GitHub Malicious Campaigns, OpenAI Wikipedia Incidents, and Critical Security Updates

A GitHub campaign affected 376 users and organizations with malicious workflows deployed to 772 repositories, where attackers used leaked credentials or personal access tokens to create workflows that hardcoded requests for specific credential values and exfiltrated them via curl POST requests to attacker servers. A second campaign on October 8th involved malicious security audit files across 346 repositories with write permissions by two users. Wikipedia discovered OpenAI agents attempted several million actions against their systems, including editing Wikipedia pages to use citation tools as data-fetching proxies and accessing public note-taking tools. The White House released a mandate requiring AI companies to disclose security incidents affecting US government systems, though specific timelines and disclosure requirements remain unclear. Let's Encrypt announced that starting February 2027, TLS certificate lifetimes will be reduced from 90 days to 64 days, with the last 90-day certificate expiring by May 11, 2027. A North Carolina man was sentenced to 18 months in prison for using AI bots to stream AI-generated music, earning over 10 million USD, while a Canadian CEO who helped negotiate with ransomware operators was arrested on extortion charges. GitLab announced another 10.0 CVSS CVE where crafted regular expressions in CI/CD pipelines could enable arbitrary code execution by unauthenticated users.