Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

The document is a cybersecurity news feed covering active exploitation, malware campaigns, supply-chain compromises, credential theft, ransomware, espionage, and newly disclosed vulnerabilities. The most significant items include malicious GitHub Actions workflows planted across hundreds of repositories, a pre-authentication AnyDesk Linux exploit enabling root access, exploitation of AhsayCBS flaws to deploy web shells and XMRig miners, CISA KEV activity attributed to Flax Typhoon, iOS exploit-kit enhancements for keychain and cryptocurrency theft, and multiple npm and browser-extension supply