This report discusses the limitations of AI code review tools that rely solely on comments in pull requests (PRs) to flag security issues. Comments from automated tools often blend into the noise of multiple bot messages and are frequently ignored or skimmed over, leading to security issues being merged without proper attention. The authors highlight a real example where sensitive information was exposed before authorization checks, which might have been missed if only commented on. Their solution is to fail the GitHub check itself for issues above a severity threshold, preventing merges until fixed, and providing instant fixes. This approach aims to increase the visibility and enforcement of security findings in code reviews.
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.
Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is presented to NeuVector, NeuVector accepts it because the only thing distinguishing "an assertion for NeuVector" from "an assertion for the wiki" is the element, and the `NotInAudience` warning that reports the mismatch is never read.
The npm package 'kartyk-github-single-ver-pkg' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized control and access to secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised system is strongly advised. However, removal of the package alone may not eliminate all malicious software introduced by the compromise.
The npm package 'kartyk-github-token-pkg' versions 1.0.3 and 1.0.4 contain malicious code that can fully compromise any computer on which it is installed or running. The compromise potentially allows an attacker full control over the affected system. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised computer is strongly advised.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (1c0bc4570b5c41bc6a589bf16daea1a90f52e57b878fe6219afb1102ec24c535)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
CVE-2026-85469 is a high severity vulnerability in Red Hat Quay 3 involving the quay-builder-qemu component. The flaw arises from reliance on the upstream Noelware/docker-manifest-action pinned to a mutable branch in the release workflow. This allows a remote attacker to inject arbitrary code, potentially leading to exfiltration of sensitive registry credentials or publication of malicious container images. The workflow also exposes the default GitHub token, which increases the risk and impact of the compromise.
In August 2026, the Pakistan-nexus threat actor APT36 launched Operation RapidRust, targeting government and defense organizations in India and Afghanistan with an updated arsenal of custom tools. The campaign introduced RUSTYSHADE, a Rust-based backdoor leveraging private GitHub repositories for command-and-control with AES-256-GCM encryption. Additional tools included RUSTYMOVE for USB-based lateral movement to air-gapped networks, PSNATCH and BASHNATCH for file exfiltration from Windows and Linux systems respectively. The attackers registered typosquatted domains impersonating Indian news outlets to stage malicious PowerShell scripts. Post-compromise activities revealed systematic network reconnaissance, credential harvesting, and lateral movement attempts, with operations conducted exclusively on weekdays between 4:00-11:00 UTC, demonstrating disciplined operational security and sustained targeting of South Asian government infrastructure.
A vulnerability in the RabbitMQ amqp091-go client prior to version 1.13.0 allows a malicious or compromised broker to cause a runtime panic by sending a specially crafted AMQP byte-array length value. This panic terminates the client process during certain protocol operations. The issue is fixed in version 1.13.0.
A vulnerability in the RabbitMQ amqp091-go client prior to version 1.13.0 allows a malicious or compromised broker to send an oversized long string in a table field. This causes the client to misinterpret subsequent data, disrupting connection integrity and availability. The issue is fixed in version 1.13.0.
A vulnerability in the RabbitMQ amqp091-go client prior to version 1.13.0 allows a malicious or compromised broker to cause excessive memory allocation by sending an extreme declared message body size. This can exhaust memory and terminate the client process. The issue is fixed in version 1.13.0.
A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the reason "completed".
The go-getter library up to versions 1.8.8 and 2.2.3 contains a privilege escalation vulnerability in its archive decompression handling. A crafted archive may cause files to be extracted with elevated permission bits. If extraction is performed by a privileged user, a local attacker could gain the privileges of that user. This issue is fixed in versions 1.8.9 and 2.2.4.
githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE_TITLE before shell parsing. An issue title containing shell command-substitution syntax can therefore execute commands on the GitHub Actions runner before the title is included in the Discord notification sent through DISCORD_WEBHOOK. Successful exploitation can manipulate or spoof trusted bot notifications and may expose the Discord webhook secret or other workflow environment data, depending on repository permissions. This issue is fixed by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.
The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into the observability pipeline. This issue is fixed in version 0.151.0.
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before webhook signature validation or confirmation that the host matches the repository URL in the signed payload. An unauthenticated attacker who can reach the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service. The exposed JWT may be used to attempt to mint installation access tokens during its validity window, subject to the GitHub App installation and permissions. The incoming webhook installation-lookup path is also affected, but exploitation of that path requires the valid incoming webhook secret for the target Repository CR. This issue is fixed in versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0.
A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.
A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A campaign named Miasma exploited a vulnerability in the Model Context Protocol (MCP) tool configuration process to gain OS-level access to 73 GitHub repositories, including one owned by Microsoft Azure. The attack leverages the fact that MCP clients trust tool descriptions as executable instructions without re-prompting or sandboxing, allowing malicious edits to MCP config files to run with developer privileges. This attack class, known as MCP tool poisoning, was first documented in 2025 and escalated to real-world exploitation by mid-2026. The campaign abused the approval process tied to server names rather than content, enabling malicious commands to execute automatically after initial approval. OWASP ranks this attack third in its MCP Top 10 threats. Mitigations include rigorous code review of MCP config changes, pinning tool definitions, scoping privileges per tool, maintaining allowlists of MCP servers, and sandboxing agent execution.
