Executive assessment
Today's brief leads with Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies. All 15 selected findings retain their own technical scope, action, observed status, and evidence limits.
Finding 01 — Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
What changed: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon.
Technical evidence: CVE-2015-3306; CVSS v3.1 10; weakness CWE-284; technical confidence High.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: Observed in-the-wild exploitation is confirmed.
Analyst note: Restrict SITE_COPY with a <Limit SITE_COPY> section using DenyAll; explicitly allow only required users. CISA reports active exploitation. ([proftpd.org](http://www.proftpd.org/docs/contrib/mod_copy.html), [services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2015-3306), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2015-3306), +2 more)
Affected: ProFTPD 1.3.5 when mod_copy is enabled. ([cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2015-3306), [openwall.com](https://www.openwall.com/lists/oss-security/2015/04/15/2))
Fix: Ubuntu 15.04: 1.3.5-1.1+deb8u1build0.15.04.1; Ubuntu 14.04 LTS: 1.3.5~rc3-2.1ubuntu2.1; Ubuntu 12.04 LTS: 1.3.4a-1ubuntu0.1. ([ubuntu.com](https://ubuntu.com/security/CVE-2015-3306?format=md))
Panel assessment: Patch now for any ProFTPD 1.3.5 service with mod_copy enabled: CISA reports active exploitation, the issue is automatable, and unauthenticated arbitrary file read/write means the blast radius is whatever the daemon can reach on disk. The likely path is SITE CPFR/SITE CPTO used to copy sensitive files to a readable location or overwrite writable files, putting credentials, configuration, hosted data, and downstream file-driven processes at risk. (priority: patch now)
Action: Map CVE-2015-3306 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: thehackernews.com](https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html)
Finding 02 — NetScaler: Improper Restriction of Operations within the Bounds of a Memory Buffer
What changed: CVE-2026-107406 is a CVSS 9.5 memory-overflow vulnerability in NetScaler ADC and NetScaler Gateway appliances configured as a SAML service provider or identity provider. It can enable remote code execution or denial of service; Citrix released fixed builds and reports no known unmitigated exploitation at publication time.
Technical evidence: CVE-2026-107406; CVSS v4.0 9.5; weakness CWE-119; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: If patching cannot be completed immediately, disable SAML service-provider or identity-provider functionality until the update is applied, and monitor SAML-related logs and network traffic for anomalous activity. SecurityWeek reports that Citrix was not aware of any unmitigated exploits when the bulletin was published. ([support.citrix.com](https://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-citrix-netscale.html), [securityweek.com](https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/), [app.opencve.io](https://app.opencve.io/cve/CVE-2026-107406))
Affected: For SAML IdP configurations: NetScaler ADC/Gateway 14.1-73.37 to 14.1-73.41 and 13.1-64.23 to 13.1-64.28; ADC 14.1-FIPS 14.1-73.37 FIPS to 14.1-73.41 FIPS. ([support.citrix.com](https://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-citrix-netscale.html))
Fix: NetScaler ADC/Gateway 14.1-73.46 or later and 13.1-64.29 or later; ADC 14.1-FIPS 14.1-73.46 FIPS or later; ADC 13.1-FIPS/13.1-NDcPP 13.1.37.283 or later. ([support.citrix.com](https://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-citrix-netscale.html))
Action: Map CVE-2026-107406 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: securityweek.com](https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/)
Finding 03 — Multiple vulnerabilities in Grid Protection Alliance openPDC and openHistorian
What changed: CISA describes six flaws affecting openPDC and openHistorian, including unsafe deserialization, missing authentication, SSRF, hard-coded credentials, and unsafe reflection. Affected operators should move to the fixed releases identified by the advisory.
