A fungus that hijacks its host’s body to spread. That’s the name security researchers gave the CI/CD flaw class where an unauthenticated stranger seeds your pipeline and lets your own automation do the infecting. June 2026’s brief: Cordyceps, a Cisco zero-day with anti-forensics, a 27-million-credential takedown, and adversaries that weaponize at machine speed.
Quick Answer
Four stories define June 2026: the “Cordyceps” CI/CD pattern (Novee Security) lets any free GitHub account hijack workflows, forge approvals, and steal secrets — 300+ of ~30,000 scanned high-impact repos were fully exploitable, including at Microsoft, Google, Apache, and Cloudflare; Cisco’s SD-WAN Manager CVE-2026-20245 (CVSS 7.8) was exploited as a zero-day for at least two months pre-disclosure with anti-forensic tradecraft; an international operation dismantled Amadey/StealC infrastructure (326 servers, 142 domains, 27M credentials, $47M in crypto); and “agentic adversaries” — AI that tests and weaponizes exploits autonomously — are compressing discovery-to-weaponization from weeks to hours. Defender priorities: audit GitHub Actions for Cordyceps patterns now, patch CVE-2026-20245 now, cut LLM/agent infrastructure access to least privilege, and track CISA KEV weekly.
The Cordyceps CI/CD Vulnerability
Security researchers at Novee Security disclosed an exploitable pattern in CI/CD workflows codenamed Cordyceps: any unauthenticated GitHub user can hijack workflows, forge approvals, push malicious code, and steal credentials — no organizational membership, no special privileges. A free account is the entire prerequisite.
Scans of roughly 30,000 high-impact repositories found more than 300 fully exploitable, including repositories at Microsoft, Google, Apache, and Cloudflare. This isn’t a plugin bug or a misconfiguration — it’s a structural weakness in how pipelines handle workflow approvals and code signing, the same class of build-system risk that has defined 2026’s supply-chain attacks.
What Makes Cordyceps Dangerous
- No authentication required — a free GitHub account is enough
- Full repository compromise — attacker-controlled code execution inside the pipeline
- Credential theft — secrets and tokens exposed through workflow manipulation
- Supply-chain cascade — compromised repos propagate to downstream consumers, the same amplification that made the AUR package hijacks and node-ipc incident land so hard
Cisco SD-WAN Zero-Day: CVE-2026-20245
Mandiant revealed that an unknown threat actor exploited CVE-2026-20245 (CVSS 7.8) as a zero-day at least two months before public disclosure. The Cisco Catalyst SD-WAN Manager flaw allows an authenticated local attacker to execute arbitrary commands with elevated privileges — effectively root on the network’s control plane.
The standout detail is the anti-forensic tradecraft: the actor selectively deleted and restored system configuration files to avoid detection while maintaining persistence. We covered this exploitation wave in the June zero-day report — patching is a same-day item, not a queue item.
Amadey and StealC Takedown
A coordinated law enforcement operation disrupted the infrastructure behind Amadey and StealC malware campaigns:
- 326 servers and 142 domains dismantled
- 27 million stolen credentials recovered
- $47 million in cryptocurrency identified and restricted
- Joint operation spanning the Netherlands, Canada, Germany, and the US
It follows a separate cleanup of nearly 15,000 infected WordPress sites tied to SocGholish — a scale reminder that CMS estates remain prime loader territory. If you run WordPress, the endpoint-side pressure and this takedown are the same story: initial-access markets at industrial scale.
The Rise of the “Apex Agentic Adversary”
The month’s most significant trend: security researchers describe AI entities that don’t merely suggest attack code but actively test, iterate, and weaponize exploits at machine speed — the “apex agentic adversary.”
- Discovery-to-weaponization compression: what took weeks now takes hours
- Autonomous testing: agents that probe, adapt, and escalate independently — the offensive mirror of autonomous attack operations
- Anti-forensic sophistication: AI-driven evasion adapting to defensive tooling in real time
- Infrastructure access: organizations that granted LLMs deep infrastructure access are now the most exposed — the exact risk in AutoJack and the broader agentic attack surface
CISA KEV Catalog Updates
CISA continued adding actively exploited vulnerabilities through June — including the Android, Palo Alto, and Oracle items we tracked in the June KEV breakdown, plus the Ivanti CVE-2026-10520 addition. KEV due dates now run in days, which makes weekly cross-referencing a floor, not a ceiling. The full exploitation picture lives in our week-three intelligence brief.
Key Takeaways for Defenders
- Audit CI/CD pipelines immediately — check GitHub Actions workflows for Cordyceps patterns (unauthenticated trigger paths, forgeable approvals)
- Patch network infrastructure — CVE-2026-20245 is actively exploited with anti-forensic tradecraft; there is no deferral tier
- Cut AI/LLM infrastructure access to least privilege — agentic adversaries weaponize the same deep access you granted your own agents; treat agent identity like human identity
- Cross-reference CISA KEV weekly — due dates are days, not weeks
- Check WordPress installations — nearly 15,000 SocGholish-infected sites were cleaned in one operation; make sure yours isn’t in the next batch
June 2026 at a Glance
| Event | Class | Scale | Defender action |
|---|---|---|---|
| Cordyceps CI/CD pattern | Supply chain | 300+ repos exploitable | Audit Actions workflows |
| Cisco SD-WAN CVE-2026-20245 | Zero-day exploitation | ≥2 months pre-disclosure | Patch now |
| Amadey/StealC takedown | Law enforcement | 326 servers · 27M creds | Rotate exposed credentials |
| SocGholish cleanup | Malware load | ~15,000 WordPress sites | CMS hygiene + monitoring |
| Agentic adversaries | AI threat evolution | Weeks→hours weaponization | Least-privilege agent access |
Frequently Asked Questions
What is the Cordyceps CI/CD vulnerability?
An exploitable pattern in GitHub Actions workflows, disclosed by Novee Security, that lets unauthenticated users hijack workflows, forge approvals, and push malicious code. Over 300 high-impact repositories — including at Microsoft, Google, Apache, and Cloudflare — were found fully exploitable.
Is CVE-2026-20245 being actively exploited?
Yes. Mandiant confirmed an unknown threat actor exploited the Cisco Catalyst SD-WAN Manager flaw as a zero-day for at least two months before public disclosure, using anti-forensic techniques to stay hidden.
What is an agentic adversary?
An AI-powered threat actor that autonomously discovers, tests, and weaponizes vulnerabilities at machine speed — compressing the attack lifecycle from weeks to hours. The defensive answer is shrinking their blast radius: least-privilege, monitored agent access.
How many WordPress sites were affected by SocGholish?
Nearly 15,000 infected sites were cleaned in the June 2026 coordinated operation — consistent with the 14,971-site SocGholish distribution network documented in prior reporting.
References
- Novee Security — Cordyceps CI/CD workflow disclosure (June 2026)
- Mandiant — Cisco Catalyst SD-WAN Manager CVE-2026-20245 zero-day exploitation reporting
- Coordinated Netherlands/Canada/Germany/US operation — Amadey & StealC infrastructure disruption
- Hmmnm — 5 Critical Zero-Days: June 2026 Threat Intelligence
- Hmmnm — CISA KEV June 2026: Android, Palo Alto, Oracle
- Hmmnm — Software Supply Chain Security
- Hmmnm — AI-Driven Autonomous Attacks
