Daily Brief — October 10, 2026

GhostAction's credential harvesting and AWS AgentCore's token leakage both show AI-adjacent infrastructure becoming the new credential-exposure surface, while Cloudflare absorbs Deno and Python 3.15 ships as separate platform bets teams now have to plan around.

84 reviewed · 3 Narratives · 8 Links

Must read

GhostAction Uses GitHub Actions to Steal Cloud and AI Credentials

The GhostAction campaign has evolved from CI/CD secret theft into broad credential harvesting through compromised GitHub accounts and malicious workflows. Since October 7, attackers have used more than 500 accounts to plant workflows across tens of thousands of repositories, while targeting cloud and AI credentials in source code and git history. The scale and propagation speed make workflow changes and repository history part of your credential-exposure surface, not just your build system.

Read today if you if you rely on GitHub Actions in repositories with broad write access

Highlights

More than 500 GitHub accounts committed credential-stealing workflows to tens of thousands of repositories since October 7, 2026.
Attackers used Takashi Kitao’s account to push the workflow to 27 repositories beginning at 13:20 UTC, then Henry Wu’s account to reach 318 repositories in a 16-minute window from 21:10 to 21:26 UTC.
The two compromised maintainer accounts pushed the malicious workflow to more than 340 repositories.
The campaign has expanded beyond CI/CD secrets to cloud and AI credentials stored in source code and git history.

Bottom line If your repositories or GitHub Actions workflows were writable by affected accounts since October 7, audit workflow changes and rotate exposed CI/CD, cloud and AI credentials now.

Signals2

Cloudflare takes in Deno to make Workers self-hosting first-class

Cloudflare is bringing the Deno team in to make the Workers and Durable Objects programming model easier to self-host, extending those primitives to more deployment environments. The move builds on Deno’s open-source celld project and Cloudflare’s workerd runtime, while putting the Deno runtime itself on a one-year maintenance clock. For teams using Deno, the deal expands the platform path but creates a concrete need to assess the runtime’s post-maintenance future.

Read today if you run Deno in production

Highlights

Cloudflare announced on October 9, 2026, that the entire Deno team is joining the company to simplify self-hosting Workers and Durable Objects.
Deno’s celld, released in August, is an open-source implementation of Cloudflare Workers’ Durable Objects pattern; Cloudflare plans to build on it to make workerd self-hosting a first-class way to run Workers applications.
Deno will receive monthly releases containing bug fixes and security updates for another year, after which Cloudflare will end development of the Deno runtime; the project will remain open source.
Deno says its work on Deno Deploy exposed how much complexity remains beneath a simple application-running experience, reinforcing the focus on combining compute, storage and communication primitives.

Bottom line If you run Deno in production, review your runtime support and ownership plan before the one-year maintenance window ends; otherwise, watch the workerd and self-hosting path.

Signals4

Python 3.15 Makes UTF-8 Default and Adds New Built-ins

Python 3.15 is now a stable release, combining new language and runtime features with changes to startup behavior and default text encoding. The release adds sentinel and frozendict built-in types, explicit lazy imports, and UTF-8 as the default encoding, while also improving the experimental JIT. These changes make runtime and compatibility testing important for teams moving from Python 3.14.

Highlights

Python 3.15 became the stable release on October 9, 2026, after 5,643 commits from 1,012 contributors.
The release adds sentinel and frozendict built-in types, along with unpacking in comprehensions.
Explicit lazy imports and package startup configuration files provide new controls over startup behavior.
The experimental JIT compiler received further improvements compared with Python 3.14.

Bottom line If you maintain Python runtimes or packages, test encoding, startup, and import behavior against Python 3.15 before upgrading production environments.

Signals2

AI & Agents

AI & Agents entries show infrastructure standardizing faster than its security model: AWS, Upstage, and Ollama agreeing on a shared decision-model API arrives alongside a report that AWS's own AgentCore leaks credentials through weak isolation and overly broad permissions, leaving the credential layer as the gap vendors haven't closed yet.

