Wiz Research uncovered the Gheist campaign, a Gheist GitHub campaign planting 13,500 rogue branches across 850+ accounts to steal private repo secrets.

Related Posts:

• Exposed Cairn AI Panels Reveal Autonomous Hacking Against Over 1,100 Targets
• GMO Desktop Cloud Breach Exposes 26,000 FX Servers
• Suspected Chinese Operator Uses ARTEX AI Framework in Global Hacking Campaign

The post Gheist Campaign Abuses Stolen GitHub Tokens Across 850 Accounts to Steal Secrets appeared first on Daily CyberSecurity.

GitHub now expires npm trusted publishing setups that miss a first publish within 48 hours, closing a repo name reuse flaw in 1,500+ packages.

Related Posts:

• Google Updates Chrome VRP Rewards for Memory Flaws
• Google Play AI Apps Revolutionize Android Publishing
• Google Gemini 4 Argon Model Officially Launches

The post npm Trusted Publishing Now Expires After 48 Hours appeared first on Daily CyberSecurity.

A CVSS 10 GeoServer Cloud vulnerability in a GitHub Actions workflow could have leaked repository secrets. No abuse found, and the workflow is gone.

Related Posts:

• Critical Apache PLC4X Flaw Lets Attackers Hijack OPC UA Connections to PLCs
• TeamViewer Fixes Five High-Severity Flaws in Full Client and Host
• Electron Fixes Five High-Severity Sandbox and Isolation Vulnerabilities

The post GeoServer Cloud Fixes CVSS 10 GitHub Actions Flaw That Exposed Repository Secrets appeared first on Daily CyberSecurity.