HIGH/ OCTOBER 10, 2026TODAY’S BRIEFING — #204
GitHub Actions malware spreads to 340+ repos; ShinyHunters arrests escalate; Android firmware exploits widen
Attackers compromised high-profile open-source maintainer accounts to inject credential-stealing GitHub Actions workflows into 340+ repositories. FBI arrests of ShinyHunters members continue following FBI breach. Android firmware malware hits 150+ countries.
CVE-2026-105133AhsayCBS — Unpatched; authentication bypass and OS command injection; active exploitation reportedCVE-2026-105134AhsayCBS — Unpatched; active exploitation reportedCVE-2015-5477Isc Bind — Data processing error; remote DoS via TKEY queries; added to CISA KEV 2026-10-08CVE-2016-3081Apache Struts — Command injection via Dynamic Method Invocation; remote code execution; added to CISA KEV 2026-10-08
Read the full briefing →