Cordyceps flaws let anyone with a free GitHub account hijack CI/CD pipelines at Microsoft, Google, and Apache

Security firm Novee has revealed Cordyceps as a class of exploitable CI/CD vulnerabilities across open-source repositories that allowed attackers to steal credentials, push malicious code, and compromise operations at some of the world’s largest software organizations. These vulnerabilities have been found across repositories belonging to Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation, which...