#CI/CD
All CosmicBytez Labs articles tagged #CI/CD, across news, security advisories, how-to guides, and projects.
- HOWTO
Container Image Signing and Verification with Cosign and Sigstore
Sign your container images with Cosign's keyless Sigstore workflow, verify signatures before deploy, and enforce the policy in Kubernetes so unsigned images never run.
- Security
CVE-2026-108259: TinaCMS CLI Code Injection via Unescaped Git Branch Name
TinaCMS CLI interpolates raw git branch names into generated JS, letting a crafted branch inject code during CI/CD builds.
- Project
Container Supply Chain Security: SBOMs and Keyless Signing with Syft, Grype, and Cosign
Build a CI pipeline that generates SBOMs with Syft, scans them for vulnerabilities with Grype, and signs container images keylessly with Cosign — closing...
- HOWTO
Detecting Leaked Secrets in Git Repos with Gitleaks
Stop shipping API keys, tokens, and passwords to GitHub. Learn how to scan git history, enforce pre-commit hooks, and integrate Gitleaks into your CI/CD...
- Security
CVE-2026-11325: Cloudflare pages-action GitHub Actions RCE
High-severity RCE in cloudflare/pages-action exposes CI/CD credentials. Migrate to wrangler-action before Sept 18, 2026 sunset.
- Security
CVE-2026-63077: JetBrains TeamCity Deserialization RCE Added to CISA KEV
JetBrains TeamCity contains a critical deserialization of untrusted data vulnerability allowing unauthenticated remote code execution via the agent...
- Security
CVE-2026-44359: Meshtastic CI/CD Workflow Exposes Repository Secrets (CVSS 10.0)
A critical GitHub Actions misconfiguration in the Meshtastic open-source mesh networking project allows attacker-controlled fork code to execute with...
- News
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
Novee Security researchers have identified a critical exploitable CI/CD workflow pattern dubbed Cordyceps that enables attackers to hijack GitHub Actions...
- News
Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking
Security researchers have disclosed a class of exploitable flaws in CI/CD pipeline configurations that allow unauthenticated attackers to take full...
- News
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
GitHub released actions/checkout v7 on June 18, 2026, adding default protections that refuse to fetch fork PR code inside pull_request_target workflows —...
- Newsletter
June 23 Digest: FortiBleed, Klue/Salesforce Supply Chain, Squidbleed, GitHub Actions Fix
A Russian IAB harvests 110M credentials from FortiGate firewalls; the Icarus group drains hundreds of Salesforce orgs via Klue OAuth tokens; a 29-year-old...
- News
Megalodon GitHub Attack Targets 5,561 Repos with Malicious
Cybersecurity researchers have uncovered Megalodon, an automated attack campaign that pushed 5,718 malicious commits to over 5,500 GitHub repositories in...
- News
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials
Threat actors have compromised the widely-used actions-cool/issues-helper GitHub Action, redirecting every existing tag to a malicious imposter commit...
- Security
CVE-2026-25244 — WebdriverIO Command Injection RCE via Git
A command injection vulnerability in WebdriverIO below version 9.24.0 allows remote code execution through malicious git branch names containing shell...
- News
Living Off the Pipeline: Defending Against CI/CD Subversion
Adversaries are increasingly weaponizing CI/CD pipelines as a living-off-the-land vector — abusing trusted build infrastructure to execute attacks without...
- News
Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft
A new supply chain attack campaign dubbed BufferZoneCorp has been observed using sleeper packages in RubyGems and Go module registries to push...
- News
Google Fixes CVSS 10 Gemini CLI RCE and Cursor Flaws Enable
Google has patched a maximum severity vulnerability in its Gemini CLI npm package and GitHub Actions workflow that allowed unprivileged attackers to...
- News
Trivy Supply Chain Attack Targets CI/CD Secrets
The open-source Trivy security scanner was weaponized by threat actor TeamPCP in a supply chain attack that hijacked 75 release tags to deploy an...
- News
Trivy Security Scanner GitHub Actions Breached — 75 Tags
Trivy, Aqua Security's widely used open-source vulnerability scanner, was compromised a second time in a month. Attackers hijacked 75 GitHub Actions tags...
- Security
CVE-2026-25534: Spinnaker SSRF via URL Validation Bypass
A critical SSRF vulnerability (CVSS 9.1) in Spinnaker's clouddriver and orca components bypasses the previous CVE-2025-61916 URL validation patch through...
- News
UNC6426 Weaponizes Old nx npm Compromise to Seize AWS Admin Access
Threat actor UNC6426 leveraged stolen credentials from last year's nx npm supply chain attack to achieve full AWS administrator access at a victim...
- Project
Claude Code for IT Operations: Building a Multi-Project
Transform Claude Code from a chatbot into a DevOps co-pilot. Set up CLAUDE.md templates, custom hooks, reusable agents, deployment skills, and MCP server...
- Checklist
Application Deployment Security Checklist
Pre-deployment checklist for launching new applications into production — security review gates, monitoring setup, rollback procedures, dependency...
- HOWTO
How to Secure GitHub Actions Workflows with OIDC, SHA
Harden your CI/CD pipeline by replacing long-lived secrets with OIDC short-lived tokens, pinning third-party actions to commit SHAs, enforcing...
- Project
CI/CD Pipeline with GitHub Actions and Azure
Build a secure CI/CD pipeline with GitHub Actions deploying to Azure. Covers build, test, security scanning (SAST/DAST), and deployment with OIDC...