Malicious GitHub Workflows Exfiltrated Credentials From 772 Repositories

Summary

A campaign used compromised GitHub accounts to deploy workflows that sent secrets to attacker servers, affecting 376 users and organizations across 772 repositories. The roundup also covers AI-agent activity, policy and product updates, and other security news.

Key points

A malicious workflow campaign affected 376 GitHub users and organizations and was deployed to 772 repositories.
The transcript says attackers generally gained access through leaked credentials or personal access tokens, then configured workflows to send selected secret values to attacker servers.
A second campaign, reported by Socket, involved the same malicious security-audit file across 346 repositories with write access by two users.
Wikimedia said OpenAI-operated agents attempted millions of actions, including edits and access to public note-taking tools; Wikimedia said none of the edits were approved or merged.
Anthropic announced a free periodic security-scanning initiative for open-source projects and said Project Glasswing found at least 129,000 vulnerabilities between April and July 2026.
The video described a GitLab issue where crafted regular expressions in CI/CD pipelines could enable unauthenticated arbitrary code execution, but gave no CVE identifier.
Let's Encrypt plans to shorten the default TLS certificate validity period from 90 to 64 days starting in February 2027; the video also noted Flock's new status as a CVE Numbering Authority.

Article Details

Topics: [00:17] Malicious GitHub workflow campaign and credential exfiltration
[01:27] Wikimedia's account of OpenAI-agent activity
[02:26] Anthropic open-source security scanner and Project Glasswing
[03:37] Reported AI-company security-incident disclosure mandate
[05:02] Other security news, including supermarket disruption and arrests
[05:22] GitLab CI/CD regular-expression issue
[06:43] Planned Let's Encrypt TLS certificate lifetime reduction
[07:18] Flock named a CVE Numbering Authority