Cordyceps CI/CD Bugs Expose Build Pipelines

Researchers reported Cordyceps, a CI/CD workflow weakness that could let untrusted GitHub pull requests hijack privileged workflows in 300+ repositories, enabling credential theft or supply-chain compromise. Audit Actions permissions, secrets, and approval gates.