tag: Ci-Cd · 22 items
- Engineer — Act: CVSS 10.0 RCE via crafted CI regex with a public PoC and a confirmed exploitation attempt against a live GitLab server; patch your GitLab instance to the latest fixed release immediately and audit CI configuration pipelines for unexpected regex patterns.
- SOC/IR — Act: An exploitation attempt against Alpine Linux’s GitLab server confirms active targeting; sweep GitLab server access and CI pipeline execution logs for anomalous regex patterns in CI configs since roughly October 21 and tune detections for RCE attempts via GitLab’s CI parsing endpoint.
- Leader — Plan: A CVSS 10.0 GitLab RCE with a public PoC and active exploitation attempts poses supply-chain risk if your engineering teams self-host GitLab; confirm with engineering that all instances are patched this week and assess whether any CI/CD outputs or secrets could have been exposed.
- Signals: CVE-2026-97229 — CISA KEV: not listed, EPSS 0.18, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Active campaign directly targeting CI/CD pipelines: stolen tokens plant workflows that echo secrets to Actions logs, then delete the runs. Immediately audit GitHub Actions logs for unexpected workflow runs, rotate all repository and org-level secrets, and tighten token scopes to least privilege.
- SOC/IR — Act: The delete-run-after-exfiltration pattern is a concrete hunt target in GitHub audit logs. Search for workflow run creation followed by rapid deletion, and sweep for tokens with unusual write-workflow permissions used outside normal pipelines since the campaign began.
- Leader — Plan: Active exfiltration campaign targeting private GitHub and GitHub Enterprise repos is worth a this-week check-in: confirm with engineering that no unauthorized workflow runs exist in your org and that secret rotation is scheduled if any anomalies are found.
- Engineer — Plan: GitLab CE/EE is a common CI/CD platform in enterprise environments; update to the patched release immediately — no public PoC or active exploitation is confirmed yet, but unauthenticated RCE via CI/CD regex warrants treating your patch window as days, not weeks.
- SOC/IR — Skip
- Leader — Learn: A maximum-severity unauthenticated RCE in a widely deployed CI/CD platform is worth tracking — if exploitation emerges at scale, this could escalate to a board-level supply-chain risk; confirm your engineering team has patched and monitor for exploitation news.
- Engineer — Act: If you maintain npm packages using trusted publishing, audit version history for any unauthorized releases pushed during the vulnerable window, and verify all pending trusted publishing configurations are validated or removed before the 48-hour expiry kicks in.
- SOC/IR — Plan: No confirmed exploitation or published IOCs, but this is worth building a detection: create coverage for unexpected npm package version bumps in your CI/CD pipelines and dependency scanning alerts tied to packages your org consumes or publishes.
- Leader — Plan: Over 1,500 packages were exposed to potential hijacking without credential theft — a notable supply chain risk; this quarter, confirm whether your teams publish npm packages via trusted publishing and assess whether your SCA tooling would catch a malicious version injection.
- Engineer — Plan: GitLab instances running CI/CD are in scope; the RCE in the regex compiler engine is CVSS max, but no KEV listing, PoC, or active exploitation is reported yet. Identify your GitLab version and schedule patching to the fixed release within your critical-patch SLA — don’t wait for routine cycle given the CI/CD blast radius.
- SOC/IR — Skip
- Leader — Plan: Confirm whether self-managed GitLab is in your environment and verify engineering has it in the patching queue; a compromised CI/CD pipeline is a supply-chain event that could trigger customer disclosure obligations, so track remediation ETA this week.
- Engineer — Plan: Public PoC exists for this RCE but EPSS is 0.02 and no KEV listing — patch GitHub Enterprise to the latest release this sprint before exploitation interest picks up; GitHub.com is already patched by GitHub.
- SOC/IR — Plan: Public PoC lowers the bar for opportunistic exploitation; build or tune detections for anomalous GitHub API calls and unexpected Actions runner behavior as an exploitation precursor before active campaign activity emerges.
- Leader — Learn: RCE in a widely-used developer platform is worth noting for the risk register, but no active exploitation and a very low EPSS score mean this does not yet warrant leadership escalation or customer communication.
- Signals: CVE-2026-3854 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Plan: This tool addresses a real supply-chain vector where committed dist/ in a pinned Action can diverge from source — a technique used in past compromises like tj-actions. Evaluate and integrate into your repo audit process this quarter to verify Actions you pin haven’t had tampered dist artifacts.
