‘Cordyceps’ CI/CD Flaw Exposes Microsoft, Google, Apache Repos to Pipeline Hijacking

A security research firm, Novee, disclosed 'Cordyceps' — a class of CI/CD/GitHub Actions workflow vulnerabilities enabling anonymous actors to inject commands, poison artifacts, and escalate privileges across build pipelines. The flaw was validated in hundreds of repositories and in scenarios affecting Microsoft Azure Sentinel, Google Cloud projects, Cloudflare, Apache, and widely used Python tooling; findings were responsibly disclosed and fixes applied.