All news with #ci cd security tag

🛡️ Since October 8–9, 2026, a renewed GhostAction campaign compromised roughly 1,900 GitHub accounts and targeted over 30,000 repositories, attempting to extract thousands of CI/CD secrets. Security firm GitGuardian observed the activity and noted evolving payloads that scan git history for AWS keys, tokens, and AI API keys. GitHub began blocking the malicious workflows on October 9, limiting later waves.

🔒 This post describes using AWS Continuum for penetration testing as a post-deployment gate in CI/CD pipelines. It explains how Continuum scopes tests to the commit range of the deployed change, runs server-side in your AWS account, and can block promotion when validated exploitable findings meet a chosen severity threshold. The article outlines setup, OIDC authentication, policy scoping, provider-specific considerations, and rollout guidance.

🔒 GitLab has released patches addressing a maximum-severity vulnerability that could permit unauthenticated arbitrary code execution via a crafted regular expression in CI/CD configurations, due to insufficient validation. The flaw, tracked as CVE-2026-97229 and rated CVSS 10.0, affects multiple 19.2–19.4 releases and is remediated in 19.4.2, 19.3.5, and 19.2.8. The advisory also fixes three high-severity issues impacting XSS, improper authorization in downstream pipeline creation, and a permissive regex allowing cache poisoning and exposure of protected variables.

🛠️ AWS Continuum for Penetration Testing (formerly AWS Security Agent) now offers public preview CI/CD integration that makes penetration testing a deploy-time event. The service delivers findings—including severity, affected endpoints, and remediation guidance—directly in pipeline output while avoiding meaningful delays for non-security changes. Teams can paste an auto-generated pipeline snippet into existing workflows and complete setup in under five minutes, with application context bootstrapped automatically on first run.

🔒 Two GitHub Actions that were compromised in May 2026 and disabled by GitHub were re-enabled on September 16, 2026, restoring access to repositories containing unremediated malicious release tags. Socket researcher Karlo Zanki warned that workflows referencing the affected tags resumed downloading and executing the May 18 payload, which harvests CI/CD secrets and exfiltrates them. Developers are urged to pin to pre‑compromise SHAs, rotate secrets, audit workflow history, and remove or replace the affected actions.

🔒 This blog outlines practical guidance for protecting the software supply chain by hardening CI/CD pipelines, developer workstations, repositories, and artifact registries. It describes modern attacker techniques—compromising developer tools, IDE extensions, and pipeline tokens—and recommends concrete controls like EDR/UEM integration, fine‑grained short‑lived credentials, strict dependency pinning, sandboxed developer environments, and centralized artifact proxies. The post emphasizes defense‑in‑depth across five SDLC pillars with actionable steps for continuous verification, provenance, and automated policy enforcement.

📧 GitLab issues each user a persistent incoming-email address for filing work items; that address contains a token tied to the account and does not expire. Researchers at Aikido Security found the token is shared across a user's project addresses and allows anyone who holds the address to create issues, open merge requests by email, commit patches to branches (including main) and trigger CI/CD jobs that run as the account holder. GitLab currently does not verify the sender address, and incoming email bypasses IP allowlists and two-factor requirements.

🔒 Google Cloud announced two generally available Secure Source Manager (SSM) features to harden CI/CD pipelines: enhanced blocking of unauthorized access across version control, build, and deployment systems, and a new Code Owners system for granular per-file and per-branch approver controls. The Code Owners feature supports nested ownership, branch-specific governance, glob-style path rules, and independent approval sections, while Developer Connect and Private Network Integrations let SSM connect CI/CD and runtimes across private networks with VPC Service Controls and Private Service Connect.

🚨 GitLab disclosed CVE-2026-85706, a maximum-severity path traversal flaw in its repository commits API that can allow unauthenticated attackers to read arbitrary files with a single HTTP request. The bug affected Community and Enterprise editions and has been patched; GitLab urged self-hosted, public-facing instances to patch immediately or remove access. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, and threat intel already reports in-the-wild probes. Experts warn this poses broad risk because GitLab often links to build, deployment, and secret-bearing files.

🚀 Amazon Elastic Container Service (Amazon ECS) introduces Early Success Criteria for rolling service deployments, letting you declare a deployment successful once a configured healthy percent of tasks are running. This reduces wait time for deployments to complete, unblocks dependent CI/CD and operational workflows, and better supports constrained capacity workloads like GPU inference. You can configure behavior for source revision cleanup using BLOCKING or DEFERRED, and enable the feature across AWS Commercial and GovCloud regions via Console, CLI, SDKs, or IaC tools.

