Cybersecurity articles tagged #CI CD Security on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/npm-supply-chain-attacks-shai-hulud-miasma-and-ci-cd-compromiseshttps://runtimerebel.com/blog/npm-supply-chain-attacks-shai-hulud-miasma-and-ci-cd-compromisesThe npm ecosystem faces escalating supply chain attacks like Shai-Hulud and Miasma RAT, leading to credential theft and widespread package compromise.Sat, 08 Aug 2026 16:26:28 GMTNPMSupply Chain AttackShai HuludTeamPCPCI CD Securityhttps://runtimerebel.com/blog/cve-2026-63077-jetbrains-teamcity-unauthenticated-rce-mitigation-guidehttps://runtimerebel.com/blog/cve-2026-63077-jetbrains-teamcity-unauthenticated-rce-mitigation-guideJetBrains has disclosed a critical RCE vulnerability (CVE-2026-63077) in TeamCity On-Premises. Learn how to patch your CI/CD environment and detect exploit attempts.Tue, 28 Jul 2026 10:36:59 GMTCVE-2026-63077JetBrainsTeamCityRCECI CD Securityhttps://runtimerebel.com/blog/github-actions-attack-patterns-evade-ci-security-scannershttps://runtimerebel.com/blog/github-actions-attack-patterns-evade-ci-security-scannersLearn how sophisticated GitHub Actions attack patterns bypass traditional CI security scanners, exposing CI/CD pipelines to supply chain risks.Tue, 07 Jul 2026 14:38:51 GMTGitHub ActionsCI CD SecuritySupply Chain SecuritySecurity ScanningCode Integrityhttps://runtimerebel.com/blog/cordyceps-defending-against-malicious-pull-requests-in-ci-cdhttps://runtimerebel.com/blog/cordyceps-defending-against-malicious-pull-requests-in-ci-cdThe Cordyceps campaign highlights critical CI/CD vulnerabilities in GitHub Actions, targeting high-profile projects like Apache Doris and Cloudflare Workers SDK.Wed, 24 Jun 2026 09:23:01 GMTGitHub ActionsCI CD SecuritySupply Chain AttackDevSecOpsCordycepshttps://runtimerebel.com/blog/novo-nordisk-breach-securing-secrets-in-github-development-pipelineshttps://runtimerebel.com/blog/novo-nordisk-breach-securing-secrets-in-github-development-pipelinesAnalysis of the Novo Nordisk GitHub token leak and why secrets management must transition from static tools to identity-based security frameworks.Fri, 19 Jun 2026 09:48:31 GMTGitHubSecrets ManagementNovo NordiskDevSecOpsCI CD Securityhttps://runtimerebel.com/blog/anthropic-claude-code-github-action-flaw-enables-repo-hijackinghttps://runtimerebel.com/blog/anthropic-claude-code-github-action-flaw-enables-repo-hijackingA critical flaw in Anthropic's Claude Code GitHub Action allowed attackers to hijack public repositories using malicious issues, posing supply chain risks.Thu, 04 Jun 2026 17:08:52 GMTAnthropicClaude CodeGitHub ActionsCI CD SecurityRyotaKhttps://runtimerebel.com/blog/megalodon-campaign-5561-github-repos-hit-by-malicious-workflowshttps://runtimerebel.com/blog/megalodon-campaign-5561-github-repos-hit-by-malicious-workflowsAutomated Megalodon attack pushes 5,718 malicious commits to GitHub repositories to exfiltrate secrets via GitHub Actions workflows.Fri, 22 May 2026 12:58:34 GMTMegalodonGitHub ActionsCI CD SecuritySupply Chain Attackhttps://runtimerebel.com/blog/developer-workstations-the-new-front-in-software-supply-chain-attackshttps://runtimerebel.com/blog/developer-workstations-the-new-front-in-software-supply-chain-attacksA surge in attacks targeting npm, PyPI, and Docker Hub highlights a shift toward stealing developer credentials and API keys from workstations and CI/CD pipelines.Mon, 18 May 2026 13:23:15 GMTNPMPyPIDocker HubCI CD SecurityCredential TheftDeveloper Securityhttps://runtimerebel.com/blog/checkmarx-jenkins-ast-plugin-compromised-in-teampcp-attackhttps://runtimerebel.com/blog/checkmarx-jenkins-ast-plugin-compromised-in-teampcp-attackTeamPCP compromised the Checkmarx Jenkins AST plugin on the Jenkins Marketplace. Defenders must revert to version 2.0.13 to secure CI/CD pipelines.Mon, 11 May 2026 20:39:30 GMTCheckmarxJenkinsTeamPCPSupply Chain AttackCI CD Securityhttps://runtimerebel.com/blog/defending-ci-cd-pipelines-with-build-application-firewallshttps://runtimerebel.com/blog/defending-ci-cd-pipelines-with-build-application-firewallsExamine how Build Application Firewalls (BAF) provide runtime protection for software pipelines to mitigate sophisticated supply chain attacks and data theft.Mon, 11 May 2026 17:01:45 GMTBAFCI CD SecuritySupply Chain AttackBuild Time ProtectionPipeline Securityhttps://runtimerebel.com/blog/gemini-cli-critical-rce-fix-patching-the-google-gemini-cli-flawhttps://runtimerebel.com/blog/gemini-cli-critical-rce-fix-patching-the-google-gemini-cli-flawGoogle patches a CVSS 10.0 flaw in Gemini CLI tools that allowed unprivileged attackers to execute commands in CI/CD environments via malicious configurations.Thu, 30 Apr 2026 08:52:38 GMTGoogle Gemini CLIGitHub ActionsGoogle GeminiCI CD SecurityRCEhttps://runtimerebel.com/blog/ci-cd-pipeline-backdoors-analyzing-recent-supply-chain-attackshttps://runtimerebel.com/blog/ci-cd-pipeline-backdoors-analyzing-recent-supply-chain-attacksExploration of supply chain risks in CI/CD pipelines, IoT device exploitation trends, and the security implications of government data acquisition.Mon, 23 Mar 2026 16:24:41 GMTCI CD SecuritySupply Chain AttackIot SecurityPipeline Backdoorhttps://runtimerebel.com/blog/trivy-supply-chain-attack-teampcp-pushes-infostealer-via-githubhttps://runtimerebel.com/blog/trivy-supply-chain-attack-teampcp-pushes-infostealer-via-githubThreat actor TeamPCP compromised the Trivy-action repository to distribute infostealer malware through GitHub Actions, targeting CI/CD pipelines and secrets.Sat, 21 Mar 2026 20:08:15 GMTTrivy ScannerGitHub ActionsTeamPCPInfostealerCI CD Securityhttps://runtimerebel.com/blog/sandworm-mode-malicious-npm-cluster-automates-secret-harvesting-and-crypto-thefthttps://runtimerebel.com/blog/sandworm-mode-malicious-npm-cluster-automates-secret-harvesting-and-crypto-theftSecurity researchers have identified a coordinated campaign involving 19 malicious npm packages designed to exfiltrate CI/CD secrets, API tokens, and private…Mon, 23 Feb 2026 12:20:23 GMTNPMSupply Chain AttackCredential HarvestingCI CD SecurityJavaScript