From code commit to production takeover (Research)

NCC Group pentest case study: by compromising a developer's build dependency to deliver a Meterpreter shell, researchers accessed a pod holding an SSH key for a Jenkins master and escalated to write privileges and cluster admin, enabling takeover of production. The report illustrates the high-risk impact of CI/CD and supply-chain compromises in modern build environments.