Novee Security disclosed “Cordyceps” on June 24 — not a single CVE but a systemic class of exploitable CI/CD weaknesses across the open-source supply chain. Scanning roughly 30,000 high-impact repositories, Novee validated hundreds of full exploit chains and confirmed fixes at Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation; a single scan flagged 654 repositories, more than 300 of them confirmed fully exploitable to attacker-controlled code execution or credential theft.
The danger lives in composition: an untrusted pull request triggers a low-privilege GitHub Actions workflow whose output feeds a high-privilege one whose token authenticates to the cloud with owner-level roles — a trust boundary no one audited.
Novee’s pointed warning is that agentic coding agents reproduce these patterns persistently and at scale, effectively “infecting” repositories exponentially. It’s the delegated-trust problem moving up the stack, into the pipeline that builds the software itself.
Sources: Novee Security, Dark Reading, The Hacker News, SecurityWeek
Cyberattacks & Breaches
Cisco Unified CM SSRF (CVE-2026-20230) now actively exploited to root. Attackers are exploiting a CVSS 8.6 server-side request forgery flaw in Cisco Unified Communications Manager and Session Management Edition, patched June 3, to drop webshells and reach remote code execution. The observed chain: a WebDialer SSRF with file:// payloads writes files, stands up a rogue Apache Axis service, drops a first-stage JSP file-writer, then a second-stage command shell. Cisco rates real-world impact as Critical because exploitation can elevate to root; automated sweeps over the Tor network were seen on honeypots from a single source IP, and WebDialer must be enabled to be exploitable.
So what: This story restates a familiar through-line one layer down. The Cisco bug is a patch-gap failure: the fix shipped June 3 and exploitation is landing now, exactly the window a live, tagged inventory of internet-reachable infrastructure is meant to close. Cordyceps, below, is a delegated-trust failure inside the build pipeline. Both are invisible without visibility across the estate, and both get worse as autonomous agents act inside the systems.
Amadey and StealC infrastructure seized in coordinated takedown. A law-enforcement operation involving Microsoft, Bitdefender, Bitsight, and ESET dismantled criminal infrastructure behind the Amadey and StealC malware-as-a-service families and identified or restricted crypto assets valued at more than $47 million.
So what: This story restates a familiar through-line one layer down: delegated trust, whether in an appliance or in commodity malware infrastructure, is invisible without visibility across the estate.
Vulnerabilities & Exposure
“Cordyceps” CI/CD supply-chain flaw class. Any unauthenticated user with a free account could forge approvals, push code, or steal credentials in vulnerable GitHub Actions compositions. Of 654 flagged repositories, more than 300 were confirmed fully exploitable, with fixes confirmed at Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation.
So what: This story restates a familiar through-line one layer down. Cordyceps is a delegated-trust failure inside the build pipeline, invisible without visibility across the estate, and it gets worse as autonomous coding agents act inside these same systems.
AI Impact on Security
Agentic coding is now a vulnerability-propagation vector, not just a productivity story. The sharpest line in the Cordyceps research is operational: because AI coding agents replicate workflow patterns across repositories, an insecure CI/CD composition isn’t a one-off — it’s a template that gets reproduced at machine speed.
So what: This is the inverse of agentic-SOC optimism: the same agentic leverage that accelerates defense also accelerates the spread of latent flaws on the build side. The defensible posture is governance and visibility at the trust boundaries — what a workflow, token, or agent is allowed to reach and do — not faith in the agent.
Regulatory & Policy
CIRCIA reporting-rule timeline back in focus. CISA’s CIRCIA rulemaking — its final rule having slipped from October 2025 into 2026, with revised town-hall scheduling noted in the Federal Register on May 26 — would require covered critical-infrastructure entities to report a covered incident within 72 hours and any ransomware payment within 24 hours.
So what: Seventy-two-hour incident reporting and 24-hour ransom-payment disclosure both presume an organization can detect and scope an incident fast. That’s only possible with continuous visibility already in place, not built after the fact.