Novee found a pattern of CI/CD vulnerabilities in GitHub Actions workflows that let any unauthenticated user hijack build pipelines, steal credentials, or push malicious code. They scanned 30,000 repositories and confirmed over 300 fully exploitable cases at Microsoft, Google, Apache, Cloudflare, and others. AI coding agents are accelerating the spread of these insecure YAML patterns, putting millions of projects at risk.

• Novee scanned 30,000 repos, flagged 654 with the vulnerable pattern, and confirmed 300+ fully exploitable chains—including at Microsoft, Google, Apache, and Cloudflare.
• Unauthenticated attackers with just a free GitHub account can trigger workflows via PRs or comments to hijack maintainer permissions, steal tokens, or push malicious code.
• Real exploits included stealing a non-expiring GitHub App key from Azure Sentinel, gaining GCP project owner access via Google's AI Agent Dev Kit, and executing arbitrary commands on Cloudflare's CI runners via a crafted branch name.
• AI coding agents are mass-replicating these insecure YAML patterns, and traditional scanners miss them because they treat workflows as config rather than executable code.

This daily roundup covers Fortinet’s FortiBleed campaign exposing 86,000 device credentials, a Texas hunting-license vendor breach affecting 3 million records, and an unpatchable BootROM exploit on Apple A12/A13 chips. It also highlights GitHub’s context-aware secret scanning, the Novo Nordisk code leak via a stolen GitHub token, and other emerging tools and vulnerabilities.

• FortiBleed exposed 86,000+ valid Fortinet credentials across 194 countries via 1.16 billion login attempts against 320,000 FortiGate devices, with hashes cracked on a 45-GPU cluster.
• A Texas hunting/fishing license vendor breach leaked driver's license and passport numbers for 3.09 million people, already being sold by a threat actor linked to a prior Virginia wildlife breach.
• The unpatchable "usbliter8" BootROM exploit affects Apple A12/A13 chips (iPhone XS to iPhone 11), installing a restart-persistent handler that downgrades security and boots unsigned code.
• GitHub's new context-aware LLM secret scanning cuts false positives by over 75% by isolating code paths where secrets feed into API calls, auth headers, or database clients.
• FulcrumSec stole a GitHub PAT to exfiltrate 1.3 TB from Novo Nordisk, including the Ozempic formula and clinical-trial data for 11,500 patients, leaking 264 GB after a refused $25 million ransom.

CISA warns that a Russian-speaking threat actor has harvested 86,644 valid logins from internet-facing FortiGate firewalls and VPNs using SSL VPN interception, GPU-powered hash cracking, and brute-force attacks. Major government entities and critical infrastructure providers are affected. CISA advises resetting credentials, enforcing PBKDF2 for admin logins, enabling phishing-resistant MFA, and tightening management access.

• 86,644 valid FortiGate credentials—about half of all internet-exposed Fortinet devices—were harvested via SSL VPN interception and GPU-cracked passwords, hitting government and critical infrastructure targets across 194 countries.
• Attackers ran 1.16 billion credential checks against 320,000 FortiGate devices and 2.1 billion brute-force attempts on 160,000+ Microsoft SQL servers, fully compromising at least four organizations.
• Huntress found 845 of its partner organizations directly affected by matching leaked IPs against its own data.
• CISA is urging immediate credential resets, session termination, a switch to PBKDF2 for admin password storage, phishing-resistant MFA, and locking down management interfaces to known IPs.

In 2025, infostealer malware infected over 11 million devices and exposed 3.3 billion credentials, browser artifacts, session tokens, and system metadata. Sold as malware-as-a-service for as little as $60 a month, strains like Vidar and Lumma use sandbox detection and obfuscation to evade defenses, harvesting passwords, cookies, crypto keys, and more. Attackers then resell the data or use the stolen credentials to gain undetected access and deploy ransomware.

• Infostealer malware hit over 11.1 million devices in 2025, exposing 3.3 billion credentials and session tokens on underground markets, with kits renting for as little as $60/month.
• Vidar exploded in early 2026 to 73% of infections (up from 4th place), while 2025's leader Lumma collapsed to about 1.1%.
• Stolen data (passwords, cookies, session tokens, crypto keys, system metadata) is packaged into "stealer logs" and sold on to other criminal groups, who use it to bypass defenses and deploy ransomware.
• Victims typically have no idea they're compromised until ransom demands appear or their credentials surface for sale, since the malware evades detection via sandbox checks and obfuscation.