We hardened zizmor's GitHub Actions static analyzer (opens in new tab)

In March 2026, attackers exploited a pull_request_target misconfiguration in Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. the aquasecurity/trivy-action GitHub Action to exfiltrate organization and repository secrets, then used those credentials to backdoor LiteLLM on PyPI (see Trivy’s post-mortem for the ful...