The article reports a large-scale supply chain attack dubbed Megalodon that infected over 5,500 GitHub repositories on May 18. The attack uses fake automated commits to inject malicious GitHub Actions workflows designed to steal credentials, CI secrets, keys, and tokens.

JetBrains has revealed a security incident involving its Cadence cloud development service after attackers gained access through an unpatched TeamCity server. The compromise exposed sensitive credentials, source code, and service information, causing concerns regarding the security of development environments connected to cloud computing resources.  During this incident, CVE-2026-63077, a critical TeamCity On-Premises vulnerability, was exploited by an unauthenticated attacker, allowing him to execute operating system commands on an affected server without any authentication.  A flaw disclosed by JetBrains on July 27 was exploited soon after by vulnerable TeamCity installations. In the case of Cadence, it was api.cadence.jetbrains.com, the infrastructure used to support JetBrains' cloud computing service for PyCharm, which was vulnerable.  A malicious attacker is believed to have begun attacking on August 8 JetBrains discovered the intrusion on August 23 and taken the affected server offline the following day, putting the confirmed incident window between August 8 and August 24. Cadence integrates with PyCharm through an optional plugin that provides access to cloud-based computing resources for development projects.  As TeamCity managed those workloads behind the service, the compromised system was part of a closely related environment involving software development and execution. JetBrains acknowledged that the server should have been patched immediately following the disclosure of the TeamCity vulnerability, but remained unpatched.  Following the discovery of the critical vulnerability in TeamCity, the company has previously advised organizations to update vulnerable TeamCity deployments. In addition, the breach became more significant because attackers obtained a complete backup of Cadence server data from 2024. In addition, JetBrains confirmed that several Amazon Web Services IAM users and their credentials were compromised, including those belonging to Cadence employees.  The backup may contain credentials, configuration data, artifacts, and logs. A compromised backup contained more than routine service data. It also contained configuration information and credentials associated with cloud and development resources. Researchers also discovered that JetBrains customers' own buckets were accessed through S3 buckets within JetBrains' Amazon Web Services environment.  The extent of customer access to these buckets is unknown. There were several aspects of the development infrastructure exposed, including access to AWS IAM accounts, source-control access, package and container registry credentials, API tokens, SSH and deployment keys, service accounts and signing credentials, among others.  In the event of valid credentials remaining after the compromise, such access could provide a path into connected systems. JetBrains has not identified a specific threat actor as responsible for the activity, and no custom malware has been identified. Instead of exploiting a TeamCity vulnerability, the attacker used legitimate credentials and cloud services to conduct the intrusion. This method can make it difficult to distinguish malicious activity from normal administrative activity. This incident demonstrates the security implications of continuous integration and continuous delivery.  Using TeamCity environments, you can access source repositories, build artifacts, deployment systems, package registries, and cloud resources. Thus, a compromise on this level can lead to credential theft, unauthorized changes, and software supply chain attacks beyond the affected server. According to JetBrains, access tokens for the Cadence plugin in PyCharm have been invalidated, and users are encouraged to revoke or rotate credentials and secrets that were potentially used during Cadence executions.  In addition, Cadence inputs and outputs derived from this period should be viewed as potentially untrusted. As a result of the TeamCity vulnerability, a CVSS score of 9.8 has been assigned to it; it affects on-premises installations not updated to the latest version. The JetBrains patch version 2025.11.7 and version 2026.1.3, along with a security patch plugin, are available for environments in which immediate upgrades are not possible.  After exploitation was observed in the wild, CISA added the flaw to its catalog of Known Exploited Vulnerabilities. JetBrains has begun to assess the impact of the Cadence breach and has prompted a broader review of the affected environment. Upon completing the investigation, the company will contact affected users if further information is discovered that requires action.  According to the company, the incident is limited to the data associated with the Cadence host identified. It illustrates how critical it is to keep the CI/CD infrastructure patched, particularly when development systems are connected to the cloud and sensitive credentials.