Technical evidence: CVE-2026-100730; CVSS v3.1 9.8; weakness CWE-502; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Explicitly bind the internal and STTP data-publisher interfaces to local loopback rather than all interfaces. Restrict Modbus network access with a firewall and block connections to loopback and RFC 1918 destinations unless explicitly required. CISA reports no known public exploitation specifically targeting these vulnerabilities. ([raw.githubusercontent.com](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-281-02.json))
Affected: openPDC versions before 2.9.482, openHistorian versions before 2.8.585, and published openPDC Docker images before 2.9.482. ([raw.githubusercontent.com](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-281-02.json))
Fix: For CVE-2026-100730: openPDC 2.9.482 and later and openHistorian 2.8.585 and later. For CVE-2026-104629: openPDC 2.9.477 and later and openHistorian 2.8.580 and later. No fix has been published for th ([raw.githubusercontent.com](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-281-02.json))
Panel assessment: Patch now where the products are reachable: the mix of unsafe deserialization, missing authentication, SSRF, hard-coded credentials and unsafe reflection gives an exposed service more than one route into high-value OT telemetry and historian functions, even though CISA reports no known public exploitation. (priority: patch now)
Action: Map CVE-2026-100730 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02)
Finding 04 — Multiple vulnerabilities in Linux kernel (OEM)
What changed: Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.
Technical evidence: CVE-2026-52914; CVSS v3.1 9.8; weakness CWE-787; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-52914 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: ubuntu.com](https://ubuntu.com/security/notices/USN-8911-1)
Finding 05 — Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
What changed: The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands. CVE coverage: CVE-2026-105133, CVE-2026-105134.
Technical evidence: CVE-2026-105134; CVSS v4.0 10; weakness CWE-78, CWE-77; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Restrict AhsayCBS management-interface web access to trusted IP addresses or require VPN. Investigate for signs of compromise. Huntress reports observing threat actors exploiting both vulnerabilities for unauthenticated remote code execution and webshell deployment. ([huntress.com](https://www.huntress.com/blog/ahsaycbs-flaws-exploit))
Affected: AhsayCBS versions through 10.3.4. ([huntress.com](https://www.huntress.com/blog/ahsaycbs-flaws-exploit))
Action: Map CVE-2026-105134 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: securityweek.com](https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/)
Finding 06 — SonicWall SMA1000: Server-Side Request Forgery
What changed: Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. (Unconfirmed, single-source.)
Technical evidence: CVE-2026-102255; CVSS v3.1 10; weakness CWE-918, CWE-441; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Limit Appliance WorkPlace access to authorised users, trusted networks and approved regions; restrict the appliance's outbound connectivity to business-required services. Segment remote-access infrastructure from sensitive administrative systems and monitor WorkPlace activity, appliance-originated outbound connections, administrative actions and unusual authentication events. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/), [fieldeffect.com](https://fieldeffect.com/blog/sonicwall-fixes-maximum-severity-sma1000-vulnerability))
Affected: SMA 6210, SMA 7210 and SMA 8200v appliances running platform hotfix 12.4.3-03526 or earlier, or 12.5.0-02952 or earlier. ([fieldeffect.com](https://fieldeffect.com/blog/sonicwall-fixes-maximum-severity-sma1000-vulnerability))
Fix: Platform hotfix 12.4.3-03670 or later, or 12.5.0-03082 or later. ([fieldeffect.com](https://fieldeffect.com/blog/sonicwall-fixes-maximum-severity-sma1000-vulnerability))
Panel assessment: Patch affected SMA1000 appliances now: exploitation attempts are already being observed, the flaw is maximum severity, and a remote-access appliance can give an attacker a useful bridgehead if it can reach sensitive internal or administrative systems. The likely path is SSRF through the appliance, turning its own outbound access into a route to internal services, configuration paths, authentication surfaces or data that are not meant to be exposed directly. (priority: patch now)
Action: Map CVE-2026-102255 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/)
Finding 07 — Multiple vulnerabilities in Nginx UI
What changed: Nginx UI carries 3 CVEs across 3 advisories: Code Injection; Uncontrolled Resource Consumption; Origin Validation Error. CVE coverage: CVE-2026-107806, CVE-2026-107805, CVE-2026-107804.
Technical evidence: CVE-2026-107806; CVSS v4.0 9.4; weakness CWE-94; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-107806 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-p393-cf76-4jmr)
Finding 08 — Multiple vulnerabilities in TinaCMS
What changed: TinaCMS carries 3 CVEs across 3 advisories: Code injection via unescaped Git branch name in generated client source; Cross-site Scripting; Origin Validation Error. CVE coverage: CVE-2026-108259, CVE-2026-108260, CVE-2026-108261.
