MAJOR FIRMS EXPOSED TO SUPPLY CHAIN ATTACKS VIA NEW CLASS OF CI/CD ATTACK

Summary from the TLDR InfoSec newsletter

A new CI/CD attack that utilizes self-hosted GitHub runners to achieve arbitrary code execution has been reported. The default setup instructions for self-hosted GitHub runners features persistent runners and only requires approval for the attacker’s first request. Attackers can exploit the bug to poison images for major companies and even GitHub itself.