[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgb3dEYZPS7dP33SRMQoeCuKfrzvZ0J-0t_1lr7-9sKA":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e5f2e09e-e544-4011-af0f-2a5460d8c9f3","‘Cordyceps’ CI\u002FCD Flaw Exposes Microsoft, Google, Apache Repos to Pipeline Hijacking","cordyceps-ci-cd-flaw-exposes-microsoft-google-apache-repos-to-pipeline-hijacking-11a02c","Novee Security reveals Cordyceps, a CI\u002FCD vulnerability in GitHub Actions workflows that let anonymous users poison builds and expose tokens across major projects today.","Novee Security has discovered Cordyceps, a systemic CI\u002FCD vulnerability in GitHub Actions workflows that allows unauthenticated users to poison builds and steal sensitive tokens. This flaw, which affects major projects from Microsoft, Google, and Apache, can lead to full administrative control over cloud networks by exploiting multi-step attack chains that bypass standard security scanners. The vulnerability is exacerbated by AI coding agents that perpetuate insecure configuration patterns.","Cordyceps CI\u002FCD flaw in GitHub Actions allows anonymous users to hijack builds and steal tokens.","https:\u002F\u002Fhackread.com\u002Fcordyceps-ci-cd-flaw-microsoft-google-apache-repos-hijack\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002F‘cordyceps-ci-cd-flaw-microsoft-google-apache-repos-hijack.jpg","2026-06-23T16:31:16+00:00","2026-06-23T18:00:25.303447+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"GitHub Actions","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":22},"Google",{"name":26,"type":22},"Apache",{"name":28,"type":19},"Azure Sentinel",{"name":30,"type":19},"AI Agent Development Kit","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,26],{"controls":57,"vendors":142},[58,86,115],{"slug":59,"name":60,"problem":61,"products":62},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":80,"vendor_name":21,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"slug":87,"name":88,"problem":89,"products":90},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"slug":116,"name":117,"problem":118,"products":119},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":137,"product_name":138,"url":140,"description":141},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[143,148],{"slug":144,"name":24,"logo_path":145,"roles":146},"google","\u002Fvendor-logos\u002Fgoogle.png",[147],"affected",{"slug":80,"name":21,"logo_path":81,"roles":149},[147],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":165},"cicd-pipeline-misconfiguration-exposes-major-open-source-repos-to-hijacking","CI\u002FCD Pipeline Misconfiguration Exposes Major Open Source Repos to Hijacking","The Cordyceps vulnerability exploits insecure GitHub Actions workflow configurations, allowing unauthenticated attackers to inject malicious code into build pipelines and steal sensitive tokens — including those granting cloud administrative access. The flaw is systemic, meaning it stems not from a single bug but from widespread insecure patterns embedded across major projects from Microsoft, Google, and Apache. Critically, AI coding assistants are actively propagating these insecure configurations by learning from and reproducing flawed patterns at scale. This matters because a compromised CI\u002FCD pipeline represents a full software supply chain breach, enabling attackers to tamper with software artifacts distributed to millions of downstream users. Standard security scanners are insufficient to detect these multi-step attack chains, leaving organizations with a dangerous blind spot.",[155,156,157,158,159,160,161,162,163,164],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-218 (SSDF) - Secure Software Development Framework","NIST SP 800-204D - Strategies for the Integration of Software Supply Chain Security","NIST AC-6: Least Privilege","NIST SA-15: Development Process, Standards, and Tools","SLSA Supply Chain Levels for Software Artifacts (Levels 2–3)","OpenSSF Scorecard - CI\u002FCD Best Practices","OWASP CI\u002FCD Security Top 10: CICD-SEC-4 (Poisoned Pipeline Execution)","OWASP CI\u002FCD Security Top 10: CICD-SEC-6 (Insufficient Credential Hygiene)",{}]