10/07/2026-10/14/2026 GhostAction Attack Compromises 500+ GitHub Accounts; Docker Fixes Critical Two-Year-Old Hub Flaw; Critical Code Injection and Memory Corruption Vulnerabilities And More.

1. GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub now expires unvalidated npm trusted publishing configurations 48 hours after creation, after Bloom Security found attackers could push new versions of others’ packages without stealing credentials. A configuration becomes validated after its first successful publish; changing the repository or project identity requires a new 48-hour window. npm also rejects trusted publishing tokens from GitHub Actions issue_comment events.

The flaw, dubbed SlugFest, stems from npm anchoring trust to a repository’s name (“owner/repository”) rather than its immutable ID until the first publish. If a maintainer renames, transfers or deletes a repository, an attacker can claim the freed name, mint an OIDC token, and obtain a publish credential for the victim’s package, inheriting its reputation and downloads. Bloom found over 1,500 vulnerable packages with more than 10 million combined downloads; AI agents pulling latest versions could worsen exposure. Maintainers should audit trusted publisher bindings, recreate them after renames or transfers, delete them when repositories are removed, and monitor unexpected publishes.

2. GhostAction Attack Compromises 500+ GitHub Accounts to Steal Cloud and AI Credentials 

A new GhostAction campaign has compromised over 500 GitHub accounts and, since October 7, 2026, spread malicious workflows across tens of thousands of repositories. It steals GitHub Actions secrets and searches source code and Git history for cloud and AI credentials.

An October 8 burst involved compromised maintainer accounts henrywoo and kitao, which injected security-audit.yml into 346 repositories, including uber/athenadriver and kitao/pyxel. The workflow runs on every push and manual dispatch, targeting secrets whose names were extracted from existing workflows. No malicious package releases had been found as of October 9.

The workflow also checks out full history and scans git log -p --all output for 13 credential patterns covering AWS, Anthropic, OpenAI, GitHub and others. Results go via cleartext HTTP POST to 193.32.204[.]199, even when nothing is found. Socket advises removing injected workflows, rotating all exposed credentials (not just Actions secrets), revoking sessions and tokens, scanning history, reviewing CloudTrail, and blocking the IP.

3. Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

A flaw in Docker Hub (CVE-2026-105445, CVSS 9.4) let one user push, pull or delete images as another. Docker fixed it on September 30 and found no evidence of exploitation.

The bug sat in the feature converting a personal account into an organization. Conversion transferred the account’s personal access tokens to the designated owner, but the token secrets stayed unchanged. An attacker could create a token, convert the account, name a victim as owner, and use the token as that victim, without the victim’s consent or notification.

Researchers Peter Molnar and Krisztian Hozak, who named it GhostPat, reported it; Docker fixed it within four hours. The flaw had been open since August 2024.

Docker reviewed about 304,000 pushes with transferred tokens and found no malicious activity, but treated all transferred tokens as possibly affected, since logs miss unused ones. Affected users were emailed October 2. Users should review tokens, revoke unfamiliar ones, and use organization access tokens for automation.

4. SAP Security Update Patches Critical Code Injection and Memory Corruption Vulnerabilities

SAP’s October 13, 2026 Patch Day fixes 22 entries: four critical, three high, 14 medium and one low, covering S/4HANA, NetWeaver, Web Dispatcher, Commerce Cloud and development libraries.

The top-rated flaw, CVE-2026-89111 (CVSS 10.0), is an OAuth2 server-side request forgery in SAP Cloud SDK for Python before 0.45.2. In multi-tenant BTP applications, an attacker controlling the tenant_subdomain parameter can redirect token requests and expose client credentials.

CVE-2026-89107 (9.9) lets an authenticated attacker with specific business privileges inject executable ABAP code through S/4HANA’s Manage Substitution/Validation Rules (Note 3805589). CVE-2026-89110 (9.9), a broken access control flaw in NetWeaver Visual Composer 7.50, and CVE-2026-89108 (9.1), a missing authorization check in Manufacturing Integration and Intelligence, are also critical.

CVE-2026-58249 (7.5) is a high-severity memory corruption bug in the Internet Communication Manager that lets unauthenticated remote attackers crash processes, with no confidentiality or integrity impact.

