Threat Briefing: October 30, 2026

This week’s stories share a theme: attackers exploiting trusted platforms, stolen credentials, and legitimate infrastructure.

Gheist used stolen GitHub tokens to run malicious workflows through GitHub’s own Actions, evading network detection. 319 Chrome extensions abused the Chrome Web Store to route searches through attacker proxies. Stolen staff logins enabled account takeovers across K-12 districts. CISA warned of active exploitation of Fragnesia chained with PHP2Shell to deploy root-level webshells, including in a U.S. government-affiliated environment.

CISA also cited evidence that Chinese firms extracted billions of tokens from leading AI models to replicate them cheaply, raising IP and security concerns for financial services.

The takeaway: Attackers are leaning on trusted systems and compromised identities, not just zero-days. Prioritize credential management, supply chain security, continuous monitoring, and timely patching.

• CISA Warns of Fragnesia Linux Flaw Chained With PHP2Shell – CISA added CVE-2026-46300 (Fragnesia), a Linux kernel privilege escalation flaw, to its Known Exploited Vulnerabilities catalog. Attackers are chaining it with two critical PHP flaws (PHP2Shell) to plant webshells and run commands as root. Dream Security documented a campaign that rooted 25 servers across the U.S., Japan, Taiwan, and South Korea, including three in a U.S. government-affiliated environment. BleepingComputer
• Stolen K-12 Staff Logins Fuel Cross-District Phishing – MS-ISAC notified 808 of its 6,116 K-12 members that staff credentials were circulating on dark web marketplaces last school year. CIS assesses with high confidence that attackers will keep using compromised accounts to hop between districts this year. Help Net Security
• 319 Chrome Extensions Hijack Searches for 13.4M Users – Socket researcher John Tuckner found 319 extensions, with 13.4 million combined installs, that hijacked default search engines and routed queries through proxy servers to collect Yahoo and Bing referral payments. The finding adds 264 new add-ons to the 57 he identified in April 2025.BleepingComputer
• OpenAI Pays $6,000 for Reasoning-Trace Bypass – Xint found a technique called Compaction Smuggling that bypassed OpenAI’s August 2026 mitigations. It let an attacker move reasoning traces between models and extract them in plaintext. OpenAI patched the issue and paid a $6,000 bounty on October 23, 2026. SecurityWeek
• Gheist Campaign Steals GitHub Secrets via Planted Workflows – Wiz Research found Gheist uses stolen GitHub tokens to plant malicious workflows in private repositories and exfiltrate secrets through GitHub’s own API. Researchers recovered more than 13,500 planted branches across more than 850 compromised accounts. Help Net Security