GitHub Actionsの構造的欠陥「Cordyceps」が公開、MicrosoftやGoogleも無料 ...

ペネトレーションテスト企業のNovee Securityは2026年6月23日、GitHub ActionsのCI/CDパイプラインに潜む構造的な脆弱性パターン「Cordyceps（コルディセプス）」に関する調査結果を公開した。この脆弱性を悪用すると ...
Cryptopolitan on MSN

Cordyceps flaws let anyone with a free GitHub account hijack CI/CD pipelines at Microsoft ...

Security firm Novee has revealed Cordyceps as a class of exploitable CI/CD vulnerabilities across open-source repositories ...
VentureBeat

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply ...

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee’s device gave attackers access to roughly 3,800 internal repositories at the Microsoft-owned code storage and ...
CSOonline

GitHub Actions attack renders even security-aware orgs vulnerable

Many open-source repositories contain privileged GitHub Actions workflows that execute untrusted code and can be triggered by attackers to expose credentials and access tokens, as MITRE and Splunk ...
技術評論社

GitHub Actionsグッドプラクティス11選

本記事のテーマはGitHub Actionsです。個人的に 「もっと早く知りたかった！」 と考えているグッドプラクティスを、厳選してお届けします。想定読者は次のとおりです。 普段GitHub Actionsを雰囲気で運用している人 GitHub Actionsをコピペや生成AIで乗り切っている ...
CSOonline

GhostAction campaign steals 3325 secrets in GitHub supply chain attack

GitGuardian has disclosed a new software supply chain attack campaign, dubbed GhostAction, that exfiltrated thousands of sensitive credentials before being detected and contained on September 5. The ...