No exploitation of these flaws has been reported. SAP urges prioritized patching; administrators should check installed components against the full affected-version lists.

5. GitLab Patches Max-Severity Vulnerability CVE-2026-97229

GitLab has fixed CVE-2026-97229 (CVSS 10.0), a critical integer overflow in Community and Enterprise Editions that could let unauthenticated attackers execute code on servers. The cause is weak validation of regular expressions in CI/CD configurations. Affected versions are 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; users should upgrade. Researcher joaxcar reported it via HackerOne.
GitLab also patched three high-severity flaws:

• CVE-2026-92883 (8.7): a crafted repository can make another user’s browser run malicious JavaScript.
• CVE-2026-16301 (8.5): Developer-role users can bypass permissions and run pipelines on protected branches.
• CVE-2026-14814 (8.2): a pattern-matching flaw lets attackers manipulate cached files, so victims’ pipelines run malicious code and may leak environment variables.

In early October, GitLab fixed CVE-2026-90970 (9.9) in its AI Gateway. An authenticated user with Duo Agent Platform access could escape the prompt template sandbox via a crafted flow configuration and run commands on the gateway host. Fixed versions are 19.2.4, 19.3.2 and 19.4.1.

6. Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects

Anthropic has launched OSS Scanner, an opt-in, free AI vulnerability scanner for open-source projects, drawing on its Project Glasswing experience. Its strongest models, including Claude Mythos, will run periodic scans, and the reports are fully model-generated, with no human review or triage.

Anthropic expects to select projects using criteria similar to Google’s OSS-Fuzz. Core maintainers enroll by opening a pull request to the OSS Scanner GitHub repository with a YAML file giving the repository link, a primary contact email, and a Dockerfile path that builds the project with all dependencies so an offline agent can audit it. Optional fields include CC emails, a GPG key, a threat model file, and an opt-out flag. So far, 116 pull requests have been submitted.

Because of possible false positives, Anthropic imposes no 90-day disclosure period, though manually validated reports may follow its CVD policy.

Anthropic has identified over 29,000 candidate vulnerabilities, reported about 6,000, and produced 584 advisories as of October 2. It also announced a Critical Infrastructure Defense Program.

09/30/2026-10/07/2026 Critical Atlassian Flaw; WordPress Malware Comes Back After Removal; GitLab Patches Critical AI Gateway Flaw And More.

1. Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

A critical flaw (CVE-2026-21589, CVSS 9.3) in eight self-hosted Atlassian Data Center products lets unauthenticated attackers read files in the web application root directory. Attackers must already know a file’s exact name and path. Atlassian disclosed it on October 5 and listed fixed versions per product. Cloud products are already patched.

Atlassian advises upgrading to a fixed LTS version or later, including for end-of-life releases. If that isn’t possible immediately, take the instance offline or restrict external access. Temporary mitigations block URLs with “..” next to “/”, “” or “::”, including encoded forms, via a WAF or reverse proxy, a Tomcat RewriteValve rule, or urlrewrite.xml (Bitbucket). Atlassian calls these limited and no replacement for patching.

Details are inconsistent: the Crowd and Bamboo fixed versions differ between the advisory and the CVE record. Server editions are listed as affected with no fixes.
Atlassian found no exploitation in cloud, but can’t confirm for self-hosted instances. Teams should search access logs for traversal patterns. A similar Jira flaw (CVE-2021-26086) was later exploited.

2. WordPress Malware Comes Back After Removal Using a Self-Healing Backdoor

A WordPress backdoor called SC, documented by Sucuri on September 30, 2026, restores deleted malware within seconds by spreading its components across website files, the database, and server memory. The report doesn’t establish the original entry point or how many sites are affected.

SC occupies at least eight locations. A configuration directive launches a loader before ordinary PHP requests, and the loader rebuilds a fake caching plugin from copies, encoded backups, or recovery archives. Early-loading components and an injected theme block provide further recovery routes. The backdoor hides from plugin lists and update checks, conceals an administrator account, and can forge authentication cookies. For commands, it queries smart contracts through about twenty public Ethereum gateways, so blocking one route doesn’t help. Replies can deliver PHP, browser scripts, or orders to delete security plugins.