Snowflake’s public snowflakedb/snowflake-connector-net repository has been identified as vulnerable to GitHub Actions workflow injection. This vulnerability could be exploited to trigger command execution within CI/CD workflow through specially crafted GitHub issues. In this case, the flaw is attributed to the repository’s automatic workflow, jira_issue.yml, which runs automatically when a public issue is opened.  When processing issue data, the workflow exposed Jira credentials, including API tokens, to the affected job. Attacker-controlled issue titles and descriptions were also passed directly into a shell command, resulting in an avenue for command injection. The workflow was also triggered by an issue event, which was incorrectly referenced with github.event.pull_request.user.login as the event check reference.  In the absence of the referenced pull request property, this condition evaluated with an empty value, resulting in regular issues reaching the vulnerable job without any protection. The issue was not related to any released versions of the Snowflake Connector for .NET and affected the repository's CI/CD automation.  Using the Red Agent, Wiz researchers discovered the vulnerability on June 23 as part of a security research project conducted by Snowflake’s HackerOne vulnerability disclosure program. Five days prior, after pull request #1218 was merged, a security flaw had been introduced, and an unauthenticated user could activate it by using a specially crafted GitHub issue title.  The scan conducted by GitHub Advanced Security, which included Copilot Autofix, examined a revised version containing the vulnerable workflow, however, did not identify the injection. As a result of discovering the flaw, the Red Agent verified access to sensitive information within Snowflake’s internal Jira system. Code that has been compromised originated in a cleanup-related pull request that replaced a safer environment-variable and jq parsing approach with direct interpolation of the title of an issue into a shell script, which is the source of the vulnerable code.  GitHub's security tooling flagged other issues during the development process and Copilot suggested fixes, but neither identified the injection caused by the change. Ultimately, a human reviewer approved and merged the pull request. In June of 2026, when the workflow became active, any new issues could be accessed by the vulnerable code path.  Wiz’s Red Agent discovered the vulnerability five days later and successfully refined its exploit after an initial attempt to exploit it failed. As a result of the resulting payload, the researchers were able to access sensitive data within Snowflake’s internal Jira environment and obtain the Jira API token, enabling them to determine the potential impact of the vulnerability.  A number of questions are raised by the incident regarding automated security review and AI-assisted software development. Wiz pointed out that coding tools can inadvertently reintroduce unsafe shell practices, while security scanners fail to detect the injection that occurs. The case underscores the importance of thoroughly reviewing code changes involving GitHub Actions, particularly when workflows handle sensitive credentials or untrusted input.  Snowflake was informed of the vulnerability by Wiz through HackerOne on June 23, 2026, under report #3819931. Snowflake resolved the issue on June 24, 2026, by submitting pull request #1402, which replaced direct expansion of GitHub issue data with environment variables passed as arguments to jq. The Jira token was rotated on June 24.  The investigation conducted by Snowflake did not reveal any evidence of unauthorized access, and Wiz reported that no unrelated external use of the exposed token was observed during the five-day exposure period. There has been no release of the company's underlying audit logs. Furthermore, GitHub's commit history does not indicate that Copilot was the author of the changes to the jira_issue.yml file.  Despite the fact that Copilot Autofix appears to be a co-author of the squash merge, the unsafe refactoring was contained in a separate commit attributed to a Snowflake developer. Consequently, the available history confirms Copilot's participation in the pull request, but does not substantiate that the code was introduced by it.  This case demonstrates GitHub's warnings of workflow security risks in 2025, particularly when issue data is directly used in run blocks, which poses a security risk to workflows. As of August 17, 2026, no CVE, CVSS score, or CISA KEV listing had been identified for this vulnerability. The vulnerable code has since been removed from the master branch, and there is no evidence that it has been exploited outside of the master branch.

