A campaign steals CI secrets from 1,800 repositories through 4,837 compromised GitHub accounts
Between November 10 and 11, 2026 an actor used credentials for 4,837 GitHub accounts to plant a secret stealer in the workflows of tens of thousands of repositories, according to Aikido Security. If you received a "docs: dependency audit notes" pull request after November 10, treat every secret in your pipeline as compromised.