Technical evidence: CVE-2026-108261; CVSS v3.1 9.3; weakness CWE-346, CWE-441, CWE-601; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: If upgrading is not immediately possible, normalise preview splats to a same-origin path, reject leading '/' or '\', and require the expected preview origin to equal window.location.origin. ([github.com](https://github.com/advisories/GHSA-x34j-47hf-4xg7), [services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-108261), [github.com](https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c))
Affected: For 2 of 3 advisories: tinacms versions before 3.14.0 and @tinacms/app versions before 2.5.14; @tinacms/cli versions up to and including 2.7.0 ([services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-108261), [github.com](https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c))
Fix: For 2 of 3 advisories: tinacms 3.14.0 and @tinacms/app 2.5.14; @tinacms/cli 3.0.0 and later ([services.nvd.nist.gov](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-108261), [github.com](https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c))
Action: Map CVE-2026-108261 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-x34j-47hf-4xg7)
Finding 09 — Multiple vulnerabilities in Contao
What changed: CVE coverage: CVE-2026-107842, CVE-2026-107843, CVE-2026-107848, CVE-2026-107844, CVE-2026-107845, CVE-2026-107850, CVE-2026-107851. The cited advisories disclose: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled; The registration module re-sends activation mails; Cross-site request forgery in custom backend actions; Path traversal in the images controller; Cross-site scripting in the comments bundle; Improper access control in the preview links module; Improper access control in the table access voter.
Technical evidence: CVE-2026-107845; CVSS v3.1 9.3; weakness CWE-79, CWE-116; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Until patched, turn off reg_activate, disable unauthenticated comment submission, and block percent-encoded dot-segment requests to image routes. Restrict backend access to trusted administrators. ([api.github.com](https://api.github.com/advisories/GHSA-x2rp-9qf7-2fmq), [api.github.com](https://api.github.com/advisories/GHSA-mfxh-vp55-7gc6), [api.github.com](https://api.github.com/advisories/GHSA-mrvp-7wmx-5m4h), +4 more)
Affected: CVE-2026-107842 (contao/core-bundle) and CVE-2026-107845 (contao/comments-bundle): >= 4.0.0, < 5.3.50 or >= 5.4.0-RC1, < 5.7.12. CVE-2026-107843 and CVE-2026-107844 (contao/core-bundle): >= 4.1.0. ([api.github.com](https://api.github.com/advisories/GHSA-x2rp-9qf7-2fmq), [api.github.com](https://api.github.com/advisories/GHSA-mfxh-vp55-7gc6), [api.github.com](https://api.github.com/advisories/GHSA-mrvp-7wmx-5m4h), +4 more)
Fix: CVE-2026-107842, CVE-2026-107843, CVE-2026-107844, CVE-2026-107845 and CVE-2026-107848: 5.3.50 and 5.7.12. CVE-2026-107850 and CVE-2026-107851: 5.7.12. ([api.github.com](https://api.github.com/advisories/GHSA-x2rp-9qf7-2fmq), [api.github.com](https://api.github.com/advisories/GHSA-mfxh-vp55-7gc6), [api.github.com](https://api.github.com/advisories/GHSA-mrvp-7wmx-5m4h), +4 more)
Action: Map CVE-2026-107845 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-x2rp-9qf7-2fmq)
Finding 10 — Multiple vulnerabilities in Vikunja
What changed: CVE coverage: CVE-2026-91970, CVE-2026-91969, CVE-2026-91968, CVE-2026-91979, CVE-2026-91981, CVE-2026-91980, CVE-2026-91971, CVE-2026-91973, CVE-2026-91983, CVE-2026-91984, CVE-2026-91985, CVE-2026-91982, CVE-2026-91972, CVE-2026-62376, CVE-2026-62367, CVE-2026-76216, CVE-2026-68582, CVE-2026-57458, CVE-2026-68581. The cited advisories disclose: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API; Unbounded CSV row cardinality permits API process termination; Unbounded nested task-filter recursion permits API process termination; Denial of service via decompression bomb in the data import; Link-share token can enumerate users through the v2 API; Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project; Unbounded image decode on avatar and project-background uploads enables decode/resize amplification; CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords; Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint; Read-only project members can obtain any link share's access hash via the single-share read endpoint and escalate to the share's permission level; TOTP secret is readable after enrollment, no step-up auth; Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited; Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access; OIDC email-fallback account linking ignores email_verified, enabling local-account takeover; Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure; Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide; Scoped API token can mint unrestricted OAuth session credentials; Link-share principal ID collision allows cross-account API token issuance and management.
