tag: Github · 11 items
- Engineer — Act: Active campaign extracted CI secrets from public repositories on October 8-9; audit all public repos for exposed secrets in CI config files and rotate GitHub PATs and any credentials stored in workflows immediately.
- SOC/IR — Act: Campaign has a tight activity window (Oct 8-9); hunt for unauthorized GitHub OAuth activity, anomalous CI/CD pipeline triggers, and unexpected secret-access events in organizational repos since that date.
- Leader — Act: Approximately 1,900 accounts compromised at scale warrants a same-week check: confirm with engineering whether any organizational GitHub accounts were among those affected and request an audit of CI secret exposure before this surfaces as a supply-chain incident.
- Engineer — Plan: Public PoC exists for this RCE but EPSS is 0.02 and no KEV listing — patch GitHub Enterprise to the latest release this sprint before exploitation interest picks up; GitHub.com is already patched by GitHub.
- SOC/IR — Plan: Public PoC lowers the bar for opportunistic exploitation; build or tune detections for anomalous GitHub API calls and unexpected Actions runner behavior as an exploitation precursor before active campaign activity emerges.
- Leader — Learn: RCE in a widely-used developer platform is worth noting for the risk register, but no active exploitation and a very low EPSS score mean this does not yet warrant leadership escalation or customer communication.
- Signals: CVE-2026-3854 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: Active campaign seeding fake GitHub repos with SmartLoader that delivers the StealC credential stealer — developers cloning unvetted repos are the attack vector. Audit recently cloned GitHub repos and CI/CD dependency pulls since early October for unexpected or newly-created repos, and verify repo authenticity before use.
- SOC/IR — Act: StealC infostealer is being deployed on developer endpoints via trojanized repos; hunt for StealC behavioral indicators (credential store access, C2 beaconing) in EDR across developer workstations, and review git clone activity logs since the campaign reactivated this month.
- Leader — Plan: Large-scale fake-repo campaign targeting developers creates credential theft risk that could cascade to production access. This quarter, assess whether developer policies require repo vetting before cloning and consider enforcing allowlists or signing requirements in CI/CD pipelines.
- Engineer — Act: AI coding agents in your dev workflow may be silently pushing screenshots—including sensitive internal data—to public GitHub repos under personal developer accounts. Audit GitHub for AI-agent-created image artifacts now, and restrict AI agent configurations to prevent writing to public repositories.
- SOC/IR — Act: Over 13,000 internal images from 300+ orgs are already publicly reachable on GitHub. Hunt for unexpected image file commits (PNG/JPEG) in developer personal repos linked to your organization’s accounts, and check whether any internal-origin images are indexed publicly.
- Leader — Act: Customer billing records are confirmed among the exposed data, implicating potential GDPR/SEC disclosure obligations. This week, confirm whether your organization is among the 300+ affected by querying your security team for AI agent GitHub activity, and engage legal on exposure scope before regulators or customers surface it first.
- Engineer — Plan: Check CI/CD pipeline dependencies on GitHub Actions and APIs; ensure fallback or retry logic is in place for build and deployment workflows during outages.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Skip
- SOC/IR — Skip
- Leader — Learn: GitHub’s restructuring signals a broader shift toward tiered, invite-only vulnerability research programs; useful benchmarking context if your organization runs or is considering a bug bounty program, but no immediate action required.
- Engineer — Act: A supply-chain campaign at GitHub scale (14M downloads) meets the Act threshold even without KEV/EPSS signals. Audit CI/CD build logs and dependency fetches for downloads from unknown or newly-created GitHub repos, and scan endpoints for SmartLoader and StealC indicators.
- SOC/IR — Plan: The campaign is active but the summary lacks specific IOCs needed for immediate sweeps. Build or tune detections for StealC infostealer behaviors (credential harvesting, C2 beaconing) and generic loader staging patterns; monitor research feeds for published IOC lists to operationalize hunting.
- Leader — Plan: Fourteen million downloads signals broad potential exposure across engineering teams. This quarter, review whether developer workflows enforce source verification for GitHub-sourced dependencies and consider a policy requiring reviewed or pinned third-party code.
- Engineer — Act: Active campaign targeting developers who clone AI tools and MCP server repos from GitHub; audit recent GitHub clone activity and ZIP downloads on developer and CI/CD systems for SmartLoader indicators, and remove any untrusted AI/MCP repos from your dependency chain.
- SOC/IR — Act: Ongoing SmartLoader delivery campaign through GitHub social engineering targeting developer workstations; hunt for suspicious ZIP extraction followed by execution artifacts on developer endpoints, and query EDR for SmartLoader process lineage since the campaign is active.
- Leader — Plan: Scale and targeting of developer tooling (7,600 repos, AI/MCP lures) makes this a supply-chain risk to the development environment; engage engineering leads this quarter on vetting controls for GitHub-sourced AI components before broader adoption.
- Engineer — Plan: Audit your team’s dependency sourcing and CI pipelines for any repos pulled by name without pinning to verified hashes or publishers; add a policy to verify repo provenance before importing new open-source dependencies.
- SOC/IR — Plan: Build or tune detections for infostealer IOCs from this campaign; monitor endpoints for outbound connections or processes consistent with cloned-repo execution, and hunt for recent developer workstation anomalies.
- Leader — Learn: This campaign illustrates ongoing supply-chain risk via developer tooling; useful background for a future policy requiring verified-source controls on open-source adoption, but no immediate leadership action is required.
- Engineer — Learn: No patch or PoC details are provided in this item, but the episode highlights the risks of coordinated vs. full disclosure and how platform policy can affect access to exploit research; no immediate action required on running systems.
- SOC/IR — Skip
- Leader — Learn: This dispute surfaces tension between Microsoft’s disclosure policy and independent researchers, relevant context for vendor risk assessments and your own organization’s vulnerability disclosure policy posture.
- Engineer — Plan: A public PoC exists for this GitHub RCE, raising urgency even though EPSS is 0.24 and KEV is not listed. If running GitHub Enterprise Server, apply available patches now and review CI/CD pipeline logs for anomalous workflow executions.
- SOC/IR — Plan: Public PoC availability makes pre-emptive detection work worthwhile before confirmed active exploitation. Build or tune rules around anomalous GitHub API calls, unexpected workflow triggers, and unusual code execution patterns in CI/CD infrastructure.
- Leader — Plan: GitHub is core infrastructure for most engineering orgs; confirm whether your deployment is GitHub.com or self-hosted Enterprise Server, and request GitHub’s remediation status — a public PoC with no KEV listing still warrants a near-term vendor risk check.
- Signals: CVE-2026-3854 — CISA KEV: not listed, EPSS 0.24, public PoC on GitHub