Cordyceps: Unauthenticated CI/CD Flaw Lets Attackers Hijack 300+ GitHub Repos
Novee Security uncovered a systemic CI/CD vulnerability in GitHub Actions they call Cordyceps, permitting any unauthenticated user to inject code, steal credentials, and commandeer supply‑chain pipelines. Their scan of ~30k high‑impact repos flagged 654, with over 300 fully exploitable, affecting giants like Microsoft, Google, and Apache.