Two GitHub Actions hit by Mini Shai-Hulud re-enabled with their payload still live
The actions-cool/issues-helper and maintain-one-comment actions, compromised on 18 May 2026 in the Mini Shai-Hulud campaign, were re-enabled on 16 September with tags still pointing at malicious code, according to Socket. The lesson is blunt: in CI/CD, a mutable tag is a door left open.