Zuckerpunch - Abusing Self Hosted GitHub Runners at Facebook
Hide commits in a GitHub PR.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
PR sneaking github.com
Methods of sneaking malicious code into GitHub pull requests.
-
Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests securitylab.github.com
Combining pull_request_target workflow trigger with an explicit checkout of an untrusted PR may lead to repository compromise.
-
One Supply Chain Attack to Rule Them All – Poisoning GitHub's Runner Images adnanthekhan.com
A critical vulnerability in GitHub Actions, involving a misconfigured self-hosted runner in the actions/runner-images repository, allowed potential compromise of all GitHub and Azure hosted runner images.
-
Remove evidence of malicious pull requests on GitHub x.com
Changing account's email to block-listed domain, automatically bans the account.
-
Bypassing required reviews using GitHub Actions medium.com
GitHub Actions can bypass required reviews, allowing malicious code pushes to protected branches.
-
Hacking GitHub AWS integrations again dagrz.com
Attacking misconfigured pipelines that use OIDC.
CI/CD Attacks › Techniques > Defense Evasion: “Hide commits in a GitHub PR.”