10/07/2026-10/14/2026 GhostAction Attack Compromises 500+ GitHub Accounts; Docker Fixes Critical Two-Year-Old Hub Flaw; Critical Code Injection and Memory Corruption Vulnerabilities And More.

1. GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub now expires unvalidated npm trusted publishing configurations 48 hours after creation, after Bloom Security found attackers could push new versions of others’ packages without stealing credentials. A configuration becomes validated after its first successful publish; changing the repository or project identity requires a new 48-hour window. npm also rejects trusted publishing tokens from GitHub Actions issue_comment events.

The flaw, dubbed SlugFest, stems from npm anchoring trust to a repository’s name (“owner/repository”) rather than its immutable ID until the first publish. If a maintainer renames, transfers or deletes a repository, an attacker can claim the freed name, mint an OIDC token, and obtain a publish credential for the victim’s package, inheriting its reputation and downloads. Bloom found over 1,500 vulnerable packages with more than 10 million combined downloads; AI agents pulling latest versions could worsen exposure. Maintainers should audit trusted publisher bindings, recreate them after renames or transfers, delete them when repositories are removed, and monitor unexpected publishes.

2. GhostAction Attack Compromises 500+ GitHub Accounts to Steal Cloud and AI Credentials 

A new GhostAction campaign has compromised over 500 GitHub accounts and, since October 7, 2026, spread malicious workflows across tens of thousands of repositories. It steals GitHub Actions secrets and searches source code and Git history for cloud and AI credentials.

An October 8 burst involved compromised maintainer accounts henrywoo and kitao, which injected security-audit.yml into 346 repositories, including uber/athenadriver and kitao/pyxel. The workflow runs on every push and manual dispatch, targeting secrets whose names were extracted from existing workflows. No malicious package releases had been found as of October 9.

The workflow also checks out full history and scans git log -p --all output for 13 credential patterns covering AWS, Anthropic, OpenAI, GitHub and others. Results go via cleartext HTTP POST to 193.32.204[.]199, even when nothing is found. Socket advises removing injected workflows, rotating all exposed credentials (not just Actions secrets), revoking sessions and tokens, scanning history, reviewing CloudTrail, and blocking the IP.

3. Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

A flaw in Docker Hub (CVE-2026-105445, CVSS 9.4) let one user push, pull or delete images as another. Docker fixed it on September 30 and found no evidence of exploitation.

The bug sat in the feature converting a personal account into an organization. Conversion transferred the account’s personal access tokens to the designated owner, but the token secrets stayed unchanged. An attacker could create a token, convert the account, name a victim as owner, and use the token as that victim, without the victim’s consent or notification.

Researchers Peter Molnar and Krisztian Hozak, who named it GhostPat, reported it; Docker fixed it within four hours. The flaw had been open since August 2024.

Docker reviewed about 304,000 pushes with transferred tokens and found no malicious activity, but treated all transferred tokens as possibly affected, since logs miss unused ones. Affected users were emailed October 2. Users should review tokens, revoke unfamiliar ones, and use organization access tokens for automation.

4. SAP Security Update Patches Critical Code Injection and Memory Corruption Vulnerabilities

SAP’s October 13, 2026 Patch Day fixes 22 entries: four critical, three high, 14 medium and one low, covering S/4HANA, NetWeaver, Web Dispatcher, Commerce Cloud and development libraries.

The top-rated flaw, CVE-2026-89111 (CVSS 10.0), is an OAuth2 server-side request forgery in SAP Cloud SDK for Python before 0.45.2. In multi-tenant BTP applications, an attacker controlling the tenant_subdomain parameter can redirect token requests and expose client credentials.

CVE-2026-89107 (9.9) lets an authenticated attacker with specific business privileges inject executable ABAP code through S/4HANA’s Manage Substitution/Validation Rules (Note 3805589). CVE-2026-89110 (9.9), a broken access control flaw in NetWeaver Visual Composer 7.50, and CVE-2026-89108 (9.1), a missing authorization check in Manufacturing Integration and Intelligence, are also critical.

CVE-2026-58249 (7.5) is a high-severity memory corruption bug in the Internet Communication Manager that lets unauthenticated remote attackers crash processes, with no confidentiality or integrity impact.

No exploitation of these flaws has been reported. SAP urges prioritized patching; administrators should check installed components against the full affected-version lists.

5. GitLab Patches Max-Severity Vulnerability CVE-2026-97229

GitLab has fixed CVE-2026-97229 (CVSS 10.0), a critical integer overflow in Community and Enterprise Editions that could let unauthenticated attackers execute code on servers. The cause is weak validation of regular expressions in CI/CD configurations. Affected versions are 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; users should upgrade. Researcher joaxcar reported it via HackerOne.
GitLab also patched three high-severity flaws:

• CVE-2026-92883 (8.7): a crafted repository can make another user’s browser run malicious JavaScript.
• CVE-2026-16301 (8.5): Developer-role users can bypass permissions and run pipelines on protected branches.
• CVE-2026-14814 (8.2): a pattern-matching flaw lets attackers manipulate cached files, so victims’ pipelines run malicious code and may leak environment variables.

In early October, GitLab fixed CVE-2026-90970 (9.9) in its AI Gateway. An authenticated user with Duo Agent Platform access could escape the prompt template sandbox via a crafted flow configuration and run commands on the gateway host. Fixed versions are 19.2.4, 19.3.2 and 19.4.1.

6. Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects

Anthropic has launched OSS Scanner, an opt-in, free AI vulnerability scanner for open-source projects, drawing on its Project Glasswing experience. Its strongest models, including Claude Mythos, will run periodic scans, and the reports are fully model-generated, with no human review or triage.

Anthropic expects to select projects using criteria similar to Google’s OSS-Fuzz. Core maintainers enroll by opening a pull request to the OSS Scanner GitHub repository with a YAML file giving the repository link, a primary contact email, and a Dockerfile path that builds the project with all dependencies so an offline agent can audit it. Optional fields include CC emails, a GPG key, a threat model file, and an opt-out flag. So far, 116 pull requests have been submitted.

Because of possible false positives, Anthropic imposes no 90-day disclosure period, though manually validated reports may follow its CVD policy.

Anthropic has identified over 29,000 candidate vulnerabilities, reported about 6,000, and produced 584 advisories as of October 2. It also announced a Critical Infrastructure Defense Program.