Sucuri advises neutralizing the loader target first, then removing the directive. Next come database payloads, shared memory copies, scheduled tasks, triggers, and hidden admins, then all files in one pass. Finish by closing the entry point and rotating credentials.

3. LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

Researchers have shown that a malicious spreadsheet can make LibreOffice and Apache OpenOffice run attacker code the moment it’s opened, with no macro-style warning. It works only when Java support is enabled, and so far exists only as a proof of concept, with no reported real-world use.

The attack chains normal features: a spreadsheet’s auto-refreshing “database range” fetches an ODB file from a web address, which names a JDBC driver hosted in a remote JAR file. The program downloads and starts it, running the attacker’s code without ever asking the user to trust the document. Researchers tested it on Windows and Linux.

LibreOffice fixed CVE-2026-63277 on October 5; users should update to 26.2.5 or 26.8.0. Apache OpenOffice (CVE-2026-59265) remains unpatched through version 4.1.16, with a fix expected in 4.1.17. Until then, disable Java or avoid opening untrusted spreadsheets.

4. GitLab Patches Critical AI Gateway Flaw Allowing Arbitrary Command Execution

GitLab has patched CVE-2026-90970 (CVSS 9.9), a critical flaw in its AI Gateway that lets authenticated users run arbitrary commands on self-hosted deployments. It affects versions from 18.1.6 up to, but excluding, 19.2.4, plus the 19.3 branch before 19.3.2 and the 19.4 branch before 19.4.1.

The bug is an improper neutralization issue in the custom-flow prompt template mechanism. A user with Duo Agent Platform access can submit a crafted flow configuration, escape the template sandbox, and execute commands on the gateway host or container.

Fixed releases are 19.2.4, 19.3.2, and 19.4.1. GitLab lists no workaround, so upgrading is the main mitigation. Because the AI Gateway is separate from the core application, administrators should check the gateway image or Helm configuration rather than assume a GitLab CE/EE upgrade covers it. Teams should also restrict flow-configuration access and review recent templates for unexpected changes.
GitLab.com, Dedicated, and instances using a GitLab-hosted gateway need no action.

5. 100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

CERT-UA has identified over 100 websites compromised in September 2026 with malicious JavaScript that serves LunexStealer, a campaign attributed to the cluster UAC-0277. Visitors see a fake Cloudflare verification page that tricks them into running a command (ClickFix), which installs a malicious MSI package. The script retrieves its settings from a Polygon or Ethereum smart contract (EtherHiding), and the lure is shown only to Windows users arriving from search results.

Three MSI variants exist: a basic installer; one that bypasses UAC, sets Defender exclusions and abuses a vulnerable AMD driver to blind security tools; and one that uses DLL sideloading.

LunexStealer also installs a browser extension, LUNARAXE, posing as “Microsoft Office Word Editor”. It steals cookies, history and credentials, strips CSP headers and can run arbitrary JavaScript. The NAIVEMESS component gives it file system access.
CERT-UA advises blocking the Run dialog, restricting MSI installs, monitoring msiexec.exe, enabling Microsoft’s vulnerable driver blocklist, and allowlisting browser extensions.

09/23/2026-09/30/2026 MCP Python SDK OAuth Flaw; Malware Spread Through Terraform Providers; AI-Powered CARBONATO Botnet Steals Credentials And More.

1. MCP Python SDK OAuth Flaw Lets Malicious Servers Steal Credentials and Take Over Accounts

A high-severity OAuth flaw in Anthropic’s official MCP Python SDK lets a malicious MCP server steal authentication material and take over accounts. Cycode says it affects HTTP-based clients on SDK versions 1.9.1 through 2.1.1.

The bug lies in OAuth discovery. An attacker-controlled server returns a 404 during authorization-server discovery, pushing the SDK onto a fallback path that accepts server-supplied OAuth metadata without validating the issuer. The metadata can name a legitimate provider, such as Okta, Google or Microsoft Entra ID, while pointing to an attacker’s token endpoint.

The victim still sees a real login page. Afterward, the client sends the authorization code, client secret and PKCE code_verifier to the attacker, who can redeem the code for a valid access token. Stolen secrets and refresh tokens may grant persistent access to cloud services and internal APIs.

