Gheist campaign uses stolen GitHub tokens to plant secret-dumping workflows

·2 views

A campaign dubbed Gheist was reported to have abused stolen GitHub tokens to plant workflows designed to dump secrets. The attempted large-scale abuse reportedly stumbled before achieving its aims, according to research published by Wiz. The source material provided is limited to a link and brief metadata, so further technical details about the scope, targets, and timing are not available here. Readers are directed to the original Wiz blog post for the full analysis.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why LLM eval score gains may be noise, and how paired bootstrap tests can gate changes

Teams often approve prompt or model changes based on small average eval score gains that turn out to be statistical noise, leading to production regressions. Eval results are affected by sampling noise in small golden sets, judge variability, and task-level factors like temperature and retrieval drift. Comparing baseline and candidate configurations on the same examples, rather than comparing raw averages, cancels out example difficulty and isolates the real change. The article explains that the required sample size depends on how often the two configurations disagree per example, and that small gains are often undetectable with a 200-example set. It proposes a simple stdlib Python paired bootstrap gate that ships a change only when the confidence interval of the difference clears zero.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

msiexec repair mode can resolve source paths from user-writable installer directories

A DEV Community article explains how Windows Installer's repair operation restores missing or modified files using source locations recorded in the installation database. When original media is unavailable, msiexec may fall back to cached package data or directories derived from the installation context. The author notes that per-user installs write into user-writable profile directories, while per-machine installs typically use administrative resolution paths. The piece advises checking whether affected products run services or tasks as SYSTEM and verifying resulting paths after deployment. It stresses that exploitability depends on each product's component registration, install scope, and source directory permissions, and makes no claim about any specific vendor.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Handling Failures in Healthcare AI Agent Workflows

Agentic healthcare systems coordinate several dependent operations, so a failure in one step can stop an entire workflow from reaching its goal. Common examples include rejected referrals, unavailable services, missing authorizations, incomplete records, and repeated communication breakdowns. The article argues that robust architectures should separate transient errors, which may warrant bounded retries with backoff, from recoverable failures needing more information or an alternative pathway, and from persistent or clinically serious failures that should be escalated. It stresses keeping workflow state observable by logging completed steps, failed operations, outstanding requirements, and attempted actions, which helps prevent duplicate execution and informs the receiving professional. Crucially, a technical failure should not be treated as resolving the underlying clinical task, so unresolved referrals must retain their status and be routed appropriately. The author closes by asking healthcare AI engineers and clinical informaticians which failure-handling patterns have proven effective.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Claude Code Deploys a Project, and a Live Console Shows It Update Without Refresh

A 26-second unedited recording shows an AI coding agent, Claude Code, deploying a Postgres database, an API, and a web service. On the adjacent screen, a live console updates on its own as each component restarts and turns green. The console receives no manual refresh and no pushed feed, since it re-reads status on a timer. The author says the motion was deliberately designed so developers can watch the deployment progress. The post is promotional for the gagarin.cloud platform, which lets users hand over a repository for deployment.

0 comments Read more at DEV Community