AWS Console Supply Chain Breach Enables GitHub Repository Hijacking 

Wiz Research disclosed “CodeBreach,” a critical vulnerability in AWS CodeBuild webhook filters where an unanchored regex allowed attacker-controlled GitHub accounts containing a maintainer ID substring to bypass ACTOR_ID restrictions; researchers automated bot account creation, captured a trusted maintainer substring, triggered builds to exfiltrate aws-sdk-js automation credentials (full admin), and demonstrated how malicious code could be injected into the AWS JavaScript SDK — potentially affecting roughly two-thirds of cloud environments. AWS has implemented global hardening (including a Pull Request Comment Approval build gate) and the report urges immediate configuration fixes, least-privilege tokens, and proper regex anchoring to prevent similar CI/CD supply-chain compromises.