Servers, local stdio clients and clients using their own tokens are unaffected. Upgrade to 1.30.0 or 2.2.0, clear stored registrations, and rotate secrets and revoke tokens if a client may have contacted an untrusted server. Also set issuer= explicitly for ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider.

2. The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths 

Malware has reached the tools developers use to manage cloud infrastructure. A campaign linked to Graphalgo planted a remote access program in Terraform providers and Go packages. It is the first time the firm has seen malware spread through Terraform providers.

In early September, attackers published two providers, one a typosquat of a popular Docker provider with 56 million downloads. The hidden code activates only when two Terraform inputs produce a specific hash, which makes casual testing unlikely to expose it. Two Go modules carried similar payloads, one hiding its code in an archive posing as a database file.

Once active, the malware reports system details via Slack and takes commands through Slack or an Ethereum test-network smart contract. Operators can run more Go or JavaScript code, or wipe the malware. Researchers counted 18 hostnames checking in: three Windows, five Linux and 10 Macs.

Affected teams should isolate the host, rotate credentials (cloud ones first), review recent Terraform runs and builds, and reimage. Preserve logs before cleanup.

3. Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content

The placeholder domain “third-party[.]com” has been serving a ClickFix lure to Windows browsers while showing a harmless decoy to other users. Unlike example.com, the domain is not IANA-reserved, so someone registered it. It is now flagged as malicious on VirusTotal and Google Safe Browsing. Since at least June 2026, Windows visitors have seen a fake Cloudflare check that poisons the clipboard and tells them to paste a command into the Run dialog, which fetches a remote PowerShell payload. macOS users see an error saying only Windows is supported. The domain appears in over 1,700 GitHub repositories, including AI agent skills and MCP-server docs.

Manifold found 13 more non-reserved placeholder domains. Two, yoursite[.]com and your-domain[.]com, serve scams and scareware to macOS users. Because the payload depends on the visitor, static file scans miss it. Developers should audit their docs and tests and use only reserved placeholders such as example.com, .org and .net.

4. AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway

CARBONATO is a Docker-based botnet, active since at least October 2024, that ThreatDown uncovered after finding the attackers’ unauthenticated container registry exposed online. In one day of passive collection, researchers pulled 4.3 GB of image data covering 59 repositories, 234 tags and 605 file blobs. The image histories revealed command-and-control addresses, bot tokens and the shared password for the crew’s own AI gateway. Evidence, including UTC-06:00 timestamps, the Telegram handle “Carbo506” and Costa Rican network infrastructure, points to Costa Rica.

The bot scans for Docker daemons that accept unauthenticated connections on port 2375. It then uses the Docker API to launch a privileged container with the host filesystem mounted and runs commands on the underlying machine. The container opens a reverse SSH tunnel to a relay in Costa Rica, using a port derived from the MD5 hash of the victim’s IP, installs an SSH server with the crew’s key, and sends a deployment report to Telegram.

Afterward, the implant installs the open-source Hermes Agent, whose persona file is rewritten to prioritize stealing AI API keys, and the botnet keeps spreading across networks on its own.

5. New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses

Researchers from VUSec and Scuola Superiore Sant’Anna have disclosed Branch Target Reuse (BTR), a new Spectre v2 variant that targets Just-In-Time (JIT) engines in browsers, language runtimes and operating system kernels across multiple CPU vendors. Modern CPUs restore code coherence after self-modification but don’t necessarily invalidate stale indirect branch predictions. When a JIT engine frees code and later reuses the address, an attacker can trigger a speculative jump to the obsolete entry point, hijacking control flow and leaking data.

BTR affects SpiderMonkey (Firefox), GraalVM and the Linux kernel’s cBPF JIT. Two proof-of-concept exploits recovered the root password hash within minutes on a fully patched Intel system with default protections. The attack also undermines mitigations for Training Solo (CVE-2024-28956 and CVE-2025-24495).

Linux has merged fixes (CVE-2026-64507 and CVE-2026-64508). GraalVM now randomizes JIT code-cache locations, while Mozilla is prioritizing site isolation over IBPB-based mitigations. The researchers warn that similar CPU flaws in handling rewritten code may emerge.