The actions-cool/issues-helper and maintain-one-comment actions, compromised on 18 May 2026 in the Mini Shai-Hulud campaign, were re-enabled on 16 September with tags still pointing at malicious code, according to Socket. The lesson is blunt: in CI/CD, a mutable tag is a door left open.
On September 24, 2026, Aikido revealed that GitLab’s “Email work item to this project” addresses, generated with a long-lived token and accidentally published in READMEs, let an attacker open merge requests or push code as the token owner. Search your repositories for these addresses and reset the exposed tokens.
GitHub has tightened minimum-version enforcement for self-hosted runners: brownouts began September 14, and from September 25, 2026 any runner not updated within 30 days stops receiving jobs. The failure is silent — jobs sit in “Queued” with no error: audit your runners before the next window.
GitLab shipped versions 19.3.2, 19.2.6 and 19.1.8 on September 10, 2026 to fix eighteen flaws, including an unauthenticated arbitrary file read through the commits API and an insecure deserialization scored CVSS 9.9. Every exposed self-managed instance must be updated without delay, and protected CI/CD variable secrets need a review.
On September 3, 2026, GitHub shipped three GitHub Actions updates: a vulnerability-alerts permission for GITHUB_TOKEN, the job context for reusable workflows, and a runner deprecation API. Swap your broad scopes for the vulnerability-alerts permission and adopt job.workflow_ref in your reusable workflows.
After the tag-repositioning attacks that hit tj-actions and 23,000 repositories, GitHub is rolling out a security roadmap for Actions: dependency lockfiles, scoped secrets, and an egress firewall. Two measures are available today: SHA pinning and OIDC.
On July 16 2026 Docker Engine 29.6.2 fixed five BuildKit vulnerabilities, including CVE-2026-15793 which can execute commands on the host during a malicious Git checkout, and CVE-2026-17106 was fixed in 29.7.0. Pipelines that build from untrusted sources should update Engine, Buildx and BuildKit now.
From 1 October 2026, GitHub applies the same retention setting to checks, workflow runs and statuses that already governs artifacts and logs — 90 days by default instead of more than 400. Teams that rely on that history must review their setting and export what they want to keep.
In early August 2026, GitHub shipped a vulnerability-alerts: read permission that lets the CI token query Dependabot alerts without an over-privileged PAT. Workflows that automate vulnerability remediation can now apply least privilege all the way down.
On August 26, 2026, GitLab shipped a fix for CVE-2026-18252, a flaw in the Duo Claude AI agent that lets an authenticated developer execute arbitrary commands in a CI context through user-controlled configuration. The lesson goes beyond GitLab: an AI agent wired into CI is a new execution surface, and the configuration it consumes is now part of the security boundary.
Version 3.18 of the self-hosted Woodpecker CI platform ships a database migration that reworks log storage — a backup and a maintenance window are recommended before upgrading. It also tightens security: additional and matrix environment variables are no longer injected into plugins automatically.
Docker Sandboxes 0.39, released August 19, 2026, introduces declarative sandbox environments described in a versioned .sbxenv.yaml file and reproduced with sbx env run. Teams running AI agents in CI should adopt the format, but they should also lock down kit signing and MCP governance.
On August 11, 2026, CloudSEK put numbers on the LiteLLM compromise: 2,500 organizations and 434,000 CI/CD pipelines potentially exposed, through a compromised Trivy build that poisoned versions 1.82.7 and 1.82.8 on PyPI. The lesson for platform teams comes down to three decisions: pin, scope, and treat CI as an attack surface.
On August 5, 2026, Novee Security demonstrated at Black Hat USA that a GitHub issue opened by an account with no write access was enough to execute arbitrary code on the CI runners behind Claude Code, Gemini CLI, and OpenAI Codex repositories. If your CI/CD pipeline executes code from GitHub issues without sandboxing, treat this as a CVE with no patch — yet.
Docker promoted Buildx Bake to general availability with Docker Desktop 4.38, eliminating the last barrier to multi-platform builds for teams still juggling separate per-architecture scripts.
