buildConfirmed2 publishers GhostAction attackers used roughly 1,900 hijacked GitHub accounts to plant credential-stealing workflows in over 30,000 repos. No GitHub Actions flaw was involved, so defence means rotating exposed keys and reviewing who edits workflows.
Perspective Coverage
3 publishers
- Builder
- Builder 38%
- Operator
- Operator 52%
- Investor
- Investor 10%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence72
Rapid7 turns GitLab's CVSS 10.0 regex overflow into command execution on an official 19.4.1 image
Rapid7 built a working command-execution exploit for GitLab's CVSS 10.0 CI/CD regex overflow, CVE-2026-97229. Rapid7 says its route needs a malicious CI config pushed to a public project first, a prerequisite that conflicts with GitLab's PR:N rating.
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher GitLab's Dependency Firewall blocks bad packages before a CI job installs them
GitLab put Dependency Firewall into early access with policies for malicious status, severity, license and package age across six package managers. The check is meant to run while the CI job still holds its credentials, according to a dev.to write-up.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence55
GitLab patches CVE-2026-97229, an unauthenticated code execution flaw in its CI/CD regex compiler
GitLab patched CVE-2026-97229, an integer overflow in its CI/CD regex compiler that lets unauthenticated users run code on self-managed servers. Separately, Let's Encrypt's 64-day production certificates start February 10, 2027, so renewal automation needs a test run first.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence65
GitLab patches a CVSS 10.0 code-execution flaw across its 19.2, 19.3 and 19.4 lines
GitLab released critical patches 19.4.2, 19.3.5 and 19.2.8 on October 12 to fix a CVSS 10.0 code-execution flaw. Self-managed installations are told to upgrade immediately, while GitLab.com is already patched and Dedicated customers need do nothing.
Publishers:docs.gitlab.com
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence72
buildOne report1 publisher A pull_request_target trigger let any forked PR run code in DuckDuckGo's CI with secrets in reach
A HackerOne report says DuckDuckGo's semver-label.yml ran code from any forked pull request with secrets in its environment. Any team can search its own workflows for pull_request_target to find the same pattern.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+35
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher Rust's Miri fix leaves CI secrets sitting in GitHub Actions caches built before it
Rust's nightly of 22 September 2026 stops Miri copying environment variables into the target/ directories CI jobs cache. Caches saved earlier still hold any secret a Miri step saw, so teams have to delete them and rotate those credentials.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence55
Unit 42 finds supply-chain malware fetching its C2 addresses from blockchain smart contracts
Unit 42 says supply-chain attackers have moved command-and-control into blockchain smart contracts, so one transaction can re-point an entire botnet or worm. Defenders' useful choke points are now developer machines, CI runners and the chain lookup itself.
Reality
- Evidence55
- Adoption45
- Hype gap+15
- Incentives45
- Confidence55
buildOne report1 publisher Jenkins accounts for 1,538 of 1,739 build-chain hosts a September scan found on the open internet
ZoomEye queries on 22 September 2026 found 1,538 Jenkins, 169 Harbor and 32 SonarQube instances reachable from the internet. These tools hold deploy credentials by design, so every reachable instance is a possible route into production.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence55
buildOne report1 publisher A static denylist stopped one more prompt injection than no protection in a coding-agent study
Bouras, Dai and Mechtaev found a static denylist let 46 of 75 prompt injections execute in a coding agent, against 3 under preflight-scoped capabilities. A same-day Google report of malware stealing OIDC tokens from GitHub Actions runners puts the outer limit on an agent in the CI job's permissions.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
GitLab's September 10 patch release closes CVE-2026-85706, a CVSS 10.0 path confinement failure in the repository commits API. GitLab.com was already patched, so the exposure sits with self-managed servers.
Perspective Coverage
3 publishers
- Builder
- Builder 33%
- Operator
- Operator 62%
- Investor
- Investor 5%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+5
- Incentives30
- Confidence70
buildOne report1 publisher Go 1.27 executes a poisoned dependency at go test in a replay of npm's August 4 worm
Go 1.27 ran none of a poisoned module's code on go get, go build or go vet in a replay of npm's August 4 worm, but go test ran it with GITHUB_TOKEN in reach. Go teams still carry exposure through CI test runs, versions that stay cached for good, and bots that edit go.mod.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence55
Two actions-cool GitHub Actions hijacked on May 18 came back online on September 16, still serving the Mini Shai-Hulud stealer to tag-pinned workflows. Only workflows pinned to a pre-May 18 commit SHA escaped; the rest have CI secrets to rotate.
Perspective Coverage
3 publishers
- Builder
- Builder 43%
- Operator
- Operator 47%
- Investor
- Investor 10%
Reality
- Evidence60
- Adoption40
- Hype gap+15
- Incentives30
- Confidence65
buildOne report1 publisher Tag-pinned workflows re-ran Mini Shai-Hulud after issues-helper was re-enabled
Socket says workflows using issues-helper@v2.2.1 re-ran Mini Shai-Hulud after the Action was re-enabled on September 16 with its malicious tags intact. The earlier takedown only made those jobs fail, so the fix that holds is dropping the Action or pinning a verified commit SHA.
Reality
- Evidence55
- Adoption35
- Hype gap+10
- Incentives
- Not scored
- Confidence55
buildOne report1 publisher Poisoned vite.config.js turns git pull and npm run build into malware
Malware that steals a developer's Git credentials force-pushes a poisoned vite.config.js to every reachable branch, a dozen rewritten in a minute in one case. A routine git pull and build then runs it, and dependency scanners never see the change.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
Ransomnews says it found more than 50,000 exposed Stripe merchant secret keys and tested a sample. One live key to a customer list and a test charge took 17 hours.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence42
Unit 42 worked a ransomware intrusion where the operator handed tactical execution to frontier AI agents, and the chain from a public API endpoint to stolen cloud AI keys closed inside a single working day with no zero-day.
Reality
- Evidence50
- Adoption20
- Hype gap+25
- Incentives60
- Confidence55
buildOne report1 publisher Attackers rode the Trivy compromise into Checkmarx's GitHub and out through its VS Code extensions
Mandiant's findings say the intrusion never reached Checkmarx One or production AWS, and that answers the vendor's question rather than the one a customer has about what a build box pulled in late March.
Publishers:checkmarx.com
Reality
- Evidence38
- Adoption
- Not scored
- Hype gap+25
- Incentives65
- Confidence45
buildConfirmed3 publishers The fix ships in 19.3.2, 19.2.6 and 19.1.8, and scanning for the flaw started the day after disclosure. Whether you can tell if a read succeeded on your instance depends on whether your proxy logs request bodies.
Publishers:dev.to · docs.gitlab.com · watchtowr.com Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 73%
- Investor
- Investor 5%
Reality
- Evidence80
- Adoption
- Not scored
- Hype gap+15
- Incentives45
- Confidence74
CISA said Sept. 23 that ransomware crews are exploiting CVE-2026-63077, an unauthenticated 9.8 RCE in JetBrains TeamCity patched July 25. Any build server patched late has to be handled as breached, including the credentials and signing keys it held.
Reality
- Evidence70
- Adoption75
- Hype gap+15
- Incentives35
- Confidence72