Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

thehackernews.com Nov 12, 2026

Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

Curated by Shubham · TechCapsules · Nov 12, 2026

AI-summarised brief · reviewed before publication

An attacker leveraged credentials from 4,837 compromised GitHub accounts to deploy a secret‑stealing script across at least 1,806 repositories. The malicious code, inserted via pull requests titled “docs: dependency audit notes,” accessed CI workflow secrets, cloud credentials, and runtime tokens, then exfiltrated them to external servers or Telegram. SafeDep identified 8,093 repositories that received malicious commits, with 7,309 containing the stealer. Aikido Security warned that any account that opened a test pull request is compromised, urging owners to revoke tokens, enable 2FA, and rotate secrets.

💡 Why It Matters

· The breach exposes the breadth of GitHub’s supply‑chain risk, showing how compromised accounts can silently harvest cloud credentials across thousands of projects, potentially enabling attackers to pivot into deeper cloud infrastructures.

Capsules Cybersecurity

Read full article on thehackernews.com

Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

A critical vulnerability (CVE‑2026‑119618) in Apache HTTP Server’s HTTP/2 module (mod_http2) allows unauthenticated remote attackers to execute code on affected servers. The flaw, rated 9.8/10 on CVSS, impacts versions 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8–2.0.42. Red Hat released a patched package (2.4.71) and updated RHEL 9 and 10 yesterday, while other distributions are following suit. Administrators must disable HTTP/2 or upgrade to the fixed release to mitigate the risk.

💡 The flaw exposes servers to full control without authentication, threatening critical infrastructure that relies on Apache’s widespread deployment. Prompt patching is essential to prevent potential large‑scale compromises.

thequantuminsider.com · Nov 12

CyberRisk Collaborative Announces Virtual Event on Post-Quantum Readiness

CyberRisk Collaborative announced a virtual event, “Post‑Quantum Readiness: Preparing for Q‑Day,” scheduled for January 26, 2027. The program targets CISOs and senior security leaders, offering five 20‑minute sessions on quantum‑computing risks, cryptographic asset inventory, post‑quantum standards, migration planning, and enterprise governance. Speakers include representatives from the Foundation for Defense of Democracies, SAP, Georgia Tech, Citi, and NewYork‑Presbyterian Hospital. Sessions will be available on demand after the live event.

💡 The event equips leaders with actionable strategies to counter the looming threat of quantum‑enabled cryptographic breakage, ensuring long‑term data protection and regulatory compliance.

thehackernews.com · Nov 12

Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak…

Node.js released critical updates for its 22.x, 24.x, and 26.x lines, fixing 16 vulnerabilities, including two high‑severity HTTP/2 flaws that let unauthenticated clients crash servers or leak memory from other connections. CVE‑2026‑123863 causes crashes when a default HTTP/2 server replies before the request body arrives, while CVE‑2026‑123866 exposes memory across streams. A separate HTTPS flaw (CVE‑2026‑123864) permits reading of TLS keys and other users’ data. All affected versions now have patched releases; end‑of‑life lines remain vulnerable.

💡 The fixes prevent attackers from crashing Node.js‑based services or exfiltrating sensitive data, safeguarding critical web infrastructure that relies on HTTP/2 and HTTPS.

thehackernews.com · Nov 12

Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation

Zoom has issued patches for two Windows‑specific flaws in its Zoom Workplace client. The critical vulnerability, CVE‑2026‑108187, affects versions prior to 7.1.5 and allows an unauthenticated remote attacker to elevate privileges on the host system. A second issue, CVE‑2026‑108186, impacts versions from 7.1.0 up to but not including 7.1.8, also enabling privilege escalation without prior access. Both bugs can be exploited without special permissions, potentially giving attackers full control of affected machines. Earlier in July, Zoom released a fix for CVE‑2026‑53412, a high‑severity input‑validation error that could let unauthenticated users hijack accounts. Zoom has not reported active exploitation, and it urges users to install the latest updates immediately.

💡 Unpatched privilege‑escalation bugs give attackers direct control over corporate endpoints, turning a video‑call tool into a covert entry point for broader network compromise.

thehackernews.com · Nov 11

Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam…

Threat actors targeted Qlik Sense servers in October 2026, attempting to deliver PowerShell reverse shells to multiple EU customers within a three‑minute window. The activity mirrors a November 2023 CACTUS ransomware campaign that exploited the same Qlik vulnerabilities, now patched in August–September 2023. Cynet’s analysis revealed a one‑line reverse shell to 45.115.26.23:4455, followed by a Windows Go reverse shell to 45.115.26.23:4456 for reconnaissance and persistence. The malware also sought ActiveMQ processes, collected Linux credentials, and installed OpenSSH via scheduled tasks. An exposed directory on the same IP hosts a custom Go backdoor, ActiveMQ exploit, and a modified Veeam toolchain, suggesting preparation for broader attacks.

💡 The reuse of previously patched Qlik flaws shows attackers’ persistence and the risk of incomplete fixes. The discovery of a multi‑stage backdoor and exploitation of other enterprise tools signals a coordinated effort to expand lateral movement and persistence across diverse environments.

thehackernews.com · Nov 11

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

The U.S. Cybersecurity and Infrastructure Security Agency added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE‑2026‑111793 in Cisco BroadWorks and CVE‑2026‑20320 in Openwave Messaging Webtop Media Transcoder. Evidence shows attackers used the BroadWorks flaw to upload malicious files and harvest sensitive data, while an AI‑driven campaign, Operation Snowball, exploited the Openwave flaw to enumerate assets, steal credentials, and exfiltrate subscriber records from a European telecom provider. Both exploits involved advanced reconnaissance, autonomous tool development, and persistent web shells. The vulnerabilities were patched, yet exploitation continued, prompting urgent patching for federal agencies by November 24, 2026.

💡 The incidents reveal that AI‑assisted attackers can autonomously orchestrate multi‑stage breaches, turning known software flaws into large‑scale data theft. This underscores the need for rapid patch deployment and enhanced AI‑aware threat detection in critical infrastructure.