Security firm Radware says it found “83 verified malicious items across 61 distinct repositories” on GitHub, “all published on September 1, 2026”. Its report, published on 29 October, names Google’s LangExtract, Aqua Security’s Trivy, the Brave browser and MLflow among the targets, and says 77 of the items appeared within about 43 minutes.
By our arithmetic that is about 1.8 malicious posts a minute in the first wave. Radware says 35 of the 83 items were still open when it verified its findings on 13 October, which by our arithmetic is about 42%, 42 days after the posts went up.
Short explainer · 61 GitHub Repos Targeted in 43 Minutes, Radware Says
A vertical news Short narrated from this piece’s headline and opening line.
Business Pill · Least privilege
An evergreen Business Engineer explainer on least privilege. It teaches the general idea only and does not discuss Radware’s report or this campaign.
The key insight: Radware says 83 malicious GitHub posts across 61 public repositories were published on 1 September 2026, 77 of them in about 43 minutes; by our arithmetic 35 of the 83, about 42%, were still open on 13 October.
Radware says the campaign targeted public repositories “through Issues, Pull Requests, and comments”, and that “The primary mechanism was shell command injection through untrusted GitHub content processed by GitHub Actions”. The goal, it says, was “executing commands in CI/CD environments and sending environment variables to an attacker-controlled server”.
In an exclusive interview with The Register, Radware researchers Gabi Nakibly and Zvika Babo said the attacker publishes an issue, pull request or comment “containing malicious commands hidden in HTML comments”, so the content is not visible on the rendered page. “The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully”, Nakibly told the outlet. We do not reproduce the payload here.
Radware’s 83 verified malicious GitHub items (1 September 2026) by where the command sat and by status on 13 October 2026; the share still open is our arithmetic.
The Scale and the Timing
Radware’s campaign table lists 59 issues and 24 pull requests. The command sat in the title in 31 cases, in the item body in 17 and in a comment in 35. The report says the first wave ran from 11:26:51 to 12:10:00 UTC, “43 minutes and 9 seconds”, and that a second wave of six cases followed later that day within about two minutes.
Radware counts “Distinct named accounts” at 74. Its researchers told The Register they suspect a single individual is behind the campaign, and the report says some accounts had prior legitimate development histories. Radware writes that “we do not have evidence that every account was compromised”.
The report names the most popular targets by GitHub stars, from agno-agi/agno at 42.7K to PX4/PX4-Autopilot at 12.8K. By our arithmetic, the 16 repositories it names carry about 460,600 stars combined, using Radware’s rounded counts. Radware says the targets span “AI frameworks, security tools, development infrastructure, databases, and widely used software projects”.
What Was and Was Not Proven
Radware says it examined logs from actual workflow runs and “found two prominent cases containing direct evidence that the malicious command executed inside the automation environment”. It adds that it “did not establish that the attacker successfully obtained repository write permissions, modified source code, or compromised downstream software”.
The researchers told The Register they disclosed their findings to the projects’ maintainers, and that most repositories were closed or fixed, but that they cannot confirm all of them were.
Why It Matters to the Business
The cost of an attempt is low. “Basically, every user with a GitHub account can try to run this attack”, Babo told The Register. Radware’s recommended defence is on the project side: treat issue titles, pull request bodies and comments as untrusted data, and keep them out of shell commands. Nakibly told the outlet that “The only way is to make sure that the workflow code is resilient”.
As we read Radware’s report, the entry point was ordinary project text: an issue title, a pull request body or a comment that a workflow then fed into a shell command.
As we read the report, the limits matter as much as the scale: Radware found evidence the command ran in two cases, and says it did not establish that any repository was taken over.
As we read the researchers’ advice, the fix sits with each project: Radware says issue titles, pull request bodies and comments should be treated as untrusted data and kept out of shell commands.
Gabi Nakibly, Radware, to The Register
“There is no way to stop the attackers from attempting”
Three Implications
FOR MAINTAINERS Radware says workflows should avoid inserting issue titles, pull request bodies and comments directly into run: blocks, and the researchers told The Register to limit the secrets available to such workflows.
FOR COMPANIES USING THESE PROJECTS Radware says it did not establish that any repository was taken over, and the researchers told The Register they cannot confirm that all affected repositories were fixed.
FOR GITHUB-BASED AUTOMATION Babo told The Register that any user with a GitHub account can try this attack, and Radware says it disclosed its findings to the projects’ maintainers.
The framework argues: “Enterprise SaaS is migrating from ‘tool you buy’ to ‘infrastructure you’re woven into.’”
As we read Radware’s report, the targeted projects include frameworks and tools that other software is built on, so a weak workflow in one of them matters to the projects woven into it. The framework was published in December 2025 and does not discuss this campaign.
What Is Not Established
Radware does not say what data, if any, left the two workflows where it saw the command run. The campaign took place on 1 September 2026 and the report was published on 29 October; Radware has not said which of the 61 repositories remained vulnerable at publication. The attribution to a single individual is the researchers’ suspicion, as told to The Register.
This Week In The AI Supercycle
Execution Fault Lines, Concentrated Demand, and Geopolitical Firewalls
This week’s issue: the AI build is not short of demand for its parts. It is short of cheap money, and its end revenue rests on a narrow base of large, often venture-funded buyers.
Radware says 83 malicious GitHub posts across 61 public repositories, including Google’s LangExtract, Trivy and Brave, were published on 1 September 2026, 77 of them in about 43 minutes. It found evidence the command ran in two cases and says it did not establish any repository takeover.
A note on sourcing. The counts, dates, placements and evidence findings come from Radware’s report of 29 October 2026, which we read on 30 October. The researchers’ quotes, the HTML-comment detail and the single-attacker suspicion come from The Register’s interview. We have deliberately left out the payload and the attacker’s server; maintainers should follow Radware’s mitigation section directly. We have not examined the repositories.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
