GhostAction Hack Hits 1,900 GitHub Accounts, Targets 30,000 Repos
The GhostAction supply-chain campaign compromised about 1,900 GitHub accounts and targeted more than 30,000 repositories in an October 8–9 spike, attempting to steal 3,174 secrets from CI environments, per GitGuardian. GitHub began blocking the malicious workflows on October 9, stopping later waves. Sources: The Hacker News, GitGuardian, October 15, 2026.