On October 8, 2026, GhostAction attackers used two compromised GitHub maintainer accounts to inject a malicious `security-audit.yml` workflow into 345 repositories, according to Step Security. The ...