Command Injection Campaign Hits 61 GitHub Repos, Aiming at CI/CD Secrets
A coordinated command-injection campaign targeted 61 public GitHub repositories on September 1, 2026, using issues, pull requests, and comments to trigger code execution inside GitHub Actions workflows. Radware’s investigation identified 83 malicious items posted that day, with most activity concentrated in two rapid waves. The incident highlights how routine project discussions can become an entry point into automated build systems when workflows treat untrusted text as executable code. How the…