Technical evidence: CVE-2026-68582; CVSS v4.0 9.3; weakness CWE-639; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: For the Planka issue, block POST /api/v2/migration/planka/migrate at the reverse proxy until patched. Apply external rate limits to v2 login, registration, password-reset and OAuth-token routes, and to CalDAV and feed endpoints. ([github.com](https://github.com/advisories/GHSA-wq92-8x3r-fm38), [vikunja.io](https://vikunja.io/changelog/vikunja-2.4.0-pro-and-a-new-api/), [vikunja.io](https://vikunja.io/changelog/vikunja-2.5.0-was-released/), +1 more)
Affected: Affected versions >= 2.5.0, < 2.6.0 Patched versions 2.6.0 ([github.com](https://github.com/advisories/GHSA-wq92-8x3r-fm38), [vikunja.io](https://vikunja.io/changelog/vikunja-2.5.0-was-released/))
Fix: Vikunja 2.4.0: Ten security fixes, Vikunja Pro, and a new v2 API ([vikunja.io](https://vikunja.io/changelog/vikunja-2.4.0-pro-and-a-new-api/), [vikunja.io](https://vikunja.io/changelog/vikunja-2.5.0-was-released/), [vikunja.io](https://vikunja.io/changelog/vikunja-2.6.0-was-released/))
Action: Map CVE-2026-68582 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-wq92-8x3r-fm38)
Finding 11 — Multiple vulnerabilities in Red Lion Controls N-Tron 700 Series
What changed: Red Lion Controls N-Tron 700 Series (per CISA alert ICSA-26-281-01): seven vulnerabilities in N-Tron 700 Series switches that can expose administrative access, configuration files, credentials, firmware integrity, or device availability. Successful exploitation can permit configuration changes or repeated forced reboots.
Technical evidence: CVE-2026-39460; CVSS v3.1 8.1; weakness CWE-522; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Configure or disable SNMP communities and disable access to the web GUI. Keep control-system devices off the internet and isolate control-system networks behind firewalls from business networks. CISA reports no known public exploitation specifically targeting these vulnerabilities. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01))
Affected: Red Lion Controls 700 Series: <=Firmware_3.11.0; Red Lion Controls 700 Series: <=Bootloader_2.0.6.1 ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01))
Fix: Firmware 3.11.1 or later. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01))
Action: Map CVE-2026-39460 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01)
Finding 12 — Multiple vulnerabilities in Strawberry GraphQL
What changed: Strawberry GraphQL carries 2 CVEs across 2 advisories: Incorrect Authorization; Uncontrolled Resource Consumption. CVE coverage: CVE-2026-107728, CVE-2026-107727.
Technical evidence: CVE-2026-107728; CVSS v3.1 7.5; weakness CWE-863; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-107728 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-pfvf-fwfp-25mp)
Finding 13 — ageLANServer: Uncontrolled Resource Consumption
What changed: GitHub Advisory Database published GHSA-4jfq-pmq9-257h for CVE-2026-107839 (ageLANServer): Uncontrolled Resource Consumption, CVSS v3.1 7.5.
Technical evidence: CVE-2026-107839; CVSS v3.1 7.5; weakness CWE-400; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-107839 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-4jfq-pmq9-257h)
Finding 14 — yopass Prometheus metrics middleware: Uncontrolled Resource Consumption
What changed: GitHub Advisory Database published GHSA-6r69-c6wg-7g8m for CVE-2026-107840 (yopass Prometheus metrics middleware): Uncontrolled Resource Consumption, CVSS v3.1 7.5.
Technical evidence: CVE-2026-107840; CVSS v3.1 7.5; weakness CWE-400; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-107840 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-6r69-c6wg-7g8m)
Finding 15 — Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
What changed: Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: The cited source reports an active supply-chain compromise; exposure depends on use of the affected packages rather than exploitation of a single vulnerability.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
fixed version or patch state unknown
[Evidence source: thehackernews.com](https://thehackernews.com/2026/10/credential-stealing-github-actions.html)