Loading story…
A researcher disclosed a time-of-check-time-of-use (TOCTOU) flaw in Google Cloud Build’s GitHub pull-request comment-control workflow. An untrusted PR author could wait for a maintainer to approve execution with /gcbrun, quickly push a malicious commit, and have Cloud Build run that newer, unreviewed revision with the pipeline’s available secrets and IAM privileges. Google fixed the issue in June 2025 and awarded a $30,000 bug bounty.
The flaw is a form of Poisoned Pipeline Execution (PPE): attacker-controlled source changes cause a trusted CI/CD pipeline to execute malicious commands, enabling theft of CI credentials, lateral movement from build infrastructure, or delivery of trojanized artifacts. Google’s remediation binds builds to an adequately aged commit and requires an explicit full commit SHA when newer commits exist; organizations should also isolate unreviewed PR builds, protect CI configuration and trigger branches, require review before privileged pipeline execution, and limit repository and CI credential permissions.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Google marked the issue fixed by requiring a commit to be visible to Cloud Build for at least five seconds before it can be triggered by comment control. When a newer commit exists after the prior check, maintainers must provide the full commit SHA to trigger a run.
Google awarded the researcher a $30,000 bug bounty for the Cloud Build TOCTOU vulnerability.
Google acknowledged the reported Cloud Build comment-control race condition.
A researcher reported that Cloud Build's GitHub `/gcbrun` comment-control flow could execute a newer, unreviewed pull-request commit rather than the commit a maintainer intended to approve. The proof of concept replaced `cloudbuild.yaml` and caused Cloud Build to contact a Burp Collaborator domain; exploitation could expose build-accessible secrets or IAM privileges.
The researcher attempted a sub-second race using webhook timestamp granularity and an attempt to forge a past Git commit timestamp. Both bypass attempts failed, including because Cloud Build tied each run to a pending check.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at Novee disclosed **Cordyceps**, a class of systemic software supply chain flaws in GitHub Actions workflows that can let attackers hijack build and release pipelines through insecure trust-boundary crossings in CI/CD YAML configurations. The attack chains combine issues such as command injection, broken authentication logic, artifact poisoning, and privilege escalation across multiple workflows rather than a single misconfiguration. Novee said exploitation may require only a pull request or even a pull request comment from a free GitHub account, allowing low-privilege or unauthenticated attackers to execute malicious code, steal credentials, and potentially gain control of code repositories and connected cloud environments. After scanning roughly **30,000** high-impact repositories, Novee flagged **654** projects and verified more than **300** as fully exploitable. Confirmed impact included repositories tied to **Microsoft, Google, Apache, Cloudflare,** and the **Python Software Foundation**, with examples including Azure Sentinel, Google `adk-samples`, Apache Doris, Black, and Cloudflare Workers tooling. The researchers said affected organizations have fixed the disclosed issues, but warned that AI coding agents are helping spread the same insecure CI/CD patterns across ecosystems including **npm, PyPI, crates,** and **Go**.
Jul 12, 2026
A critical misconfiguration in GitHub’s public `actions/runner-images` repository allowed pull requests from fork contributors to execute on persistent, non-ephemeral self-hosted runners between February and July 2023. A researcher bypassed contributor-status controls, achieved arbitrary code execution on `azure-builds` and `macos-vmware` infrastructure, and demonstrated persistence by leaving processes running after workflow jobs completed. Persistent access could have exposed secrets used by legitimate runner-image builds, including a write-capable `GITHUB_TOKEN`, vCenter credentials, and Azure build-process credentials. An attacker could plausibly have altered GitHub-hosted runner-image build code, tampered with image-generation infrastructure, moved laterally into GitHub or Azure build engineering environments, or pivoted into GitHub’s macOS private cloud. GitHub triaged the disclosure in July 2023, applied repository mitigations, resolved it as a critical misconfiguration in November, and awarded the researcher a $20,000 bounty; organizations using public repositories with self-hosted runners should require approval for all external contributors and use isolated, ephemeral runners.
Sep 3, 2026
Aikido Security researchers have identified a new vulnerability class, dubbed **PromptPwnd**, that affects automated CI/CD pipelines such as GitHub Actions and GitLab CI/CD when integrated with AI agents like Gemini CLI, Claude Code, OpenAI Codex, and GitHub AI Inference. The vulnerability arises from prompt injection attacks, where untrusted user input—such as bug report titles—can be embedded into AI prompts, causing the AI agent to execute privileged actions, leak secrets, or manipulate workflows. This attack chain has been confirmed as practical and reproducible, with at least five Fortune 500 companies exposed, including a notable case involving Google’s Gemini CLI repository, which was patched within four days of responsible disclosure. Aikido Security has open-sourced Opengrep rules to help organizations detect this vulnerability in their codebases and recommends several mitigation steps: restricting the toolset available to AI agents, avoiding the injection of untrusted input into prompts, treating AI output as untrusted, and limiting the blast radius of leaked tokens. This is the first confirmed real-world demonstration that AI prompt injection can compromise CI/CD pipelines, highlighting the growing risks of integrating AI automation into software supply chains. The discovery follows recent attacks like Shai-Hulud 2.0, underscoring the urgent need for robust security controls in environments leveraging AI-driven automation.
Sep 3, 2026