Compromised GitHub Actions Resurface, Spreading Mini Shai‑Hulud Malware

• 🔓 Two GitHub Actions (**actions-cool/issues-helper**, **actions-cool/maintain-one-comment**) were briefly accessible again before being disabled a second time this week.
  

• 📅 The repositories were originally breached during the May 2026 Mini Shai‑Hulud campaign.
  

• 👥 Developers who integrated these actions into their CI/CD pipelines could have inadvertently run the Mini Shai‑Hulud malware.
  

• ⚠️ This repeat exposure underscores the lingering threat posed by compromised supply‑chain components in the GitHub Actions ecosystem.
  

Takeaway: Immediately audit and replace any usage of the listed actions, and enforce strict provenance checks for all third‑party CI/CD assets.

---

Source: https://thehackernews.com/2026/09/compromised-github-actions-came-back.html

AI‑Powered Attack Retries Are Changing SOC Playbooks

• 🤖 AI is making a failed attack cheap enough to retry repeatedly, turning a single missed privilege‑escalation into a rapid‑fire series.
  

• ☁️ Threat actors start with a low‑privilege cloud account; the initial privilege escalation often stalls, but they can now cycle attempts instantly.
  

• 🛡️ Security Operations Centers (SOCs) and cloud‑centric teams feel the pressure as the old habit of spending hours poring over documentation becomes impractical.
  

• 📈 The rise in cheap retries boosts attack velocity, threatening to overwhelm conventional detection and response workflows.
  

Takeaway: Deploy AI‑driven automation to triage, replay, and analyze failed attempts, slashing manual review time and staying ahead of the faster attack cadence.

---

Source: https://thehackernews.com/2026/09/the-soc-doesnt-need-to-start-over-with.html

North Korean Hackers Swipe $351.6M from Bitget

• 🚨 $351.6 million was siphoned from Bitget’s hot and warm wallets after an unauthorized transfer was detected.
  

• 🌐 The perpetrators are believed to be North Korean threat actors, who breached the exchange’s backend.
  

• ⏰ The breach was flagged at 18:31 UTC on September 24 2026 by Bitget’s security monitoring.
  

• 🔐 Bitget confirmed its cold wallets and the vast majority of platform assets remain untouched.

Takeaway: Secure large crypto holdings with multi‑signature and offline (cold‑storage) solutions to limit exposure from hot‑wallet compromises.

---

Source: https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html

$351.6M Heist: Bitget Hit by Suspected North Korean Hackers

• 🚨 Bitget disclosed that suspected North Korean threat actors stole $351.6 million from its hot and warm wallets.
  

• 🕒 The breach was spotted at 18:31 UTC on September 24, 2026 when security alerts flagged unauthorized transfers.
  

• 🔐 Only a limited set of hot wallets were compromised; cold wallets and the vast majority of platform assets remain untouched.
  

• 📉 The incident highlights the inherent risk of storing large sums in hot/warm storage on crypto exchanges.
  

Takeaway: Regularly audit and cap hot‑wallet balances, enforce multi‑signature controls, and set strict withdrawal limits to reduce exposure.

---

Source: https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html

🚨 Critical WSO2 & Adobe Commerce Flaws Added to CISA KEV

• 🔎 CISA added two critical vulnerabilities affecting WSO2 and Adobe Commerce / Magento to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation.
  

• 🛠️ The WSO2 issue is identified as CVE‑2026‑5430, a path traversal flaw in the API Control Plane with a CVSS score of 9.8.
  

• ⚠️ The Adobe Commerce / Magento flaw(s) are also classified as critical, though specific CVE IDs were not disclosed in the brief.
  

• 📌 Both vulnerabilities are being actively weaponized, making rapid remediation essential.
  

Takeaway: 🔐 Immediately apply the latest vendor patches for WSO2 API Control Plane and Adobe Commerce / Magento, and keep an eye on the CISA KEV list for further updates.

---

Source: https://thehackernews.com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html

🚨 Cloudflare Containers Data Leak Fixed – What You Need to Know

• 🛡️ Flaw in Cloudflare Containers allowed a paying customer to read leftover disk space data from other customers’ containers on the same server.
  

• 👥 The exposed data originated from previous containers that had released storage, not from any active or live workload.
  

• 🔍 Cloudflare says attackers could not select specific victims, and the issue was patched after researchers reported it.
  

Takeaway: Regularly audit and rotate container storage policies, and stay updated on Cloudflare security notices to ensure residual data isn’t exposed.

---

Source: https://thehackernews.com/2026/09/cloudflare-fixes-flaw-that-let-one.html