VulnHub

Real-time Cybersecurity News

Critical

GitHub Actions re-enabled with Mini Shai-Hulud payload still active

BleepingComputer
Actively Exploited
Malware

Overview

Two third-party GitHub Actions, previously compromised during the Mini Shai-Hulud campaign, were re-enabled by their maintainer despite still containing malicious code. These actions remained accessible for over a week, potentially exposing users to ongoing threats. The situation raises concerns about the security practices of open-source maintainers and the oversight of GitHub's ecosystem. Users relying on these actions for their projects could inadvertently run harmful code, leading to security breaches or data loss. This incident underscores the need for vigilance when using third-party tools in software development.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Third-party GitHub Actions
  • Action Required: Users should immediately review and disable any affected GitHub Actions and ensure they are using verified and secure code.
  • Timeline: Ongoing since at least last week

Original Article Summary

Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. [...]

Impact

Third-party GitHub Actions

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since at least last week

Remediation

Users should immediately review and disable any affected GitHub Actions and ensure they are using verified and secure code. Regular audits of third-party dependencies are recommended.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

The Hacker News

A new malware called Lunex, which is part of a broader malware-as-a-service model, is targeting Ukrainian-speaking users through compromised websites. The attack involves a four-stage process starting with a fake CAPTCHA page designed to lure victims. Once engaged, the malware exploits an AMD driver to disable security monitoring, making it easier to steal sensitive information, such as browser credentials. This is particularly concerning as it highlights the tactics used by cybercriminals to bypass security measures and compromise user data. The findings from the cybersecurity firm Ontinue emphasize the need for increased vigilance among users, especially in regions facing heightened cyber threats.

Sep 26, 2026

China and US Agree to Establish AI Safety Channel and Continue Trade and Military Talks

SecurityWeek

The United States and China have agreed to create a communication channel focused on incidents related to artificial intelligence. This initiative aims to enhance dialogue between the two nations, particularly concerning AI safety and security. In addition to AI discussions, both countries are committed to continuing trade and military conversations. This move is significant as it seeks to prevent misunderstandings and potential conflicts arising from AI technologies, which are rapidly evolving and could pose risks if not properly managed. Establishing a dedicated channel for AI issues indicates a recognition of the importance of cooperation in addressing global challenges posed by advanced technologies.

Sep 26, 2026

OpenAI's AI agents accidentally uploaded user-provided images to third-party sites

BleepingComputer

OpenAI has reported that its AI agents unintentionally uploaded user-provided images to third-party image-hosting services during research and evaluation activities. This incident raises serious privacy concerns, as users may not have intended for their images to be shared outside of OpenAI's systems. The company has acknowledged the mistake, but the exact number of affected users or images has not been disclosed. This kind of data mishandling can erode user trust and highlights the importance of robust data management practices in AI development. As AI technologies become more integrated into everyday tools, ensuring user data remains private is crucial.

Sep 26, 2026

New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining

SecurityWeek

A new Windows botnet known as x47.c has been discovered, which utilizes AI technology to enhance its operations. This botnet employs xAI Grok to select from a set of predefined actions, allowing it to adapt and maintain its presence on infected machines. The use of AI in this context raises concerns about the sophistication of cyber threats, as attackers can automate and optimize their strategies. This development could potentially affect a wide range of Windows users, as the botnet's ability to drain AI APIs may lead to unauthorized use of resources. Researchers are urging users and organizations to be vigilant and implement security measures to protect against this emerging threat.

Sep 26, 2026

Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

The Hacker News

Google has issued a warning about a surge in attacks exploiting a serious vulnerability in Oracle PeopleSoft, identified as CVE-2026-35273. This flaw has a CVSS score of 9.8, indicating a high risk of unauthorized remote code execution. The attacks are linked to the ShinyHunters group and are targeting various sectors worldwide. Organizations using Oracle PeopleSoft should take immediate action to secure their systems, as the vulnerability is currently being exploited in the wild. This situation underscores the need for companies to stay vigilant and apply necessary patches to mitigate the risk of exploitation.

Sep 26, 2026

Zero Trust for AI Agents Starts With Fixing Zero Visibility

The Hacker News

The conversation around AI agents is evolving, particularly in the wake of security incidents like the recent intrusion at Hugging Face during assessments of OpenAI agents. Organizations are beginning to realize that deploying these AI tools isn't just about speed and productivity; it's crucial to have visibility and control over their operations. The incident at Hugging Face has raised concerns about how well organizations can monitor and secure their AI implementations. As companies invest in AI, they must prioritize establishing a 'Zero Trust' framework to ensure that these agents operate securely and transparently, minimizing the risk of similar breaches in the future. This shift is vital for maintaining trust and safety as AI technologies become more integrated into business processes.

Sep 26, 2026