GitHub account breaches spread credential-stealing workflows to 30,000 repositories

Attackers used roughly 1,900 compromised GitHub accounts to plant credential-stealing workflows in more than 30,000 repositories, while Nix, Lix and seven Linux kernel branches received security fixes. Elsewhere, Amazon acquired DuckLabs, Ubuntu completed its Rust-based coreutils rollout, and OpenAI set a January deadline for retiring four GPT-4 API models.

Key developments

GitHub workflow attack spreads

Attackers accessed roughly 1,900 GitHub accounts and used them to insert credential-stealing workflows into more than 30,000 repositories.

Credentials accessible to affected repository workflows are exposed to theft.

Oct 15 · The New Stack

Nix and Lix fix root escalation

Nix and Lix jointly disclosed root-privilege-escalation vulnerabilities affecting all systems that build untrusted derivations using their daemons. Fixed releases are available; CVE IDs have not yet been requested.

Building an untrusted derivation can compromise the host beyond the build environment.

Oct 13 · LWN.net

Seven kernel branches patched

Linux kernels 7.2.11, 6.18.57, 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272 fix CVE-2026-99999. The flaw in skb_checksum_help() allows IPv4 packets with bad checksum metadata to corrupt the network header.

Systems across seven supported kernel branches have a network-header corruption flaw to address.

Oct 15 · LWN.net

Amazon acquires DuckLabs

Amazon acquired DuckLabs, the company behind DuckDB, with Hannes Mühleisen and Mark Raasveldt continuing to lead the team under AWS. DuckDB will remain open source, and Aurora PostgreSQL has received its first DuckDB-powered feature.

DuckDB's stewardship now sits under AWS while its technology enters Aurora PostgreSQL.

Oct 17 · InfoQ

Ubuntu completes coreutils transition

Canonical released Ubuntu 26.10, completing its rollout of Rust-based uutils coreutils. The release also includes GNOME 51, stronger Microsoft Entra ID authentication integration and enterprise security features.

Scripts and development environments moving to Ubuntu 26.10 now run against a different coreutils implementation.

Oct 15 · LWN.net

GPT-4 retirement deadline set

OpenAI will retire four GPT-4 API models on January 14, 2027. GPT-4o users received three months' notice rather than the six months OpenAI had promised developers.

Applications using the affected models have a fixed migration and regression-testing deadline.

Oct 15 · The New Stack

VS Code isolates MCP approvals

VS Code 1.141.1 persists sandbox permission approvals only for the requesting MCP server. It also ignores legacy root-level allowedDomains and allowWrite grants at runtime while preserving shared and server-specific deny rules.

An approval for one MCP server no longer grants the same access to another server.

Oct 13 · VS Code Releases

Actions lockfiles enter preview

GitHub Actions workflow dependency lockfiles entered public preview across Free, Team, Enterprise Cloud and Enterprise Cloud with data residency plans.

Workflow dependencies referenced through movable tags or branches can be evaluated with lockfiles.

Oct 14 · Archive: 2026 - GitHub Changelog

Vite+ reaches stable release

VoidZero launched Vite+ 1.0, its first stable JavaScript toolchain release. It manages Node.js, package management and frontend development through one configuration file, with GitLab CI integration and Docker support.

Frontend projects can consolidate runtime, package and development tooling configuration in one toolchain.

Oct 14 · InfoQ

Dependabot broadens malware coverage

GitHub integrated OpenSSF malicious-package data into its Advisory Database, expanding Dependabot malware alerts across eight ecosystems.

More malicious dependencies can surface through existing Dependabot alert workflows.

Oct 16 · Open Source Security Foundation

Also this week

Security and review

• Google patched an unauthenticated remote-code-execution vulnerability in its developer documentation infrastructure after two months and paid $90,000 for the bug. The New Stack

• Node.js announced security releases for October 21, 2026. Node.js Blog

• Reviewers found a race in Linus Torvalds's ten-patch, LLM-assisted series addressing a longstanding folio-lookup problem. LWN.net · The New Stack

• GitHub made code scanning AI Scan for pull requests generally available, complementing CodeQL for languages and frameworks it does not currently cover. Archive: 2026 - GitHub Changelog

• Chainguard launched betas of Workspaces, which provides hardened microVM-based remote development environments, and Checks, which brings continuous integration into the development loop. InfoQ

• GitHub said its context-aware secret classifier raises weighted acceptance by 11.5% and reduces median scan execution time by 86%. The GitHub Blog

Languages and runtimes

• React 19.3, released September 9, introduces the react-dom browser() API so components can opt out of server-side rendering. InfoQ

