CRITICALSupply Chain
Global

Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks

·Source: The Hacker News

Updated:

Executive Summary

Cybersecurity researchers have flagged a new class of CI/CD workflow weakness that allows attackers to hijack workflows and compromise open-source supply chains. The "critical exploitable pattern" has been codenamed Cordyceps by Novee Security. The issue can allow full attacker control of repositories at dozens of the largest organizations worldwide, including Microsoft, Google, Apache, and

Analysis

Cybersecurity researchers have flagged a new class of CI/CD workflow weakness that allows attackers to hijack workflows and compromise open-source supply chains. The "critical exploitable pattern" has been codenamed Cordyceps by Novee Security. The issue can allow full attacker control of repositories at dozens of the largest organizations worldwide, including Microsoft, Google, Apache, and
Source Attribution

Originally published by The Hacker News on Jun 24, 2026.

Related Threats

MEDIUMSupply ChainNEW

Aikido Buys Root for $70M to Automate Open-Source Patching

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/aikido-buys-root-for-70m-to-automate-open-source-patching-image_small-9-a-32118.jpg" align=right hspace=4><b>Deal Adds Hardened Packages, Automated CVE Fixes to Application Security Platform</b><br>Belgian software vendor Aikido Security acquired Boston-based Root for $70 million to embed automated vulnerability remediation into i

Bank Info Security
LOWSupply Chain

Malicious PyPI packages give hackers control of Telegram bot servers

A campaign active since last November has been targeting Python developers building Telegram bots with trojanized Pyrogram forks that allow attackers to read arbitrary files on compromised servers. [...]

BleepingComputer
MEDIUMSupply Chain

Decades-Old Bash Tricks Expose AI Coding Agents to Supply Chain Attacks

Decades-old Bash shell tricks can bypass safeguards in most open source AI coding agents, potentially turning malicious repositories into supply chain attack vectors. The post Decades-Old Bash Tricks Expose AI Coding Agents to Supply Chain Attacks appeared first on SecurityWeek .

SecurityWeek