[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5my7JdXIk5ucg31OWkZDecxdU5yAr-olrNUvUNEFUhs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":56},"2c56a798-4bae-48b5-8454-069fd4969636","cicd-pipeline-misconfiguration-exposes-major-open-source-repos-to-hijacking","e5f2e09e-e544-4011-af0f-2a5460d8c9f3","CI\u002FCD Pipeline Misconfiguration Exposes Major Open Source Repos to Hijacking","The Cordyceps vulnerability exploits insecure GitHub Actions workflow configurations, allowing unauthenticated attackers to inject malicious code into build pipelines and steal sensitive tokens — including those granting cloud administrative access. The flaw is systemic, meaning it stems not from a single bug but from widespread insecure patterns embedded across major projects from Microsoft, Google, and Apache. Critically, AI coding assistants are actively propagating these insecure configurations by learning from and reproducing flawed patterns at scale. This matters because a compromised CI\u002FCD pipeline represents a full software supply chain breach, enabling attackers to tamper with software artifacts distributed to millions of downstream users. Standard security scanners are insufficient to detect these multi-step attack chains, leaving organizations with a dangerous blind spot.","**Immediate actions:**\n- Audit all GitHub Actions workflow files for use of untrusted `pull_request_target` triggers combined with code checkout from the fork.\n- Rotate any secrets, tokens, or cloud credentials that may have been exposed in CI\u002FCD pipeline environments.\n- Pin all GitHub Actions dependencies to a specific commit SHA rather than mutable tags to prevent dependency substitution attacks.\n\n**Long-term improvements:**\n- Enforce least-privilege permissions on all CI\u002FCD pipeline tokens, scoping them to only the minimum required repository and cloud permissions.\n- Establish a secure-by-default CI\u002FCD workflow template library and mandate its use across all internal and contributed projects.\n- Implement human review gates before any workflow changes are executed in privileged pipeline contexts, especially for external pull requests.\n\n**Detection measures:**\n- Deploy CI\u002FCD-specific security scanning tools (e.g., StepSecurity, Semgrep CI rules) that detect insecure workflow patterns beyond standard SAST coverage.\n- Enable detailed audit logging for all GitHub Actions workflow executions, token usage, and cloud API calls originating from pipeline runners.\n- Monitor for anomalous cloud credential usage or privilege escalation events that originate from CI\u002FCD service accounts.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-218 (SSDF) - Secure Software Development Framework","NIST SP 800-204D - Strategies for the Integration of Software Supply Chain Security","NIST AC-6: Least Privilege","NIST SA-15: Development Process, Standards, and Tools","SLSA Supply Chain Levels for Software Artifacts (Levels 2–3)","OpenSSF Scorecard - CI\u002FCD Best Practices","OWASP CI\u002FCD Security Top 10: CICD-SEC-4 (Poisoned Pipeline Execution)","OWASP CI\u002FCD Security Top 10: CICD-SEC-6 (Insufficient Credential Hygiene)",{},"published","2026-06-23T18:20:42.618638+00:00","2026-06-23T18:20:42.477+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fhackread.com\u002Fcordyceps-ci-cd-flaw-microsoft-google-apache-repos-hijack\u002F","cordyceps-ci-cd-flaw-exposes-microsoft-google-apache-repos-to-pipeline-hijacking-11a02c","‘Cordyceps’ CI\u002FCD Flaw Exposes Microsoft, Google, Apache Repos to Pipeline Hijacking",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[50],{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"5bc7e3c3-dee0-46ff-9ef7-05c7ec869ea4","2026-06-24","morning","ThreatNoir Morning Brief — June 24","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-06-24\u002Fthreatnoir-morning-brief-2026-06-24.mp3",[57,61,65],{"slug":58,"name":59,"problem":60},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":62,"name":63,"problem":64},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":66,"name":67,"problem":68},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]