AWS AgentCore leaks tokens via metadata, weak VM isolation, wide permissions

This is a design-level weakness, not a single bug, which makes it harder to patch away. The report describes tokens transmitted in metadata, insufficiently isolated VMs, and overly broad permissions combining so that a crafted prompt can extract credentials from the agent runtime itself. Teams adopting AgentCore need to scope permissions tightly and treat prompt input as an attack vector against the credential layer, not just the model.

theregister.com →

AWS, Upstage, Ollama align on shared decision-model API; OpenAI stays out

This is a standardization move that fragments the ecosystem along vendor lines before it unifies anything. AWS, Upstage, and Ollama have agreed on a common API for decision models, while OpenAI has not signed on to the agreement. Teams building on this API now should weigh the risk of committing to a standard that one major model provider hasn't endorsed.

The New Stack →

Security

Security entries converge on a widening and shortening trust window: GhostAction's credential harvesting, a public pre-auth AnyDesk root exploit, a CISA deadline for actively exploited flaws, and a new critical NetScaler bug show attackers outrunning patch cycles, while Let's Encrypt's shorter cert lifetimes and Anthropic's new scanner push the other way toward faster-expiring, faster-detected trust.

PostgreSQL JDBC 42.7.14 patches two CVEs, 107314 and 107315

This is a maintenance-grade fix, not an emergency one, but any service using the JDBC driver should still pick it up on the next patch cycle. The release addresses CVE-2026-107314 and CVE-2026-107315, each tracked under a matching GitHub Security Advisory, with details left to the release notes rather than the announcement itself. Teams running PostgreSQL JDBC in production should treat the update as a routine dependency bump for the next deploy window.

PostgreSQL →

Let's Encrypt shortens certs to 64 days starting February 2027

This is a multi-year glide path, not a surprise shift, giving teams real lead time to automate renewal before it bites. Let's Encrypt confirmed 64-day lifetimes as the second stage toward the CA/Browser Forum's eventual 45-day requirement, with existing 90-day certificates allowed to expire naturally rather than being revoked. Any TLS automation still assuming quarterly renewal cadences needs to be rechecked well before the cutover date.

LWN →

Public exploit gives root on unpatched AnyDesk Linux via port 7070

This is now a live, no-click risk for any AnyDesk Linux install that hasn't moved past 8.0.2. The published exploit achieves pre-authentication root command execution over direct TCP connections, while AnyDesk's own changelog for the fix described it only as a crash fix with no CVE attached. Teams relying on AnyDesk for remote access should verify the patched version is actually deployed rather than trusting the changelog wording.

The Hacker News →

CISA gives agencies until Oct 11 to patch 5 Flax Typhoon-exploited flaws

This is a forcing function, not a routine advisory, and the short deadline reflects active exploitation by a state-linked actor. CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming abuse by Flax Typhoon, including an older flaw carrying a maximum CVSS score, and is requiring federal agencies to patch or stop using affected software. Any organization running the same software should read the KEV listing as evidence of real-world targeting, not theoretical risk.

The Hacker News →

Citrix patches new critical NetScaler flaw scoring 9.5 severity

This warrants urgent patch scheduling even without confirmed exploitation, given the severity score alone. Citrix has not disclosed whether the flaw is being actively exploited, but the 9.5 rating signals a near-total compromise scenario for affected NetScaler deployments. Admins should move this ahead of lower-severity backlog items given NetScaler's history as a favored target.

theregister.com →

Anthropic's new OSS Scanner finds vulnerabilities with no human review

This is a useful signal generator, not a replacement for audits, given the lack of review before reports go out. Anthropic's opt-in OSS Scanner runs periodic AI-driven vulnerability scans on open-source projects, built on experience from its Project Glasswing research, and ships findings without human verification. Maintainers adopting it should treat its output as a lead for triage, not a confirmed vulnerability report.

The Hacker News →

Architect’s corner

Transitive CI/CD trust

A CI/CD pipeline's trust boundary is never just the build config - it includes every repository, workflow file, and git history commit reachable by any account with write access, because secrets accumulate in all of them over time. GhostAction shows what happens when that boundary is treated as narrower than it is: a batch of compromised accounts becomes a vector for planting workflows across a large number of repositories, each one a potential credential-exposure point. Treating workflow files and git history as part of the same trust domain as production secrets, rather than as build-time scaffolding, is the only way to close that gap before scale makes it unmanageable.

Also noted

That’s the Brief for 10 October. A new one arrives every morning.

← All Daily Briefs