Latest CI/CD security news

Two CVSS 10.0 flaws top the March 12 CVE digest, with Himmelblau's Azure Entra ID bypass letting attackers authenticate to any tenant and a Jellyfin GitHub Actions flaw enabling full repo takeover. 644 new CVEs in one day.

A poisoned Git tag turned a security vendor's own GitHub Action into a backdoor. The C2 implant in xygeni-action ran for seven days, giving attackers access to repo secrets on every workflow run. Same technique that hit tj-actions last year.