Novee Security published the Cordyceps research today, disclosing a systemic class of exploitable vulnerabilities across GitHub Actions workflows in major open-source repositories. The research is named after a parasitic fungus that takes control of its host, reflecting how the attack hijacks trusted build infrastructure to act on behalf of an attacker. The vulnerabilities are not a single CVE but a structural pattern: command injection into workflow shell steps, broken authentication logic in workflow triggers, artifact poisoning between workflow stages, and cross-workflow privilege escalation from low-trust triggers to high-trust credential contexts.

The core of Cordyceps is the treatment of GitHub Actions YAML as passive configuration rather than security-critical code. Workflows execute shell commands, authenticate to cloud providers, hold package signing keys, and publish releases to npm, PyPI, Docker Hub, and cloud marketplaces. When a workflow trigger such as pull_request_target or workflow_run processes untrusted external content without proper isolation, that content can traverse internal workflow trust boundaries and reach steps that operate with maintainer-level credentials.

Novee scanned approximately 30,000 high-impact repositories and confirmed more than 300 fully exploitable chains. Specific confirmed findings included Microsoft Azure Sentinel, where a PR comment could execute attacker code on Microsoft CI and steal a non-expiring GitHub App key with persistent write access to security content deployed to customer Sentinel workspaces; Google’s AI Agent Development Kit, where a crafted pull request granted full owner-level Google Cloud permissions; Apache Doris, with two zero-click attack paths through comments and forked PRs reaching credentials and write access; Cloudflare’s Workers SDK, where a crafted branch name triggered arbitrary command execution; and the Python Software Foundation’s Black code formatter, where a malicious PR could steal the project bot token and approve subsequent pull requests, creating a path to poisoning official Docker images. All named organizations confirmed and fixed the issues following Novee’s responsible disclosure.

Mandiant published a detailed technical blog post today documenting the exploitation chain they observed at a service provider beginning in late 2025 and continuing into early 2026. Mandiant credited itself with discovering CVE-2026-20245, having identified the vulnerability during the active investigation. The flaw exists in the command-line interface of Cisco Catalyst SD-WAN Manager, Controller, and Validator components, and it allows an authenticated attacker with local access to execute arbitrary commands as root by uploading a crafted file.

In the observed attacks, the threat actor first established unauthorized SD-WAN peering connections to the service provider’s SD-WAN Manager devices. Mandiant assessed this was likely accomplished by exploiting previously disclosed authentication bypass vulnerabilities CVE-2026-20127 or CVE-2026-20182, though the precise method in some cases remained unclear. With peering established, the attacker authenticated to the SD-WAN Manager web interface using the default vmanage-admin account and extracted configuration data for the entire SD-WAN fabric, including edge device configurations, controller settings, and SD-WAN deployment templates.

The attacker then exploited CVE-2026-20245 by uploading a malicious CSV file named evil_tenant.csv through the tenant-upload feature in the SD-WAN CLI. The payload first created backups of /etc/passwd and /etc/shadow, then created a new account named troot with full root-level shell privileges. After switching to the troot account and verifying root access, the attackers pushed unauthorized configuration changes to downstream edge devices managed by the SD-WAN controller. Before exiting, the attacker deleted all files created during the attack, restored modified system configurations, and executed a validation script to confirm no evidence remained. In a specific operational security step, the attacker changed the default admin account password during the attack window and then restored it to the original value before disconnecting, specifically to avoid triggering an alert to an administrator who might notice an unexpected password change.

CISA added three Ubiquiti UniFi OS vulnerabilities to its Known Exploited Vulnerabilities catalog on June 25, 2026, with a remediation deadline of June 26 under Binding Operational Directive 26-04. The three vulnerabilities affect UniFi OS on UniFi Dream Machine and Cloud Gateway hardware.

CVE-2026-34908 is an improper access control vulnerability. A malicious actor with network access could make unauthorized changes to the system by exploiting insufficient access validation on UniFi OS management interfaces. CVE-2026-34909 is a path traversal vulnerability allowing a network-adjacent attacker to access files on the underlying system that could be used to access an underlying account. CVE-2026-34910 is an improper input validation vulnerability that could allow a network-adjacent attacker to conduct command injection against the device. All three were addressed by Ubiquiti in Security Advisory Bulletin 064. None of the three require authentication for exploitation, though all require network access to the management interface.