Posts of last few hours

A campaign called GhostAction has placed malicious GitHub Actions workflows in 790 repositories, putting cloud credentials, software-publishing tokens, and AI service keys at risk. The total is OpenSourceMalware’s count of publicly recoverable, validated repositories through October 9, 2026; it is not a claim that every repository leaked credentials or suffered confirmed misuse. The campaign abuses […]

The post Hackers Hijack 790 GitHub Repositories to Steal Cloud Credentials and AI API Keys appeared first on Cyber Security News.

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
• CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability  
• CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
• CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability 

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance. 

Revolut suffered a major service outage on Tuesday, October 20, 2026, disrupting payments, cash withdrawals, and access to its banking app. The digital bank said customer money and data remained safe while engineers worked to restore affected services. The disruption came as Google Cloud reported problems in its London region. Reuters reported that a person […]

The post Revolut Outage Disrupts Payments and Banking Services as Google Cloud Reports London Issues appeared first on Cyber Security News.

Scammers have weaponized a legitimate spend-management platform to send phishing messages and validate stolen financial credentials, turning trusted payment infrastructure into an operational part of fraud instead of attacking it directly. Group-IB documented the activity within a client environment after the platform reported suspicious payment notifications in late April 2026. According to the supplied research, […]

The post Scammers Turn Legitimate Fintech Platforms Into Phishing Tools to Steal Banking Details appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers linked to AI-assisted attacks on South Korean banks left parts of their own infrastructure open, giving researchers a view of their tools and preparations. The exposed files showed a wider operation involving cryptocurrency theft tools, Linux attacks, and mobile security testing beyond the banking campaign. Public reporting cited in the investigation said the breaches […]

The post Hackers Target South Korean Banks With AI, Then Accidentally Expose Their Own Attack Tools appeared first on Cyber Security News.

OVHcloud has reported a supply-chain attack involving its command-line interface (CLI) repository. An attacker exploited a developer’s GitHub account to distribute a malicious binary designed to steal sensitive information from users’ disks. CEO Octave Klaba confirmed the incident on October 19, 2026, after a customer reported it. The company identified the compromised release at 14:47 […]

The post Hackers Compromise OVHcloud GitHub Repository to Distribute Secret-Stealing Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.