Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks

Cybersecurity researchers have identified a new type of vulnerability in CI/CD workflows that can be exploited to compromise open-source supply chains. This weakness, referred to as Cordyceps, enables attackers to take control of workflows. The issue poses a significant risk, potentially allowing attackers to gain full control of repositories. Dozens of major organizations, including Microsoft, Google, and Apache, are affected, with over 300 GitHub repositories exposed to supply-chain attacks.