🚨 ACTIVE EXPLOITATION
- fake-captcha-clickfix-mac-backdoor — Cyber Security News
📋 ADVISORIES
- Permissive GitHub Actions workflows expose tokens and secrets to attackers
Attackers can abuse permissive GitHub Actions workflows to steal tokens and secrets.- GitHub Actions users and organizations are affected.
- Pull-request workflows, third-party actions, and runner environments can expose GITHUB_TOKEN credentials, secrets, or build outputs.
- Contributor-controlled code can run in a privileged workflow and access tokens or secrets.
- Compromised actions or runner environments can also read credentials and alter build artifacts.
📎 Coverage: clearpathsecurity.co.uk · 👁 via securityboulevard.com (discovered)
🔓 CVEs & KEV
-
CVE-2026-78306 — CVSS 8.5 — DJI Drone Bluetooth Interface Unauthenticated DUML Command ExecutionDJI drone...
-
CVE-2026-78321 — CVSS 6.0 — DJI Drone HTTP Media Server Denial of Service via Connection Pool ExhaustionT...