Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking

A new class of CI/CD vulnerabilities called Cordyceps has been discovered in GitHub Actions YAML configurations that allows unauthenticated attackers to hijack repositories and steal credentials. The flaws exploit workflow composition logic rather than individual components, bypassing traditional scanners and affecting millions of open-source repos from Microsoft, Google, and Apache. Attackers can achieve command injection, artifact poisoning, and full repository control.