SECURITY CIPHER · BLOG
Incident Response
Posts from SecurityCipher.
GitHub Actions Secret Stealer (wfx): Hunt, Rotate, Harden
The November 2026 wfx campaign used 4,800+ stolen GitHub accounts to probe 64k+ repos and run a CI secret stealer in 1,800+…
OpenSSH Password Bypass on Alpine (CVE-2026-123158)
A 300-character password logs into Alpine accounts that have no password. CVE-2026-123158 explained, reproduced in a lab, and fixed: who is affected,…
October 2026 Patch Audit: PHP2Shell, GitLab, Node, LiteLLM
You patched in October. Prove it took: one read-only script that checks PHP2Shell, both GitLab CVSS 10s, Node.js and LiteLLM 1.107.0 on…