Topic

CI/CD Security: news, advisories and analysis

4 articlesUpdated 22 Oct 2026

CyberSecureToday covers CI/CD Security across 4 articles published between 16 Sep 2026 and 22 Oct 2026. The coverage includes 4 vulnerability advisories. 3 advisories are rated critical or high severity, and 1 involves a flaw listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on CI/CD Security most often intersect with Remote Code Execution, DevSecOps and Command Injection, with Technology, Cloud & SaaS the most affected sector. The most recent story, “GitLab Patches Maximum-Severity CVSS 10.0 Unauthenticated RCE Flaw Spanning 12 Years of Releases”, was published 22 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaS
GitLab Patches Maximum-Severity CVSS 10.0 Unauthenticated RCE Flaw Spanning 12 Years of Releases
GitLab has released emergency security updates resolving CVE-2026-110264, a critical CVSS 10.0 integer overflow in the Onigmo regular expression compiler enabling unauthenticated RCE.
CST Editorial Desk22 Oct 202612 min read
ThreatsCloud & SaaSHigh
Microsoft Azure CLI Command Injection Vulnerability CVE-2026-83948 Exposes Cloud CI/CD Automation Runners
Microsoft patches important command injection flaw CVE-2026-83948 in Azure CLI, requiring customer updates to prevent remote code execution in CI/CD pipelines.
Aisha Noor22 Sep 202614 min read
ThreatsCloud & SaaSHigh
AWS Discloses Command Injection Flaw in projen Tooling Enabling CI/CD Runner Takeover
AWS resolves high-severity vulnerabilities CVE-2026-89066 and CVE-2026-89065 in projen software project synthesis tooling allowing arbitrary command execution on developer workstations and CI runners.
Daniel Okafor19 Sep 202610 min read
ThreatsCloud & SaaSCritical
JetBrains TeamCity Critical Deserialization Flaw Exploited in Active CI/CD Attacks
CISA orders federal agencies to patch CVE-2026-63077, an unauthenticated Java deserialization flaw enabling complete remote code execution on TeamCity CI/CD servers.
Priya Raman16 Sep 202610 min read

Latest coverage

GitLab Patches Maximum-Severity CVSS 10.0 Unauthenticated RCE Flaw Spanning 12 Years of Releases

Microsoft Azure CLI Command Injection Vulnerability CVE-2026-83948 Exposes Cloud CI/CD Automation Runners

AWS Discloses Command Injection Flaw in projen Tooling Enabling CI/CD Runner Takeover

JetBrains TeamCity Critical Deserialization Flaw Exploited in Active CI/CD Attacks