FortiBleed

'Cordyceps': Malicious Pull Requests Threaten CI/CD Workflows Security researchers at Novee have disclosed a widespread CI/CD vulnerability class dubbed "Cordyceps," named for the parasitic fungus known for hijacking its hosts. The weakness exploits overly permissive automated workflows triggered by pull requests, allowing any unauthenticated user — with nothing more than a free GitHub account — to execute attacker-controlled code, steal signing keys and access tokens, and potentially compromise software supply chains. From a scan of…