GitHub Actions Risk, VMware vCenter Flaws, and US-China AI Safeguards

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. It delivers concise, business-focused analysis for CISOs, security leaders, and decision-makers.

1. 01

   Top Story 1: No article content was available beyond a verification page, so there is no reliable story to report.

2. 02

   GitHub temporarily re-enabled two third-party Actions previously compromised in the Mini Shai-Hulud supply-chain campaign. Their mutable version tags still pointed to malicious code, potentially exposing tokens, credentials, and CI/CD secrets, highlighting the need to audit dependencies and rotate secrets after a suspected compromise.

3. 03

   China and the United States agreed to create a channel for AI-related incidents and improve military crisis communications. The limited progress could reduce escalation risks, while continued trade discussions may affect technology supply chains and broader business planning.

4. 04

   A new Windows botnet, x47.c, is being sold with capabilities including DDoS, credential theft, proxying, and AI credit theft. Its use of paid AI services creates a new financial and operational risk, allowing attackers to drain customer credits while keeping victim websites online.

5. 05

   VMware patched two critical, pre-authentication flaws in vCenter Server Appliance, including an authentication bypass and a path traversal vulnerability enabling arbitrary file writes and remote code execution. One flaw was exploited in the wild, making urgent patching essential for organisations protecting high-value virtualisation management infrastructure.