• .NET 11 Release Candidate 2 became available with improvements across the runtime, libraries, SDK, MSBuild, NuGet, F#, ASP.NET Core, .NET MAUI and Windows Forms. .NET Blog

• Node.js released 24.22.0 for its LTS line and 26.12.0 for its Current line. Node.js Blog · Node.js Blog

• Go 1.27 improves HTTP/1 connection reuse, potentially speeding up programs that send many sequential requests. The Go Blog

• Rust published the 1.99.1 point release, available to existing rustup users through rustup update stable. Rust Blog

• Zod 4.5 and 4.6 introduce in-process schema compilation for faster parsing, a reported ninefold reduction in memory footprint and new validation features. InfoQ

• Helidon 27 adds restructured programming models, Helidon Messaging and Helidon Data JDBC in its first release under Oracle's Tip & Tail model. InfoQ

• Microsoft published October 2026 servicing updates for .NET and .NET Framework. .NET Blog

• Python 3.16.0 alpha 1 opened developer testing for the next Python release. Python Insider

Editors and tooling

• OpenCode detailed its 2.0 architectural overhaul, putting its terminal, desktop and web applications on a shared service roughly three months after the public beta launch. The New Stack

• Apple is introducing a JSON-based project configuration format in Xcode 27.2 to replace the traditional property-list format and improve readability, merging and modification by AI coding agents. InfoQ

• Microsoft introduced dotnetup for installing, managing and updating user-local .NET SDKs and runtimes on macOS and Linux. .NET Blog

• JetBrains' LSP-powered Java and Kotlin extension for Cursor and VS Code reached 1.0 ten weeks after its preview opened, bringing IntelliJ IDEA language intelligence to both editors. The JetBrains Blog

• The Go team introduced interactive refactoring in gopls and the Language Server Protocol, enabling dynamic, multi-step refactorings in editors. The Go Blog

• Google replaced Pytype with Meta-originated open-source Python type checker Pyrefly, citing faster, more accurate checking and lower infrastructure costs. InfoQ

• Lauterbach and JetBrains integrated TRACE32 with CLion so embedded C and C++ developers can debug applications on target hardware from the IDE. The JetBrains Blog

AI development

• GitLab 19.4 adds goal-driven GitLab Duo CLI operation, three hosted open-weight models, more Model Context Protocol tools and more detailed AI spending controls. InfoQ

• Google added local model support to the Antigravity SDK, allowing agentic workflows to run on developers' machines while using cloud models for higher-level tasks. InfoQ

• Google made Gemini 4 Argon available to developers on a paid tier with a unified one-million-token input/output limit. The New Stack

• Junie Local stabilized Windows support and added support for NVIDIA RTX Spark, which combines a Blackwell RTX GPU and Grace CPU for running larger local AI models. The JetBrains Blog

• Cloudflare open-sourced Void to help IT teams manage employee-built AI applications, including those created by people with little or no programming experience. The New Stack

• The open-source Reverse Engineer Anything project connects coding agents including Claude Code and Codex to Ghidra, Hopper and IDA for inspecting binaries and tracing function calls. InfoQ

• AWS previewed Well-Architected Agent to analyze cloud environments, prioritize recommendations, suggest remediation and review infrastructure-as-code before deployment. InfoQ

Platforms and governance

• Backstage 1.55 adds opt-in recovery of interrupted Software Template tasks from their last completed step and breaking changes to catalog, search and TechDocs, with 1.55.3 the current patch. InfoQ

• GitHub Enterprise Cloud made open-source license compliance generally available with ruleset-based dependency checks for centralized policy enforcement. Archive: 2026 - GitHub Changelog

• Cloudflare's managed OHTTP Gateway entered closed beta and refuses traffic arriving through Workers or Cloudflare-proxied hosts to keep client identifiers and request contents separated. InfoQ

Operating systems

• Linux 7.3-rc7 became available for testing with ext4 data=journal mode deprecated, and Linus Torvalds kept the final release planned for the following weekend unless new issues arise. Latest Linux Kernel Versions · LWN.net

• LineageOS released version 24.0 of its Android-based mobile distribution. LWN.net

What to watch

• Node.js security releases are scheduled for October 21, 2026; their fixes will determine the next runtime patching work.

• Linux 7.3's final release was planned for the weekend following the October 12 release-candidate announcement, unless new issues arise; watch for confirmation.

• Four GPT-4 API models are scheduled to retire on January 14, 2027, making migration results and application compatibility the next checks for affected users.