Gheist turns stolen GitHub tokens into secret leaks

Check private repos for ci-sync branches. Also: LLM price cuts, Python CA fixes and ML Drift.

The main thing

If your org runs GitHub Actions in private repos, someone else's stolen token could be printing your production secrets into a log. Spend ten minutes on this before standup.

Wiz Research has tracked a campaign called Gheist since September 15, 2026. It takes compromised GitHub tokens and pushes a branch to every repo each token can reach. The branch adds a workflow that dumps the repo's secrets into its own run log. The tool downloads that log through the GitHub API and deletes the run seconds later.

The tricks are small and they work. The tool base32-encodes the secrets, and GitHub's log masking only catches values that appear verbatim. Repos with deployment environments get a job matrix that pulls environment-scoped secrets too, and those are often production credentials. The data leaves through GitHub's own API, so there is no attacker domain to block.

Public repos are mostly covered. Since July 28, 2026, GitHub has held suspicious runs in public repos until a collaborator approves them, and every public Gheist run Wiz checked is stuck at action_required. Private repos and GitHub Enterprise Server have no such hold. In enterprise orgs, Wiz saw the tool cycle through several users' tokens within minutes. Hours later, cloud credentials from the same org were used to enumerate AWS Secrets Manager. A newer variant also targets self-hosted runners and sweeps the host for tokens, keys and cloud metadata.

• Branch: ci-sync- plus six random characters
• File: .github/workflows/sync-check.yml, commit message ci: sync config, unsigned, authored as the token's owner
• Extra job sync-host with runs-on: self-hosted (seen since October 19)
• API user agent: gheist
• Scale: more than 13,500 planted branches from more than 850 accounts, still active as of October 24

What to do today: In private repos and GHES, search your audit logs for ci-sync-* branches and for runs deleted by the gheist user agent. Wiz notes that CloudTrail can show it even without GitHub logs: look for your own workflows running on ci-sync branches and assuming AWS roles. If you get a hit, treat every secret that repo and its environments can reach as leaked, and treat the token owner's account as compromised.

Quick bits

• LLM prices fell off a cliff. One example: GPT-6 Sol costs $2 / $10 / $0.20 per MTok, half the $4 / $20 input and output price of the temporarily discounted GPT-5.6 Sol, and Opus 5.5 is $4 / $20 / $0.20. The author points out that cache reads are 96 to 99% of agent token spend, so check those rates first. Your invoice says thank you.

• Wide events over metrics, logs and traces. This 2024 essay argues for Scuba-style events: one wide record per event, then slice it during incidents. Commenters ask fair questions about storage cost and PII.

• Google open-sources ML Drift. It is the Apache 2.0 GPU engine behind LiteRT, with OpenGL ES, OpenCL, Metal and WebGPU backends. It is part of Google’s LiteRT stack for on-device inference.

• Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18. The ssl module now blocks the compromised eMudhra intermediate CA keys (CVE-2026-115557), and tarfile gets a fix too (CVE-2026-114583). Only 3.15.2 and 3.14.10 ship binary installers; the other three are source-only.

• MCP C# SDK 2.0 goes stateless. HttpServerTransportOptions.Stateless now defaults to true; set it to false if your server needs sessions. Note that 2.3 made McpClient.ServerInfo nullable, which breaks source compatibility.

• DreamHost asks account owners to reset email and FTP/SFTP passwords. Account owners can set new ones now at panel.dreamhost.com under Mail > Manage Email or Websites > SFTP Users & Files. The File Manager is still offline, and DreamHost says it will never email you asking for your password.

• GitHub's secret scanning classifier. Regex finds the candidates, then a fine-tuned ModernBERT model drops the lookalikes. GitHub reports 11.5% higher owner-weighted acceptance and 86% lower median post-push scan time. The speedup let it add generic secret detection to push protection.

• The state of context engineering. The talk names four failure modes: poisoning, distraction, confusion and clash. The discussion turns to context size. One commenter reports no large change until roughly 700–800k tokens.

Also happening

• Removing Next.js got one blog to 100 on Lighthouse: the author reports the result after removing the framework.
• Faster pnpm installs on Vercel: 14% lower average install time on Pro with a restored cache, and it is automatic.
• pnpm 10.34.9: pnpm 10 now records the packageManager pin when it switches to it, and 10.34.8 recomputes hoists after a frozen install removes packages.
• POSIX wordexp(3) is dangerous: even with WRDE_NOCMD, keep untrusted input away from it.
• UTS #39: Unicode Security Mechanisms: the reference for confusable and mixed-script checks on identifiers.
• PaperPilot: a local Rust PDF toolkit with CLI, WASM and MCP; a commenter asks about MuPDF ancestry.
• Farol: an MIT-licensed risk map of a pull request for whoever presses merge.
• Microsoft-Decision-1 explained: a Qwen3.5-9B model that scores answer options and writes no prose.
• An older CNN beats frontier LLMs on skin cancer: 125 correct answers on 200 biopsied lesions, according to the author.
• IBM's CEO on on-prem open-weight models: treat it as a sales pitch.
• DeedReader: a $1.15 LoRA reads synthetic deeds at 99.6% and lets plain code check the math.
• Zig now requires parentheses for ambiguous precedence: This change is on Zig’s master branch.
• SIMD FAST corners on a $2 ESP32-S3: about 6 ms per QVGA frame.
• When a glibc update broke Chromium's audio (2021): a classic sandbox debugging story.
• AI didn't cause the tech jobs bust, but it explains the stall: one author's data case.
• Blast reports France asked ISPs to prepare social platform blocks: the targets were TikTok, Instagram, Snapchat and X.

Today's homework: grep for ci-sync. The coffee can wait five minutes.

← All issues