- SOC/IR — Learn: Provides useful framing for the dist-vs-source discrepancy attack surface in GitHub Actions supply-chain attacks, but no IOCs, active campaigns, or detection rules are surfaced by this tool release itself.
- Leader — Skip
- Engineer — Plan: Supply-chain tampering via committed dist files in GitHub Actions is a real attack vector; evaluate and integrate action-dist-verify into your CI pipeline to catch dist/source divergence in pinned Actions this quarter.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: This tool rebuilds pinned JavaScript Actions from source and diffs the committed dist, addressing the tampered-dist supply-chain vector seen in real incidents. Worth evaluating for inclusion in CI pipelines that pin third-party Actions.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: GitLab AI Gateway RCE is vendor-rated critical and affects a widely deployed DevOps component, but no KEV, public PoC, or active exploitation is confirmed. Schedule patching to the latest fixed GitLab version this sprint and verify AI Gateway is not exposed to untrusted networks until patched.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Any pipeline that used actions-cool/issues-helper or actions-cool/maintain-one-comment during the recent reactivation window may have executed malware; audit CI/CD build logs for those action references and treat affected workflow runs as potentially compromised.
- SOC/IR — Act: Hunt across pipeline/SIEM logs for workflow runs invoking actions-cool/issues-helper or actions-cool/maintain-one-comment since last week’s reactivation; flag any execution and initiate IR review of affected build environments.
- Leader — Plan: This recurrence of the Mini Shai-Hulud campaign illustrates the risk of unpinned third-party Actions; use it to drive a policy requiring SHA-pinning and inventory approval for all third-party GitHub Actions across engineering teams this quarter.
- Engineer — Act: Active supply-chain compromise in CI/CD is a direct Act trigger — audit every pipeline that references these affected Actions, check recent build logs for signs of malicious payload execution, and rotate any secrets or tokens exposed to those workflow runs.
- SOC/IR — Plan: No IOCs are published in this item, but the Mini Shai-Hulud campaign name suggests threat-intel feeds may carry indicators — check those feeds and build a detection for anomalous GitHub Actions workflow executions or unexpected secret-access events in your CI/CD telemetry.
- Leader — Plan: A named supply-chain campaign actively re-compromising CI/CD Actions warrants asking your engineering team this quarter to confirm pipeline dependency exposure and report back on whether any credential material was at risk.
- Engineer — Plan: If your team uses GitLab’s email-to-issue feature, those per-project addresses are live credentials — audit whether any have appeared in screenshots, bug reports, logs, or Slack, and rotate them via GitLab profile settings; also evaluate whether to disable the feature organization-wide if it isn’t actively used.
- SOC/IR — Learn: No exploitation evidence or IOCs, but this expands the CI/CD abuse surface worth knowing for future hunts — an attacker who obtains one of these addresses could trigger pipeline jobs without touching a keyboard in a way most SIEM rules wouldn’t catch.
- Leader — Skip
- Engineer — Plan: The worm now targets 469 credential paths spanning CI/CD configs, cloud credentials, and AI tool configs — audit your pipelines and developer environments to ensure secrets aren’t stored in predictable locations, and validate that secret managers (not flat files) are used across those categories.
- SOC/IR — Plan: The expanded path list represents a concrete, mappable set of credential-access TTPs worth building detections for — develop or tune rules that alert on bulk file-read activity across CI/CD config directories and cloud credential paths on developer endpoints and build runners.
- Leader — Learn: The systematic expansion of this worm’s credential-harvesting scope illustrates growing attacker focus on developer and pipeline infrastructure; useful context for evaluating secrets-management maturity, but no immediate leadership action is indicated without breach signals.
- Engineer — Learn: Reinforces the case for auditing CI/CD pipeline permissions, pinning action versions, and reviewing third-party developer tool integrations — no specific CVE or active exploit to act on now.
- SOC/IR — Learn: Useful framing for expanding hunt coverage into build pipeline logs and developer tooling telemetry, but no IOCs or specific TTPs are surfaced in this piece.
- Leader — Skip
- Engineer — Plan: This is a textbook workflow injection pattern — untrusted input from issue metadata flowing into shell steps. Audit your own repos under .github/workflows/ for any workflow triggered by issue/PR events that interpolates github.event.issue.title or body into run: commands, and replace with intermediate env vars or safe contexts.
- SOC/IR — Learn: No IOCs or active exploitation are reported, so there is nothing to hunt or detect today; however, understanding that crafted GitHub issues can trigger arbitrary commands in CI pipelines is useful context for evaluating future CI/CD-targeted campaigns.
