10 real-world stories of how we’ve compromised CI/CD pipelines

NCC Group documents multiple CI/CD pipeline attack stories demonstrating how common misconfigurations and overly-permissive settings in Jenkins, GitLab, Kubernetes, and associated services (S3, Docker, AWS IAM) can lead to full environment compromise; each story outlines the attack path, impact (credential and secret exfiltration, host/container escapes, AWS/EKS admin access), and remediation recommendations to harden build pipelines and protect the software supply chain.