Today’s Field Note

Two supply-chain-flavored problems need attention before the weekend. Threat actors are exploiting an unpatched critical and a medium-severity flaw in Ahsay’s AhsayCBS backup management platform to drop webshells and crypto miners; backup servers are high-value because they hold the keys to everything you were planning to restore from. Separately, StepSecurity flagged an ongoing credential-theft campaign that hijacked the maintainer accounts of popular projects (including the 18,400-star pyxel engine) to push a malicious GitHub Actions workflow into over 340 repositories, harvesting CI secrets as they go. If you pull from any of those repos or run their actions, your tokens may already be in someone else’s hands. Neither of these is a vendor press release. Both are live.

Today’s Action

  • Inventory any internet-facing AhsayCBS instances, pull them off the public internet or put them behind a VPN until Ahsay ships fixes, and hunt for unexpected webshells and miner processes.
  • Audit GitHub Actions workflow runs since early this week for unfamiliar steps, outbound calls, or secret exfiltration, especially in repos you forked or depend on.
  • Rotate any CI/CD secrets, PATs, and cloud credentials that could have been exposed through compromised workflows, and scope token permissions down.
  • Pin third-party GitHub Actions to full commit SHAs instead of tags, and enable branch protection plus required review on workflow file changes.
  • Check your backup server logs for new admin accounts and mass password resets, the same insider pattern that just put an engineer in prison this week.

Your backups are only as trustworthy as the box they live on.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.