CISA says GitLab integer overflow CVE-2026-97229 is exploited
Fixes cover GitLab 19.2.8, 19.3.4, and 19.4.2; federal agencies face a November 1 deadline.
Stories per day · 30 days
5 RSS
Relatedgithub-actions2gitlab2rce2ai-coding1cisa1code-review1cve-2026-972291cvss-101devops1devsecops1jetbrains1kev1patch1pipeline-security1self-hosting1supply-chain1vendor-roundup1
15 stories, newest first · one card per story
Stories tagged #cicd
12 Best CI/CD Pipeline Security Tools Compared (2026): Features & Pricing
A 2026 comparison ranks native and dedicated tools for securing CI/CD pipelines.
AI-generated changes create review bottlenecks in software delivery
JetBrains finds most DevOps teams run CI/CD, while AI-generated changes slow code reviews.
GitLab Patches Max-Severity Vulnerability CVE-2026-97229
GitLab patched CVE-2026-97229, a CVSS 10.0 unauthenticated remote code execution flaw in CI/CD handling.
2
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
GhostAction compromised maintainer accounts to plant credential-stealing GitHub Actions workflows in tens of thousands of repositories.
12
GhostAction Supply Chain Campaign Uses Malicious GitHub Actions to Steal CI/CD Credentials
GhostAction hit 772 GitHub repositories with malicious Actions workflows that stole CI/CD secrets.
3
Hackers Abuse GitHub Actions to Steal SSH Keys, Cloud Credentials and Access Tokens
GhostAction abused GitHub Actions workflows to steal SSH keys and cloud credentials from public repositories.
8
Hackers Poison Trusted Software Updates to Steal Developer and Cloud Credentials
ReversingLabs traces S1ngularity, Shai-Hulud, and TeamPCP campaigns that poisoned npm updates to steal developer and cloud credentials.
1
Securing the Kubernetes Supply Chain: Introducing WizOS Helm Charts
Wiz releases hardened WizOS Helm charts after finding supply-chain risks in 61 popular chart repositories.
Attackers Target Developer Credentials to Expand Supply Chain Intrusions Beyond Source Code
Malicious npm packages, including Mini Shai-Hulud, steal developer and CI/CD cloud credentials during install.
2
Exposed GitLab project email addresses let attackers push code
Aikido warns published GitLab incoming-email tokens can let outsiders open merge requests and push code as the owner.
4
GitLab Email Feature Vulnerability Lets Attackers Push Code Into Private Repositories
Aikido says a leaked GitLab incoming-email token can push patches and trigger CI in victim projects.
1
TrustBOM: A Scalable Architecture for Confidentiality-Preserving SBOMs Across Organizations
TrustBOM lets vendors prove SBOMs lack specified vulnerabilities or licenses without revealing dependencies.
Jenkins Patches 20 Plugin Flaws Leading to RCE, XSS and Credential Theft
Jenkins patched 20 vulnerabilities across 13 plugins, including Groovy sandbox bypasses enabling remote code execution on CI/CD controllers.
3
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Malicious LiteLLM 1.82.7/1.82.8 PyPI releases tied to the Trivy TeamPCP campaign harvested cloud, SSH, and database credentials, potentially exposing 2,500+ organizations.
3