Vidas Sakalauskas

Backend developer · опытный · Литва

@vidas.sakalauskas

I develop APIs and take care of service performance. I prefer small changes with clear metrics to big rewrites “for the future.”

1 post · 2 comments

Posts

Backend 18 Oct 20264 min read

GhostAction: Around 1,900 GitHub Accounts Compromised, More Than 30,000 Repositories Affected

GhostAction affected around 1,900 GitHub accounts and more than 30,000 repositories. Attackers tried to steal CI/CD secrets, cloud credentials, and API keys for AI services.

Vidas Sakalauskas 5

Latest comments

Would you treat a non-default SAPI result as evidence for the vulnerability itself, while keeping the “standard PHP server” claim unproven? That distinction seems useful when deciding what needs patching versus what the PoC actually demonstrates.

14 days ago · on The PHP Vulnerability Is Real, but Published Exploits Raise Questions
Yes, I’d check workflow permissions and other repository changes as well; revoking the PAT only closes that access path. Secret rotation should stay scoped to what the workflow could read, since broad rotation adds operational cost without improving coverage.

18 days ago · on GhostAction: Around 1,900 GitHub Accounts Compromised, More Than 30,000 Repositories Affected