- Leader — Skip
- Engineer — Act: If your team runs Claude Code or Gemini CLI in CI pipelines under vendor-default configuration, an unprivileged GitHub issue can reach your runner and exfiltrate CI secrets — audit all AI agent CI integrations now, restrict what secrets are scoped to those runners, and disable issue-triggered agent workflows until hardened configurations are documented.
- SOC/IR — Plan: This Black Hat presentation defines a new TTP category — prompt injection via issue trackers targeting AI coding-agent CI workflows — worth building detections for; plan to monitor for anomalous CI runner invocations originating from issue events and unexpected secret-access patterns in pipeline logs.
- Leader — Plan: Default configurations of AI coding agents from major vendors expose CI secrets to anyone who can open a GitHub issue — assess whether engineering teams have deployed these tools in CI/CD pipelines this quarter and establish an approval policy for AI agent access to production secrets before adoption widens.
- Engineer — Act: A self-propagating npm worm targeting GitHub Actions runner secrets is a direct threat to any CI/CD pipeline using npm packages; audit your runner logs for unexpected outbound calls to Ethereum RPC endpoints and review recently installed or updated npm dependencies for malicious scripts.
- SOC/IR — Plan: The blockchain-based C2 technique (Ethereum smart contracts for routing) is a novel evasion method worth building detections for; develop hunt queries for unusual npm postinstall script execution and outbound connections to Ethereum JSON-RPC endpoints from CI runners.
- Leader — Learn: This campaign illustrates how supply chain attacks are adopting decentralized infrastructure to evade takedowns — relevant context for board-level discussions on software supply chain risk and CI/CD security investment.
- Engineer — Act: A public PoC on GitHub combined with a CVSS 9.8 unauthenticated RCE makes exploitation imminent — patch all on-premises TeamCity instances to 2025.11.7 or 2026.1.3 immediately; Cloud instances are already remediated.
- SOC/IR — Act: With a public PoC now available, begin hunting for unauthenticated requests to TeamCity build/run endpoints and review build agent logs for unexpected OS command execution patterns since the PoC publication date.
- Leader — Plan: Confirm whether your organization runs TeamCity On-Premises and verify the engineering team has prioritized emergency patching this week — a compromise of CI/CD pipelines carries supply-chain risk that could generate customer or board questions if exploitation is later confirmed.
- Signals: CVE-2026-63077 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Active supply-chain compromise of 10 Packagist packages tied to developer dinushchathurya (July 12–13); audit your PHP dependency tree for these packages, remove or pin away from any dev/pre-release versions, and inspect CI/CD build logs for unexpected executions since July 12.
- SOC/IR — Plan: No IOCs are surfaced in the summary, but the campaign’s use of malicious Packagist dev-version installs inside GitHub Actions runners is a detectable pattern — build a detection for unusual package-manager installs of dev/pre-release versions in pipeline logs and hunt for dinushchathurya package executions since July 12.
- Leader — Learn: This campaign illustrates how a single compromised developer account can turn a public package registry into attack infrastructure; useful context when reviewing third-party dependency risk in your software supply chain policy.
- Engineer — Learn: The updated analysis covers wormable malware patterns, CI/CD persistence techniques, and multi-stage npm attack chains — useful for hardening your pipeline and package vetting posture, but no specific package compromise or KEV signal requiring immediate action today.
- SOC/IR — Learn: The breakdown of npm attack TTPs (worm propagation, CI/CD persistence) helps tune detection logic for build pipeline anomalies, but no concrete IOCs or active campaign indicators are surfaced in this item.
- Leader — Skip
- Engineer — Act: Confirmed supply chain compromise of AsyncAPI npm packages with import-time malware execution — audit all projects for AsyncAPI dependencies, check CI/CD build logs for the affected package versions, and rotate any secrets accessible from compromised build environments.
- SOC/IR — Act: Active campaign with malware delivered at import time via npm means CI/CD runner telemetry is the primary hunt surface — sweep build system logs for suspicious outbound connections or process spawns during npm install/import phases since the compromise window, and tune EDR rules to flag unusual child processes from package managers.
- Leader — Act: A weaponized CI/CD supply chain attack of this type can expose credentials and intellectual property across every project that consumed the affected packages — confirm internally whether AsyncAPI packages are in use, request an exposure assessment from engineering, and prepare to brief leadership given the potential scope.