Topic
Every article tagged CI/CD Security, newest first.
Related topics
actions-cool/issues-helper and maintain-one-comment were re-enabled Sept 16 with malicious tags intact, re-exposing ~15K repos. Learn SHA-pinning fix.
A practical guide to replacing GCP service-account keys with Workload Identity Federation across GitHub Actions, GitLab, AWS, and Azure.
Leaked service account keys are a top cloud security risk. This definitive developer's guide explains how to go keyless with GCP's Workload Identity Federation.
Explore the evolution of supply chain attacks in 2026. Discover how the Miasma worm bypasses SLSA Level 3, targets AI coding agents, and fuels the Developer Credential Economy.
GitHub actions/checkout v7 now blocks pwn request attacks by default. Learn how the pull_request_target exploit worked, what changes, and what supply chain gaps remain.
Prevent the Megalodon supply chain attack. Learn how threat actors injected 5,718 malicious GitHub Actions workflows to steal OIDC tokens and cloud credentials.
Master the OWASP Top 10 CI/CD Security Risks. Concrete attacks, code examples, and battle-tested controls to harden your pipelines against supply chain threats.
The software supply chain is under relentless attack from campaigns like TeamPCP and the Axios hack. Learn actionable, step-by-step strategies to secure your CI/CD pipelines and developer endpoints.
TeamPCP strikes again. The popular Python package litellm (versions 1.82.7 and 1.82.8) was compromised on PyPI, deploying a credential harvester and Kubernetes backdoor.
Aqua Security's Trivy was compromised a second time on March 19, 2026, by "TeamPCP." Learn how malicious v0.69.4 and GitHub Actions were used to steal CI/CD secrets, how to detect the breach, and immediate remediation steps.