Adobe
Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
At a glance
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers.
Briefing
- IT leaders should assess whether GitHub workflows in their estate could be exploited in similar campaigns.
Next steps
Monitor- For awareness — no fixed action deadline for this reporting
- The attack leverages GitHub workflows that activate within a second when vulnerable.
Next steps
Monitor- No immediate technical action — track if your estate depends on the products or vendors discussed
Summary
- Attackers exploited GitHub issues to launch a supply chain campaign targeting 61 public repositories within an hour.
- A workflow is triggered automatically within a second, and if vulnerable, the attack executes successfully.
Read the original reportThe Register Security(opens in a new tab)
Products and services involved
- Adobe Campaign94% match confidence
Pulse
Last checked 3d ago · Recheck overdue since 7 Nov 2026, 14:49 UK time
- Story29 Oct 2026, 12:15 UK time · 29 Oct
Linked reporting from The Register Security (independent original reporting).
Read source (The Register Security)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- The Register SecurityNews
Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
- ProbableSummary fact75% confidence
'The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully'