GitHub Gaffe: Over 23,000 Organizations Exposed by Malicious Action Mishap!
Over 23,000 organizations learned the hard way that their GitHub Actions were a little too public. A compromised GitHub Action leaked secrets like a sieve, exposing CI/CD secrets to anyone with a Wi-Fi connection. The attack, which targeted the tj-actions/changed-files, has been tagged with CVE-2025-30066. GitHub has since removed the compromised code.
Hot Take:
Who knew that secrets could be so easy to spill? In the latest installment of “Oops, I Did It Again,” over 23,000 organizations learned the hard way that their confidential data was just a GitHub Action away from being exposed. Let’s just hope this was a dress rehearsal and not the main event in the cybersecurity theater!
Key Points:
- Over 23,000 organizations unknowingly exposed secrets due to a compromised GitHub Action.
- GitHub Actions is a platform for CI/CD, which helps streamline code processes.
- Attackers tampered with the tj-actions/changed-files GitHub Action.
- The malicious commit allowed CI/CD secrets to be printed in public logs.
- No evidence that leaked secrets were exfiltrated, but concerns remain about potential software supply chain compromise.
Already a member? Log in here