CuraSec

tag: Cicd-Security · 2 items

Act archived CISA: Ransomware gangs now exploiting critical TeamCity flaw
2026-09-24 · BleepingComputer · source ↗ #ransomware#teamcity#cicd-security
  • Engineer — Act: TeamCity is core CI/CD infrastructure; active ransomware exploitation means immediate patching to the July release is overdue — also audit build logs and pipeline configurations for signs of unauthorized access or tampered artifacts.
  • SOC/IR — Act: With ransomware actors actively leveraging this, hunt for unusual authentication events, anomalous build triggers, or lateral movement originating from TeamCity hosts; a compromised CI/CD server is an assume-breach scenario for the entire build pipeline.
  • Leader — Act: Ransomware exploitation of CI/CD infrastructure carries supply-chain and disclosure risk — confirm whether TeamCity is run internally or by key software vendors, and brief leadership before a downstream incident surfaces the question.
Act archived GitLab CVE-2026-19478 Code Injection Actively Exploited Days After Disclosure
2026-08-21 · The Hacker News · source ↗ #gitlab#code-injection#cicd-security
  • Engineer — Act: GitLab is a core CI/CD asset in most engineering environments; this unauthenticated code-injection flaw (CVSS 9.4) with a public PoC is already being weaponized. Patch all self-hosted GitLab instances to the vendor’s fixed version immediately and audit recently modified public projects for unexpected data rewrites.
  • SOC/IR — Act: Active exploitation of a GitLab code-injection flaw means assume-compromise posture for any internet-exposed self-hosted instance: hunt GitLab audit logs for unauthenticated modification or deletion events against public projects since the disclosure date, and alert engineering if anomalies are found.
  • Leader — Plan: A critically-rated, actively exploited flaw in a widely-used CI/CD platform carries supply-chain risk if projects were tampered with before patching; confirm with engineering that all GitLab deployments are patched this week and assess whether any customer-facing build artifacts could have been affected.
  • Signals: CVE-2026-19478 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub