Morning Brief
October 27, 2026 · 07:30
ThreatNoir Morning Brief — October 27
- •No highlights available yet.
- •Check back soon.
- •New briefings publish daily.
HIGH
ThreatNoir
Daily Brief
AI-filtered cyber intelligence for security practitioners.
Morning & Evening briefings. No noise. Just signal.
Supported by Your brand here
Top story · Rapid alert 27 Oct
Gheist campaign abuses stolen GitHub tokens to dump private repo and cloud secrets via Actions logs
Since 15 Sep 2026, the Gheist campaign has planted a sync-check workflow in over 13,500 branches using stolen GitHub tokens, printing secrets to Actions logs and pulling them before deleting the run. Public repos are protected by a GitHub hold, but private repos and GitHub Enterprise Server are not.
What to do nowLatest Briefs
View all briefsEvening Brief
October 26, 2026 · 18:00
ThreatNoir Afternoon Brief — October 26
- •No highlights available yet.
- •Check back soon.
- •New briefings publish daily.
MEDIUM
Red vs Blue
Real attacks. Real defenses. One minute to become stronger.
ATTACK vs DEFEND
1:40
Gheist Turns GitHub Tokens Into Secret Pipelines
Gheist malware compromised 850 GitHub accounts by exploiting overpermissioned personal access tokens to inject malicious workflows and exfiltrate cloud credentials at scale.
ATTACK vs DEFEND
1:20
WAF Turned Weapon: SiteGuard Root Takeover
SiteGuard WAF contains an OS command injection vulnerability in its statistics feature that allows unauthenticated attackers to execute commands with SYSTEM privileges. WAF appliances require the same configuration auditing and patch management discipline as production.
ATTACK vs DEFEND
1:00
Croatian Gambling Firm Fined for Fingerprint Grab
A Croatian gambling operator collected four fingerprints instead of two without explicit consent, resulting in a 2.59 million euro fine from the DPA for biometric data misuse.
Weekly Brief
The week in cyber, summarized.
Week of Oct 19 – Oct 25, 2026
- •PHP2Shell dominated the week: CVEs exploited before disclosure, millions of attempts, no confirmed compromises yet, but a third unpatched RCE arrived days later.
- •AI-accelerated attacks went mainstream: Storm-0940 used the Artex framework to compromise 300+ Entra tenants; ransomware affiliates deployed autonomous kill-chain agents; an AI agent tried to inject malware into a real GitHub repo.
- •Supply chain took two hits: LiteLLM 1.107.0 was backdoored via a leaked master key and served 49,000 malicious downloads; OVHcloud's CLI binaries were swapped on GitHub for 94 minutes.
- •️ Nation-state activity escalated: APT41's BlackX UEFI bootkit bypassed Secure Boot on fully patched Windows systems; Sandworm and UAC-0099 combined mesh-network backdoors with a wiper against Ukrainian infrastructure.
Get the weekly roundup
The week in security and what it means for your team. One email, no account needed. Privacy
Prefer a feed reader? Follow by RSS