Re-enabled Malicious GitHub Actions Expose Thousands to Mini Shai-Hulud Payload

• •Two compromised GitHub Actions were re-enabled, exposing thousands of repositories.
• •The malicious code remained intact, allowing workflows to execute the payload again.
• •Developers are urged to pin actions to known-clean SHAs and rotate exposed secrets.

On September 16, 2026, two compromised GitHub Actions, actions-cool/issues-helper and actions-cool/maintain-one-, were re-enabled, exposing thousands of downstream repositories to malicious code from the May 2026 Mini Shai-Hulud campaign. The malicious tags remained intact, allowing workflows referencing these actions by version tag to resume executing the payload. The GitHub Actions were initially disabled on May 19, 2026, after being compromised on May 18, 2026, to harvest sensitive credentials from CI/CD pipelines. The threat actor did not need new exploits or infrastructure; the malicious code was already present. GitHub's dependency graph lists around 15,000 dependent repositories for actions-cool/issues-helper alone. Developers are advised to remove the affected actions, pin them to known-clean SHAs, and rotate exposed secrets. The current status is that both actions have been disabled again as of September 25, 2026.