Post-mortem of Shai-Hulud attack on November 24th, 2025
1–10 of 77 posts
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#2I didn’t know what Posthog was before this event but the website is so unusable on Safari on MacOS or iOS for me i’m surprised I stuck through to discover the product.
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#3So it wasn't phishing attack? Wonder how those bot access tokens got stolen.
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#4So it wasn't phishing attack? Wonder how those bot access tokens got stolen.
> The PR was opened, the workflow run, and the PR closed within the space of 1 minute (screenshots include timestamps in UTC+2, the author's timezone):
It's an unfortunately common problem with GitHub Actions, it's easy to set things up to where any PR that's opened against your repo runs the workflows as defined in the branch. So you fork, make a malicious change to an existing workflow, and open a PR, and your code gets executed automatically.
Frankly at this point PRs from non-contributors should never run workflows, but I don't think that's the default yet.
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#5So it wasn't phishing attack? Wonder how those bot access tokens got stolen.
They explain how.
“ At 5:40PM on November 18th, now-deleted user brwjbowkevj opened a pull request against our posthog repository, including this commit. This PR changed the code of a script executed by a workflow we were running against external contributions, modifying it to send the secrets available during that script's execution to a webhook controlled by the attacker. These secrets included the Github Personal Access Token of one of our bots, which had broad repo write permissions across our organization.”
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#6So it wasn't phishing attack? Wonder how those bot access tokens got stolen.
They do explain all the details how the got the tokens stolen.
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#7So it wasn't phishing attack? Wonder how those bot access tokens got stolen.
They explain how. “ At 5:40PM on November 18th, now-deleted user brwjbowkevj opened a pull request against our posthog repository, including this commit. This PR changed the code of a script executed by a workflow we were running against external contributions, modifying it to send the secrets available during that script's execution to a webhook controlled by the attacker. These secrets included the Github Personal…
Oh. I mist be blind.
Well, that's a warning for all.
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#8Posthog's website design feels like a joke that went a bit too far
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#9So it wasn't phishing attack? Wonder how those bot access tokens got stolen.
It explains in the article under "Why did it happen?".
Re: Post-mortem of Shai-Hulud attack on November 24th, 2025
#10This is a great writeup, kudos for the PostHog folks.
Curious: would you be able to make your original exploitable workflow available for analysis? You note that a static analysis tool flagged it as potentially exploitable, but that the finding was suppressed under the belief that it was a false positive. I'm curious if there are additional indicators the tool could have detected that would have reduced the likelihood of premature suppression here.
(I tried to search for it, but couldn't immediately find it. I might be looking in the wrong repository, though.)