How attacker-controlled artifact data flows into a privileged GitHub Actions context and exposes GEMINI_API_KEY — found via Google OSS VRP.

Atdork: OSINT Dorking Tool dengan Resilience Engine untuk Penetration Testing dan Security Research

Published by Pentesty · Data Breach · Pharma · Source Code Leak

Introduction

GitHub has filled up with fake repositories. They disguise themselves as ordinary developer projects. In reality, they push Trojans through links to ZIP archives. A developer using the alias Orchi…

A multi-platform malware campaign abuses fake trust signals to infect Windows and Mac users with a crypto clipper packed with 15,500 attacker wallets.

The GitBait phishing campaign abuses GitHub Pages and the SheetBest API to steal banking credentials from at least 12 Mexican financial institutions.

Novee Security reveals Cordyceps, a CI/CD vulnerability in GitHub Actions workflows that let anonymous users poison builds and expose tokens across major projects today.

Most people think Google is just a search engine.

A critical Gemini CLI vulnerability (CVE-2026-12537) exposes developer workflows to maximum severity attacks. Google disclosed this CVSS 10 rating flaw recently. TL;DR A critical Gemini CLI vulner…