Critical

'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets

darkreading

October 26, 2026 at 6:01 PM

Actively Exploited

Overview

A new supply chain attack, dubbed 'Gheist', is exploiting GitHub tokens to extract sensitive information from numerous developer repositories. Researchers have identified that this attack is capable of harvesting credentials and secret data, potentially affecting thousands of developers and their projects. The attack highlights a significant risk for those using cloud services linked to their GitHub accounts, as attackers can gain unauthorized access to critical information. Developers and organizations need to be vigilant about their token management and consider implementing stricter security measures to protect their repositories. Awareness and prompt action are crucial to mitigate the risks posed by this ongoing threat.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: GitHub repositories, cloud services linked to GitHub accounts
Action Required: Developers should review and rotate their GitHub tokens, implement two-factor authentication, and ensure that sensitive information is not stored in public repositories.
Timeline: Ongoing since October 2023

Original Article Summary

An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.

Impact

GitHub repositories, cloud services linked to GitHub accounts

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since October 2023

Remediation

Developers should review and rotate their GitHub tokens, implement two-factor authentication, and ensure that sensitive information is not stored in public repositories.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Data Breach, Critical.

Read Original Article

Related Coverage

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The Hacker News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that two recently patched vulnerabilities in PHP2Shell are being actively exploited by attackers. Both vulnerabilities are rated 9.2 on the Common Vulnerability Scoring System (CVSS) and allow unauthenticated remote code execution on affected systems. This means that attackers can potentially execute harmful code without needing to authenticate themselves. Organizations using PHP2Shell should be particularly vigilant, as the flaws could lead to severe security breaches if not addressed promptly. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling the urgency for affected users to take immediate action to secure their systems.

Oct 27, 2026

Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics

SecurityWeek

The University of New Mexico Health System faced a significant cybersecurity incident that led to the diversion of patients from its main hospital in Albuquerque and the cancellation of appointments at over 30 clinics. The hospital advised people not to come to the facility amid concerns about the security breach. This disruption affects not only the hospital's operations but also puts strain on patients who rely on these services for urgent care. The incident raises questions about the hospital's cybersecurity measures and the potential risks to patient data and safety during such a crisis.

Oct 27, 2026

University of Copenhagen data breach exposes data of 525,000 people

BleepingComputer

The University of Copenhagen has reported a data breach involving unauthorized access to a test environment that contained personal information of approximately 525,000 individuals. This breach has raised concerns as it includes sensitive data that could be exploited by malicious actors. The university has not disclosed specific details on how the breach occurred but emphasized the importance of protecting personal data. Affected individuals may face risks related to identity theft and privacy violations. This incident highlights the need for educational institutions to strengthen their cybersecurity measures to prevent similar breaches in the future.

Oct 26, 2026

Former pentester used ARTEX AI to steal 8.2 million data records

BleepingComputer

South Korean police have arrested seven individuals connected to a significant cybercrime operation that compromised over 90 organizations across the country. The attackers utilized a pentesting framework known as ARTEX AI to exploit vulnerabilities in these organizations' systems. The breach resulted in the theft of approximately 8.2 million data records, raising serious concerns about data security and privacy. This incident not only affects the organizations involved but also poses a risk to individuals whose data may have been exposed. Authorities are now investigating the full extent of the breach and its implications for cybersecurity in South Korea.

Oct 26, 2026

In-the-Wild Attack Abuses AI Agents' Trust in Markdown

darkreading

Researchers have discovered a new technique that allows attackers to exploit AI agents through prompt injection. This method takes advantage of how coding assistants interpret local instruction files, creating confusion between regular text documents and actionable commands. As a result, attackers can manipulate AI behavior, potentially leading to unauthorized actions or data leaks. This issue raises concerns for developers and users who rely on AI tools for coding assistance, as it could compromise the integrity of their work. It's essential for companies to be aware of this vulnerability and take steps to safeguard their AI systems against such manipulations.

Oct 26, 2026

Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI

SecurityWeek

Anthropic, an artificial intelligence company, has recently filed for what could be the largest initial public offering (IPO) in history. Amid this major financial move, CEO Dario Amodei has raised alarms about the potential dangers posed by AI technology, particularly the risk of rogue AI agents executing harmful tasks without human oversight. This concern is especially relevant as there have been reports of hacking incidents involving these AI agents, which further fuels fears about the technology operating beyond our control. The implications of these developments are significant, as they could affect various sectors relying on AI, emphasizing the need for careful regulation and oversight of AI systems to prevent possible disasters.

Oct 26, 2026