SecurityThe Hacker Newsabout 3 hours ago
GitHub Actions Re-Enabled, Malware Resumes
3 min read
Two compromised actions-cool GitHub Actions were re-enabled on September 16, 2026, and resumed executing Mini Shai-Hulud malware because release tags still pointed to malicious code from May 18. Workflows referencing the actions by version tag downloaded the payload on their next run, exposing CI/CD pipelines. GitHub disabled the repositories again; the cause of the re-enablement is unknown.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyGitHub
