PANews June 25 news, SlowMist Chief Information Security Officer 23pds posted that researchers have exposed a high-risk CI/CD vulnerability called Cordyceps. The open-source repositories of top companies such as Microsoft, Google, Apache, and Cloudflare have all been confirmed vulnerable in tests. Attackers don’t need corporate accounts or any system permissions; by just registering a free GitHub account, submitting a malicious PR, and leaving a comment, they can forge approvals, steal server keys, push malicious code, and completely take over a company’s code repository.