Critical CI/CD Vulnerability "Cordyceps" Exposes Supply Chain Risks in GitHub Workflows A newly identified vulnerability pattern, dubbed Cordyceps, reveals systemic flaws in GitHub Actions workflows that allow unauthenticated attackers to hijack software supply chains. Unlike a single bug, this issue stems from insecure workflow compositions combining command injection, broken authentication, and cross-workflow privilege escalation creating multi-step exploit chains accessible from free GitHub accounts. Security firm Novee scanned 30,000 high-impact repositories, identifying 654 instances of the vulnerability and validating over 300 fully exploitable chains. Major organizations, including Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation, confirmed fixes after disclosures. The flaw’s scale suggests millions of repositories could be affected. At its core, Cordyceps exploits the misclassification of GitHub Actions YAML files as "configuration" rather than code. Despite executing shell commands, managing tokens, and publishing releases, these workflows often bypass the security scrutiny applied to application code. This oversight enables seemingly harmless steps like outputs or environment variables to carry untrusted data into high-privilege workflows, leading to credential theft, artifact poisoning, or malicious releases. Novee’s research uncovered high-impact examples: - Microsoft’s Azure Sentinel: A pull request comment executed attacker code, stealing a non-expiring GitHub App key with persistent write access to customer deployments. - Google’s AI Agent Development Kit: A single PR triggered CI code with owner-level Google Cloud permissions. - Apache Doris: Two zero-click attack paths exfiltrated CI credentials and tokens with broad repository write access. - Cloudflare’s Workers SDK: PR branch names could execute arbitrary commands on CI runners. - Python’s Black project: A malicious PR ran on build systems, hijacked automation tokens, and approved pull requests as the project bot, risking tainted releases for millions of users. Traditional security tools fail to detect Cordyceps because they analyze workflows in isolation, missing cross-workflow attack paths. Novee’s approach combined large-scale scanning with AI-driven validation to simulate end-to-end exploits. The vulnerability is exacerbated by modern development practices, where AI-generated CI/CD templates propagate insecure patterns rapidly across projects. Mitigation requires treating workflows as code enforcing least privilege, sanitizing inputs, isolating untrusted workflows, and testing for malicious PRs. The findings underscore that supply chain security now hinges on CI/CD rigor, demanding the same scrutiny as application code.

High-Severity Memory Corruption Flaw Discovered in Python’s asyncio on Windows A critical security vulnerability (CVE-2026-3298) was disclosed on April 21, 2026, affecting Python’s asyncio module on Windows systems. The flaw, identified by Python security developer Seth Larson, enables out-of-bounds (OOB) memory writes in the `sock_recvfrom_into()` method of `asyncio.ProactorEventLoop`, a Windows-specific event loop for asynchronous I/O operations. The issue stems from a missing boundary check when the optional nbytes parameter is used. If network data exceeds the pre-allocated buffer size, Python fails to enforce limits, allowing excess data to overwrite adjacent memory. This can lead to memory corruption, application crashes, or under specific conditions arbitrary code execution. The vulnerability is exclusive to Windows, as other platforms (Linux, macOS, Unix) use the unaffected `SelectorEventLoop` backend. Systems at risk include Windows-hosted Python web servers, API backends, and applications using UDP socket operations or variable-length network data in fixed-size buffers. Given the widespread use of `ProactorEventLoop` as the default event loop since Python 3.8, the flaw impacts a broad range of modern Python deployments on Windows. The Python security team classified it as high severity, citing the potential for exploitation in memory corruption attacks. A patch (GitHub PR #148809) has been submitted, introducing the missing boundary check to prevent buffer overflows. Users are advised to monitor the official CVE record for patched version details and apply updates promptly. Until then, avoiding `sock_recvfrom_into()` with nbytes in untrusted environments is recommended.

GlassWorm Malware Campaign Exploits Stolen GitHub Tokens to Infect Python Repositories Security researchers at StepSecurity have uncovered an active malware campaign, dubbed GlassWorm, which is leveraging stolen GitHub tokens to inject malicious code into a wide range of Python repositories. The attack targets core project files including setup.py, main.py, and app.py across multiple Python ecosystems, such as Django applications, machine learning research code, Streamlit dashboards, and packages on the Python Package Index (PyPI). The campaign employs obfuscation techniques to evade detection, making it difficult for developers and security teams to identify compromised code. Once executed, the injected payload can enable remote access, facilitate data exfiltration, or further propagate the infection within connected networks and systems. Given Python’s widespread use in web development, data analytics, and scientific research, the attack poses significant risks to the integrity and security of applications built on these repositories. The primary entry point stolen GitHub tokens highlights the growing threat of supply chain attacks, where attackers exploit weak authentication controls to compromise trusted codebases. StepSecurity has confirmed the campaign’s ongoing activity, emphasizing the need for heightened vigilance in token management and code review processes to mitigate further exposure.

Critical Authentication Bypass Flaw in Python.org API Patched After Decade-Long Exposure A severe authentication bypass vulnerability in Python.org’s release management API, present since 2014, was disclosed and patched in February 2026. The flaw, reported by Splitline Ng of the DEVCORE Research Team on February 23, could have allowed attackers to impersonate administrators by supplying an admin username with an arbitrary API key, granting full administrative privileges. If exploited, the vulnerability would have enabled threat actors to alter Python release metadata, including download URLs and verification materials (Sigstore signatures and PGP keys) on python.org/downloads. While attackers could not directly modify release binaries, tampering with verification links could have facilitated large-scale supply chain attacks targeting Python users and downstream distributors globally. The Python Security Response Team (PSRT) confirmed the flaw on a local instance and deployed a patch (python/pythondotorg#2946) within 48 hours, with DEVCORE verifying the fix by February 24. Post-incident forensics, including log audits and artifact signature verification across Python versions 2.5 to 3.13, found no evidence of exploitation. Additional security measures were implemented to mitigate future risks: - URL validation: Restricted to `https://www.python.org/` to prevent malicious redirects. - HTTPS enforcement: Trail of Bits’ audit introduced a custom validator for HTTPS-only URLs in newer releases. - Negative auth test cases: Expanded test coverage for authentication failures. - Extended log retention: Increased from 3 to 30 days for improved auditing. A third-party audit by Trail of Bits, funded by OpenAI and completed on June 1, confirmed no further authentication or authorization issues. Earlier LLM-assisted audits in April also returned no additional vulnerabilities.

The Python Software Foundation (PyPI) was targeted in the GhostAction supply chain attack in early September 2023. Threat actors exploited malicious GitHub Actions workflows (e.g., FastUUID) to exfiltrate PyPI API tokens and other secrets (including npm, DockerHub, GitHub, Cloudflare, AWS, and database credentials) from over 570 repositories. While 3,300+ secrets were stolen across multiple ecosystems (Python, Rust, npm, JavaScript, Go), PyPI confirmed no evidence of token abuse to publish malware or compromise repositories. The attack leveraged stored GitHub secrets in workflows, sending them to attacker-controlled servers. Response delays occurred due to a spam-filtered alert from GitGuardian, postponing mitigation until September 10th. PyPI invalidated all affected tokens, urged maintainers to adopt short-lived Trusted Publishers tokens, and advised security reviews. Though no direct data breach or financial loss occurred, the incident exposed supply chain vulnerabilities, risking potential future exploits if unmitigated. The attack mirrored prior campaigns like s1ngularity (August 2023), highlighting persistent risks in open-source ecosystems.