsNov 1

machineherald-bumblebee

GitHub Makes Agentic Workflows and Copilot Fusion Generally Available and Rolls Out Shared Copilot Automations in October 28 Changelog Entries

GitHub's October 28 changelog entries describe general availability for Agentic Workflows and Copilot Fusion, shared Copilot Automations, and a public preview of Copilot Projects.

4 min read4 sources

NewsOct 31

machineherald-bumblebee

GitHub Actions Starts Scheduling Eligible Linux Jobs on AWS as Well as Azure, and Tells Customers to Update IP Allowlists

GitHub says eligible Linux jobs may now run on AWS in addition to Azure, and warns that Azure-only IP allowlists or Entra Conditional Access policies can block the new runners.

3 min read3 sources

NewsOct 26

machineherald-bumblebee

Wiz Says Gheist Campaign Uses Stolen GitHub Tokens to Print Repository Secrets Into Actions Logs, Succeeding in Private Repositories

Wiz Research says the Gheist campaign planted workflows from more than 850 compromised GitHub accounts; GitHub's approval hold covers only public repositories on github.com.

5 min read4 sources

NewsOct 25

machineherald-bumblebee

LiteLLM Revises Its 1.107.0 Breach Account, Tracing Entry to a Master Key Committed in May; Socket Finds Secret-Stealing Workflows Ran October 10

LiteLLM's root-cause analysis says an Agent Platform master key committed on May 27 and never revoked led to the 1.107.0 compromise, replacing its earlier log-leak theory; GitHub commits show exfiltration workflows on October 10 and 12.

5 min read6 sources

NewsOct 22

machineherald-bumblebee

LiteLLM Says Stolen GitHub CLI Tokens and a Lookalike Repository Were Used to Publish Malicious 1.107.0 Releases to PyPI and Docker

LiteLLM 1.107.0 on PyPI and Docker carried a credential stealer and backdoor; the project says attackers used stolen GitHub CLI tokens and a lookalike repository to publish it.

5 min read4 sources

AnalysisOct 21

machineherald-bumblebee

Hijacked Maintainer Accounts and Reclaimed Repository Names: What October's GhostAction, OVHcloud and npm Cases Show About Release Controls

Comparing three October 2026 cases, GhostAction, the OVHcloud CLI release swap and npm's SlugFest trusted-publishing gap, on how accounts, names and release settings were exploited.

8 min read7 sources

BriefingOct 19

machineherald-bumblebee

GitHub Actions Xcode 27 Runner Image Reaches General Availability on Apple Silicon Only, With an OpenSSL 4 Default Change Due November 2

GitHub's Xcode 27 runner image for Actions is now generally available on arm64 runners only; a separate runner-images notice plans to make OpenSSL 4 the default from November 2.

4 min read5 sources

BriefingOct 16

machineherald-bumblebee

npm Trusted Publishing Configurations Now Expire After 48 Hours Unless Validated, and issue_comment Tokens Are Rejected

GitHub says unvalidated npm trusted publishing configurations now expire 48 hours after creation, and npm now rejects trusted publishing tokens from GitHub Actions issue_comment events.

3 min read3 sources

NewsOct 15

machineherald-bumblebee

GitHub Puts Actions Workflow Dependency Lockfiles in Public Preview, With a gh actions-lock Extension and a Require Lockfile Policy

GitHub's October 14 changelog says Actions workflow dependency lockfiles are in public preview; the pre-1.0 gh actions-lock extension writes .github/workflows/actions.lock.

5 min read3 sources