> InfoSec News Nuggets – 10/26/2026

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs An automated campaign that Wiz has tracked since September 15 and named Gheist is using stolen GitHub tokens to plant workflows on new “ci-sync-” branches that print every secret a repository can read into its GitHub Actions logs, encoded in base32 to slip past GitHub’s log masking, before downloading the logs and deleting the runs within seconds. Wiz recovered more than 13,500 planted branches from over 850 compromised accounts, and while GitHub’s hold on suspicious workflows blocked every public-repository run it checked, that safeguard does not cover private repositories or GitHub Enterprise Server, where the attacks succeeded. Affected organizations are advised to rotate every secret the repository could access, revoke the tokens that pushed the commits, and check token owners’ devices for infostealers.   AI coding agents hijacked using AGENTS.md file in Downloads folder Researchers at Forever Security found a malicious AGENTS.md instruction file in a customer’s Downloads folder that tried to trick an AI coding agent into installing the rogue npm package function-color, then reproduced the attack against OpenAI Codex with a 90% success rate and showed a related CLAUDE.md technique that could leak Claude Code OAuth tokens. Because browsers such as Chrome, Edge, and Firefox save files to Downloads without prompting by default, a malicious web page could quietly drop the file, which an agent will treat as instructions if it is launched from that folder. The researchers say there is nothing for the AI vendors to patch, and users are urged to run coding agents only from the specific project directory and to review unfamiliar instruction files before letting an agent follow them.   Capcom Data Breach Exposes 11.7 Million Email Addresses Japanese game publisher Capcom disclosed that a third party gained unauthorized access to its CAPCOM ID online membership service, a breach discovered on October 19 that exposed 11,774,247 email addresses along with account creation dates, last login dates, login counts, and the IP addresses used for the most recent logins. In 43 cases, birth dates, gender, region, and nicknames were also exposed, and attackers illegally changed the passwords on 196 accounts, which the company has since reset. Capcom says services using CAPCOM ID remain operational, authorities have been notified, and customers should be wary of phishing emails impersonating the company or its partners.   TG-iPASS portal services disrupted since October 22 after suspected ransomware attack Telangana’s single-window portal for industrial clearances, TG-iPASS, has been down since October 22 after a suspected ransomware attack encrypted its database and renamed files with a “vgb” extension, leaving a ransom note on the server that listed only an email address and made no payment demand. The Telangana Cyber Security Bureau has registered a case under the Information Technology Act and is conducting a forensic examination of the affected server to determine whether any data was stolen. The outage has stalled the processing of industrial permissions for businesses, though officials say backups are available and restoration work is underway.   PHP exploitation moves at slower-than-expected pace, but millions remain at risk Exploitation attempts against the critical PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 have surged since disclosure, including activity tied to the Mirai-derived Potassium botnet, but researchers say successful compromises at scale had yet to materialize. VulnCheck found that most public proofs of concept target the rarely enabled “display_errors” setting and many are nonfunctional, while Mandiant validated some exploits capable of remote code execution against default mod_php deployments, though not PHP-FPM, and warned that limited exploitation may already have begun. With PHP powering roughly 70% of websites, defenders are urged to upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, restart web services, and rotate keys and passwords on internet-facing systems exposed before patching. The post InfoSec News Nuggets – 10/26/2026 appeared first on AboutDFIR - The Definitive Compendium Project.