Block .env reads & malicious commands with a real-time MCP interceptor, safeguarding CI/CD pipelines

Software industry companies have emphasized development velocity as a competitive advantage for years, streamlining release cycles, automating deployments, and increasingly utilizing sprawling open-source ecosystems to accelerate innovation as a competitive advantage. However, a recent campaign orchestrated by TeamPCP has revealed the security debt underpinning that speed-first approach. Within a short period of time, the threat actor compromised more than 1,000 software packages and weaponized trusted development channels, showing the reliance on assumptions rather than verification that modern software supply chains have in place. The most recent escalation occurred following the public release of the Shai-Hulud worm's source code, a malicious tool previously used in numerous supply chain intrusions, along with operational guidance aimed at encouraging broader misuse.  Through open distribution of the malware and promotion of a reward-driven "supply chain challenge," TeamPCP has demonstrated its ability to shift the threat from a single adversary to a potentially broader ecosystem threat. There is a growing reality for software developers, enterprises, and security teams alike that this development emphasizes: the greatest vulnerability in modern software development is not necessarily a flaw in the code itself, but rather a trust placed in repository repositories, dependencies, and automated workflows.  A key component of TeamPCP's campaign is the ability to weaponize vulnerabilities already embedded within modern software development practices rather than developing new malware and previously unknown exploitation techniques. With organizations accelerating release cycles through automated continuous integration/continuous delivery pipelines and increasingly integrating artificial intelligence-driven coding assistants, trust decisions are making more frequently without meaningful human verification. The security research community notes that this environment has created a fertile ground for supply chain abuse, in which unvetted packages, compromised dependencies, and stolen publisher credentials are able to move through development workflows at unprecedented speed. TeamPCP demonstrates exactly how a single compromise within a trusted distribution channel can have an impact on thousands of downstream users through a single breach.  In the process of conducting the attacks, the group has highlighted a long-standing industry concern: although software packages are often thoroughly tested before deployment, identities, credentials, and publishing environments that distribute those packages are usually less scrutinized. It is believed that much of TeamPCP activity may be attributed to a small group of operators following threat intelligence investigations conducted by Palo Alto Networks and Google. These investigations have identified a central figure known online as "ResoluteXBF" with connections to South African-based infrastructure.  Even though the group was relatively new when it emerged in 2010, it has rapidly evolved from the Shai-Hulud campaign to subsequent operations that involved malware such as GlassWorm, as well as the public release of Shai-Hulud's source code, and even a high-profile GitHub breach that compromised Visual Studio Code to expose thousands of private repositories.  The security analysts cite these incidents as evidence that attackers have shifted their approach, making developers themselves primary targets and trusted software ecosystems the preferred method of intrusion. As a result, TeamPCP's significance is greater than its volume of compromises, but it also illustrates the fragility of trust relationships that continue to underpin large portions of open-source supply chains throughout the world.  Researchers gained a better understanding of TeamPCP's operations after digging deeper into the company's operations. Palo Alto Networks' threat intelligence assessments identified a central figure operating under the alias "ResoluteXBF," as well as associates known as "diencracked" and "Shinigami." However, numerous researchers remain of the opinion that the group is an essentially loosely connected operation with a relatively small core. There has been speculation that a successful law enforcement action against a few individuals or possibly even one key operator  could significantly disrupt the campaign based on this structure. Even so, the group's influence has surpassed its apparent size. TeamPCP has consistently been associated with underground communities and criminal affiliates linked to BreachForums, DragonForce, ShinyHunters, Vect, Lapsus$, and HasanBroker, thereby expanding its influence and reputation through these networks.  