‼️ Mini Shai-Hulud came back without a new attacker update. Two compromised GitHub Actions became reachable again while their tags still pointed to malicious commits, letting downstream workflows resume executing the credential stealer. 🔗 Here's how the attack reactivated: https://thehackernews.com/2026/09/compromised-github-actions-came-back.html