#CI/CD Security
All CosmicBytez Labs articles tagged #CI/CD Security, across news, security advisories, how-to guides, and projects.
- News
GitHub Actions Re-Enabled With Mini Shai-Hulud Payload Still Active
Socket found actions-cool's GitHub Actions ran live Mini Shai-Hulud malware for roughly 9 days after a no-cleanup restore, exposing ~15,000 repos.
- News
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Two actions-cool GitHub Actions, compromised in May 2026, silently reactivated their credential-stealing payload after repos were restored uncleaned.
- Security
CVE-2026-55158: Conflibot Command Injection via Pull Request Branch Name
Conflibot before 1.2.1 interpolates attacker-controlled PR branch names into shell commands, enabling RCE with repo secrets and a write-scoped GitHub token.
- News
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
JetBrains confirms its Cadence cloud service was breached via an unpatched, KEV-listed TeamCity RCE, exposing AWS IAM credentials and a 2024 server backup.
- Security
CVE-2026-44246: nnU-Net Agentic Workflow Injection via GitHub Actions Issue Triage
A high-severity agentic workflow injection vulnerability in nnU-Net's GitHub Actions issue triage workflow allows attackers to inject and execute...
- News
Build Application Firewalls Aim to Stop the Next Supply
A new class of security tooling called Build Application Firewalls inspects runtime behavior inside software build pipelines rather than just scanning...