One notable instance occurred when the group advertised 4,000 private code repositories with a reported asking price of $95,000 on a dark web forum. Despite this, researchers contend the group is not solely concerned with financial gain. Based on the group's behavior, such as public feuds, open recruitment, reward-based challenges for supply-chain attacks, and deliberate release of offensive tooling, it is apparent that the campaign is centered on notoriety, disruption, and influence within cybercrime circles. It is clear from TeamPCP's own metrics that there is a significant disparity: even though the group has claimed more than 10,000 victims, and earned approximately $90,000 in extortion-related earnings, its reputation and operational damage have been disproportionately greater than its revenues.  TeamsPCP has been aggressively targeting open-source repositories and developer infrastructure in order to spread credential-stealing malware designed to harvest credentials, cloud credentials, and secrets associated with Kubernetes environments, Amazon Web Services, Microsoft Azure, Google Cloud, and other enterprise platforms. This impact is visible across the software ecosystem. Those organizations affected directly or indirectly by compromised packages include Checkmarx, Bitwarden, LiteLLM, Telnyx, Mercor AI, PyTorch Lightning, AntV, SAP, GitHub, TanStack, UiPath, Mistral AI, Microsoft DurableTask, Red Hat, and Nx Console, among others.  Researchers have estimated that malicious packages linked to TeamPCP represent nearly 500 million weekly downloads, showing how a compromise which affects only a few repositories can spread rapidly due to interconnected dependency chains.  The success of the group has largely been attributed to its understanding of modern development workflows rather than its malware sophistication. Through compromise of CI runners, TeamPCP effectively converted trusted software distribution channels into malware delivery channels by compromising automated systems that build, test, and publish software.  By automatically retrieving the infected updates from a repository, downstream developers were able to retrieve them using package managers, GitHub Actions, Python libraries, NPM registries, and other software components that were configured to pull the latest releases from the repository. Using the security best practices strategy, the group aims to exploit a fundamental characteristic of software development: rapid patching and continuous updates encourage rapid trust automation, resulting in an environment where trust is routinely automated on a large scale.  Researchers note that the group's operational tempo remains unusually aggressive. New package compromises occur almost every day, with validations, credential harvestings, and follow-on activities occurring shortly after initial access. The detection speed of defenders has increased, resulting in some malware packages being exposed within minutes, rather than several hours, as whereas TeamPCP has continued to adapt its techniques.  A variety of toolsets have been developed by it, ranging from JavaScript and Python-based payloads to Kubernetes API attacks, bundled software development kits, and custom credential theft mechanisms. Additionally, the group's objectives have grown as they have spread the use of Mini Shai-Hulud, a self-replicating malware strain that infected hundreds of open-source packages across multiple registries, and was then publicized to encourage imitations. These developments indicate that a scale-oriented operating model has taken precedence over precision as an operating model.  As an alternative to focusing on a select number of high-value targets, TeamPCP has adopted an approach aimed at maximizing downstream exposure, exploiting interconnected software dependencies, and generating disruption across as many environments as possible in order to maximize downstream exposure a formula that has made it one of the most consequential supply-chain threats facing the open-source community in recent years.  The TeamPCP campaign emphasizes that the most disruptive cyber threats do not always arise from sophisticated exploits or new malware. The most common causes of these attacks are vulnerabilities in trust mechanisms that maintain the rapid pace of software development.  By exploiting interconnected repositories, automated build systems, and dependency chains repeatedly, the threat actor has demonstrated how quickly a localized compromise can ripple across the entire digital landscape.  Software supply chains are becoming increasingly complex, and AI-driven development is accelerating code adoption, so organizations are under increasing pressure to strengthen publisher security, validate dependencies, protect development environments, and continuously monitor build pipelines. As a consequence of TeamPCP, the resilience of the software ecosystem will be dependent not only on securing code, but on verifying every link in the delivery chain.

When combined with cloud service providers' CLIs, CI/CD can pose a serious security threat. Here's why — and how to keep a lid on your sec...

Explore the GitHub Action supply chain attack, its impact, and mitigation strategies for CI/CD environments.

Explore strategies to secure GitHub Actions against supply chain attacks with pinning, allow-lists, and secret rotation.

Learn how to secure CI/CD pipelines against supply chain attacks with zero-trust models and verified actions.