A simple CodeBuild flaw put every AWS environment at risk – and pwned 'the central nervous system of the cloud'

Wiz researchers disclosed a critical CodeBuild misconfiguration (CodeBreach) in AWS where unanchored regex ACTOR_ID filters allowed an attacker to bypass pull-request restrictions, create bot accounts that matched maintainer IDs, and gain admin access to AWS GitHub repositories (including the JS SDK). They demonstrated credential exfiltration and the potential to inject malicious code into widely used SDKs—an impact that could have affected millions of applications and the AWS Console—while AWS fixed the flaw and reported no evidence of exploitation in customer environments.