🤖 Amazon SageMaker Unified Studio CI/CD adds two open-source features: an AI agent skill to auto-generate deployment manifests and native notebook promotion across environments. The manifest skill inspects project resources, applies least-privilege IAM guidance, and substitutes environment variables to avoid hardcoded identifiers. Notebook promotion synchronizes notebooks in place, preserving run history, supports selective promotion and dry-run validation, and integrates with existing CI/CD commands. Both features are available in all Regions offering SageMaker Unified Studio.

🔍 Unit 42 details how supply chain attacks have escalated, shifting adversaries from finished applications to the developer tooling and CI/CD pipelines that build software. The report examines incidents like ChainDrop, Axios, and Shai-Hulud to show how malicious preinstall scripts, account hijacks, and memory scraping steal credentials and self-propagate. It argues that SBOMs alone are insufficient and recommends continuous visibility, execution controls, ephemeral CI servers, and short-lived credentials to stop autonomous malware.

🔧 The Amazon EKS Capability for Argo CD now accepts a standard argocd-cm ConfigMap in your cluster to enable custom configuration. This managed GitOps continuous delivery experience can be tuned to your team’s workflows, including custom health checks for Custom Resources, UI banner content, and resource watch/compare behavior. AWS applies settings configured the same way as upstream Argo CD, and built-in health checks for AWS Controllers for Kubernetes (ACK) and kro resources are included.

🛡️ Self‑propagating malware dubbed ChainDrop has compromised over 1,300 npm packages, collectively serving about 2 billion monthly downloads. The attacker gained access by compromising a maintainer’s GitHub account, pushed malicious code to main branches, and used legitimate GitHub Actions workflows to publish tainted releases with valid provenance. The payload uses a Bun runtime to execute an obfuscated infostealer that harvests developer and cloud credentials, then exfiltrates them to a public GitHub repository. Security vendors recommend treating affected workstations and CI/CD runners as compromised, rotating tokens, rebuilding from clean backups, and applying dependency allowlisting and provenance checks.

🛠️ Cloudflare introduces the CI SDK built on Workflows to run CI pipelines directly on its platform. The system ties Artifacts (versioned code storage) to Workflows so repository pushes can trigger CI jobs, with sandboxed steps, dependency caching, and parallel execution. Platforms can manage CI for many repos while allowing customers to run custom Workflows in the same namespace. The CI SDK supports self-healing agents, R2-backed caches, and improved observability in the Workflows dashboard.

🔒 Google Threat Intelligence Group and Mandiant outline recent trends in large-scale open source supply chain compromises observed in 2025–2026 and provide practical mitigation and hardening recommendations. The post highlights actor techniques such as repository compromise, malicious package injection, and abuse of CI/CD triggers, and emphasizes increased risk from AI-enabled workflows. It recommends inventories, SBOMs/ABOMs, SDLC threat modeling, active risk monitoring, and configuration controls to reduce exposure.

🛡️ In June 2026, Novee Security disclosed "Cordyceps," a CI/CD composition weakness across thousands of high-impact repositories that flagged 654 and confirmed 300+ exploitable cases. The issue stems from how GitHub Actions events like pull_request_target and workflow_run execute with elevated privileges and can be tricked into running attacker-controlled content. Each workflow file appears valid, so SAST/DAST tools miss the cross-file composition that enables command, code injection and cross-workflow privilege escalation. Vendors have patched, but the broader governance gap—exacerbated by AI-generated workflows—remains and requires stricter trust boundaries and provenance controls.

🚀 AWS CodePipeline is now available in Asia Pacific (New Zealand) Region (ap-southeast-6). CodePipeline is a continuous delivery service that models, visualizes, and automates release processes including build, test, and deployment. It integrates with AWS services like CodeBuild, CodeDeploy, and CloudFormation, and supports third-party tools such as GitHub. The service includes governance controls like manual approvals, IAM-based access, and artifact encryption to help enforce security and compliance.

🚀 Amazon Elastic Container Service (ECS) Express Mode now supports custom task definitions, enabling teams to reuse existing ECS configurations and CI/CD workflows while benefiting from Express Mode’s simplified deployment. This update brings advanced task-level options—like observability and security sidecars, custom health checks, ulimits, Linux runtime settings, and FireLens log routing—into Express Mode services. Available in all AWS Regions, you can add a custom task definition via the AWS Console, CLI, SDKs, or infrastructure-as-code tools to manage deployments either through task definition updates or Express Mode.

🚀 AWS announces CloudFormation and CDK express mode, cutting deployment time by up to 4x for developers and AI agents by marking stacks complete once resource configuration is applied, rather than waiting for extended stabilization. Express mode lets propagation and long-running stabilization continue asynchronously, preserves dependency ordering and failure handling within stacks, and disables rollback by default to speed iterative fix-and-retry workflows. It requires no template changes and can be enabled via CLI, SDKs, console, or cdk deploy --express. The feature is available in all Regions where CloudFormation is supported.