TL;DR
GitHub Actions were compromised a second time and resumed running Mini Shai-Hulud malware; suspected North Korean attackers stole $351.6M from Bitget exchange. Roundcube, WSO2, and Adobe flaws remain actively exploited. Patch immediately and audit repository access.
Executive Summary
- Two GitHub Actions repositories were disabled for a second time after becoming accessible and resuming execution of Mini Shai-Hulud malware, months after initial compromise.
- Cryptocurrency exchange Bitget reported a suspected North Korean backend compromise resulting in $351.6 million theft from hot and warm wallets on September 24, 2026.
- Roundcube Webmail pre-authentication SQL injection (CVE-2026-48842, CVSS 8.1) is actively exploited in the wild, confirmed by Canadian Centre for Cyber Security.
- WSO2 path traversal vulnerability (CVE-2026-5430) and Adobe Commerce incorrect authorization flaw (CVE-2026-71362) remain under active exploitation and were added to CISA’s Known Exploited Vulnerabilities catalog on September 24.
- macOS malware PamStealer introduced live C2 payload decryption and multi-layer persistence mechanisms, increasing detection evasion.
Top Threats Today
1. GitHub Actions Compromised Repositories Resume Malware Execution
Severity: HIGH Affected: Technology
Two GitHub Actions repositories from the actions-cool organization have been disabled for a second time after becoming accessible and resuming execution of Mini Shai-Hulud malware [1]. The affected repositories—actions-cool/issues-helper and actions-cool/main—were originally compromised during a May 2026 campaign but regained access months later [1]. This represents a persistent supply-chain threat to developers who may have integrated these actions into their workflows.
Sources:[1] The Hacker News
Recommended Action
- Audit all workflows and actions currently in use; cross-reference against compromised actions-cool repositories
- Review GitHub Actions execution logs and secrets access for anomalies since May 2026
- Rotate all GitHub tokens, API keys, and credentials that may have been exposed via these repositories
- Implement GitHub Advanced Security features to monitor for supply-chain artifact tampering
2. North Korean Attackers Steal $351.6M from Bitget Cryptocurrency Exchange
Severity: HIGH Affected: Finance
Cryptocurrency exchange Bitget reported that suspected North Korean threat actors stole $351.6 million from its hot and warm wallets on September 24, 2026, at 18:31 UTC [1][2]. The breach resulted from a backend compromise detected by Bitget’s security systems, and some wallet addresses linked to the attacker have been frozen [2]. Bitget stated it will cover losses using its User Protection Fund, which holds over $464 million ⚠[1].
Sources:[1] The Hacker News[2] SecurityWeek
Recommended Action
- If holding funds on Bitget, immediately verify account balances and review recent transaction history
- Enable multi-signature withdrawal requirements and IP whitelisting on all crypto exchange accounts
- Monitor blockchain transaction records for suspicious outflows tied to your wallets
- Coordinate with compliance and legal teams if institutional exposure exists
3. Roundcube Pre-Authentication SQL Injection Actively Exploited
Severity: HIGH Affected: Technology
The Canadian Centre for Cyber Security has confirmed that CVE-2026-48842, a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail, is being actively exploited in the wild [1]. The vulnerability carries a CVSS score of 8.1 and affects multiple versions of Roundcube [1]. An attacker can exploit this flaw without authentication, enabling data exfiltration and potential privilege escalation. ⚠
Sources:[1] The Hacker News
Recommended Action
- Immediately patch Roundcube to the latest patched version provided by the vendor
- Review webmail server logs for SQL injection attempts and abnormal database queries since July 2026
- Monitor for unauthorized user account creation or privilege escalation in webmail systems
- Isolate affected Roundcube instances from untrusted networks until patches are deployed
4. WSO2 Path Traversal and Adobe Commerce Authorization Flaws Under Active Exploitation
Severity: HIGH Affected: Technology
CVE-2026-5430 (WSO2 Multiple Products) and CVE-2026-71362 (Adobe Commerce and Magento) remain under active exploitation and were both added to CISA’s Known Exploited Vulnerabilities catalog on September 24, 2026, with federal remediation due September 27 [1][2][3]. WSO2’s path traversal vulnerability in API Control Plane, API Manager, Traffic Manager, and Universal Gateway can lead to unrestricted file upload and remote code execution [2]. Adobe Commerce’s incorrect authorization flaw allows attackers to gain elevated access to sensitive resources without user interaction [3].
Sources:[1] BleepingComputer[2] CISA KEV[3] CISA KEV
Recommended Action
- Prioritize patching of WSO2 API products and Adobe Commerce instances within the CISA federal deadline (September 27)
- Deploy input validation and file upload restrictions on affected API gateways pending patches
- Review access control logs for unauthorized administrative access attempts
- Implement network segmentation to restrict direct exposure of API management platforms to untrusted networks
5. PamStealer macOS Malware Enhances Evasion with Live C2 Decryption
Severity: HIGH Affected: Technology
Security researchers at Jamf Threat Labs have identified a new variant of PamStealer that implements live C2 payload decryption, requiring the main payload to be recovered using a server-side decryption chain [1]. The malware continues to leverage JavaScript for Automation (JXA) as its dropper mechanism but has modified its persistence and evasion capabilities [1]. This represents an escalation in capability and detection difficulty for macOS-targeted malware.
Sources:[1] The Hacker News
Recommended Action
- Implement behavioral monitoring for JXA script execution and keystroke logging on macOS endpoints
- Deploy endpoint detection and response (EDR) solutions tuned for macOS-specific malware patterns
- Disable JavaScript for Automation in System Settings if not operationally required
- Review macOS security logs for PamStealer indicators of compromise identified by Jamf Threat Labs
Today’s Action Checklist
- ☐ URGENT (by Sept 27): Patch WSO2 API products (Control Plane, API Manager, Traffic Manager, Universal Gateway) for CVE-2026-5430 per CISA federal deadline
- ☐ URGENT (by Sept 27): Patch Adobe Commerce and Magento instances for CVE-2026-71362 per CISA federal deadline
- ☐ HIGH: Patch Roundcube Webmail immediately for CVE-2026-48842 (pre-auth SQL injection, CVSS 8.1)
- ☐ HIGH: Audit GitHub organization repositories and Actions for references to actions-cool; rotate all GitHub-related secrets and API tokens
- ☐ HIGH: If using Bitget or holding cryptocurrency, verify balances, enable multi-signature withdrawal requirements, and monitor blockchain transactions
- ☐ MEDIUM: Patch Elementor WordPress plugin for CSRF vulnerability allowing unauthorized admin account creation
- ☐ MEDIUM: Review macOS endpoint logs for PamStealer indicators; strengthen JXA execution policies