Unidentified actors abused GitHub Issues to hit 61 public repos in under an hour

En bref

• Attackers abused issue events to launch GitHub Actions runs automatically.
• The campaign touched 61 public repositories in under one hour.
• No CVE was assigned; the exposure is configuration and automation abuse.
• Maintainers and consumers of affected repos should review workflow permissions and run history.

On October 29, 2026, an unidentified group exploited the interaction between GitHub Issues and Actions to launch an automated campaign against public code repositories. The activity reached 61 projects in less than an hour, according to the available facts, and appears to have relied on issue events to start workflow runs without manual intervention.

Because the repositories were public, the attackers could likely open issues or otherwise generate events that caused existing workflows to execute. This is a supply-chain concern: if a workflow has broad permissions or can access secrets, a malicious issue can become a path to code execution, artifact tampering, or release manipulation. No CVE has been assigned, which is consistent with abuse of configuration and automation rather than a software vulnerability.

Affected organizations include maintainers of the 61 public repos and anyone consuming their outputs. The short duration suggests scripting or tooling rather than a patient, manual intrusion. The lack of a CVE does not reduce risk; misconfigured workflow triggers are a common and often overlooked exposure.

IT admins should treat issue-triggered workflows as an attack surface. Review which workflows respond to issues, comments, or other public events, and confirm whether they run with write tokens or secrets. Where possible, require approval for runs from untrusted contributors and limit default token permissions.

Watch for unusual workflow runs, unexpected commits, changed release artifacts, and audit-log entries tied to issue events. Also monitor for repeated issue creation across repositories in a short window. Since the actors remain unidentified, attribution is not yet possible; focus on containment and hardening.

À faire maintenant

1. Audit every workflow triggered by issues, issue comments, or public events; disable any that are not required.
2. Set the default GITHUB_TOKEN to read-only and remove unnecessary secrets from issue-triggered jobs.
3. Require maintainer approval for workflow runs from forks or untrusted contributors, and restrict who can trigger automation.
4. Review Actions run history and audit logs around 2026-10-29 for suspicious issue-driven executions across public repositories.
5. Pin third-party actions to commit SHAs and apply least-privilege permissions to every job.
6. Enable alerts for spikes in issue creation and workflow runs, and rotate secrets if unauthorized execution is confirmed.

Source originale

The Register — Security