ci-cd - DIESEC

GhostAction GitHub Actions Attack Steals Secrets

By Editorial Team | October 13, 2026

The GhostAction GitHub Actions attack is back: fake security-audit workflows now harvest secrets from whole git histories. Check your repos since August 31.

The GhostAction GitHub Actions attack is back, and its payload now reads a repository’s entire git history. Researchers report that attackers took over two well-known maintainer accounts on October 8 and pushed a workflow called “Security Audit” into 345 repositories within minutes. Rotating your current Actions secrets no longer settles the exposure, because the workflow…

GitLab Path Traversal Vulnerability: Patch Now

By Editorial Team | September 21, 2026

A critical GitLab path traversal vulnerability lets attackers read any file from self-managed servers with no login. Active exploitation confirmed.

A critical GitLab path traversal vulnerability, CVE-2026-85706 (CVSS 10.0), lets an unauthenticated attacker read any file off a self-managed GitLab server, including credentials, deploy keys, and CI/CD configuration. GitLab shipped a patch on September 10; CISA added the flaw to its Known Exploited Vulnerabilities catalog the next day, and BSI issued its own warning on…

JFrog Artifactory Authentication Bypass Exploited

By Editorial Team | September 3, 2026

A JFrog Artifactory authentication bypass is now under active exploitation: attackers are minting themselves unauthenticated administrator tokens on self-hosted Artifactory instances just days after JFrog disclosed the flaw. Tracked as CVE-2026-82329 (CVSS 9.8), the bug sits in Artifactory’s default, out-of-the-box configuration — no misconfiguration required, no credentials needed. What Happened JFrog disclosed the JFrog Artifactory…

GitLab GraphQL code injection vulnerability

By Editorial Team | August 27, 2026

A GitLab GraphQL code injection vulnerability is now under active exploitation, reproduced and attacked within minutes of GitLab’s August 17, 2026 disclosure of CVE-2026-19478. The unauthenticated flaw (CVSS 9.4) lets an attacker delete public projects, forge fake fix records, or lock out maintainers on any unpatched self-managed GitLab instance. GitLab.com and GitLab Dedicated were already…

TeamCity CVE-2026-63077 RCE: Unauthenticated CI/CD Takeover

By Editorial Team | August 10, 2026

TeamCity CVE-2026-63077 RCE lets an unauthenticated attacker send a single crafted request to a TeamCity On-Premises server and execute operating system commands — no login, no valid session, no user interaction. CISA added it to the Known Exploited Vulnerabilities catalog on August 5 with a three-day remediation deadline, and exploitation is now active in the…