---
title: "Two GitHub Actions supply chain attacks hit CI/CD secrets, Cisco SD-WAN zero-day exploited two months before disclosure"
url: https://daily.dev/posts/two-github-actions-supply-chain-attacks-hit-ci-cd-secrets-cisco-sd-wan-zero-day-exploited-two-month-yru0bxlws
source_url: https://daily.dev/posts/two-github-actions-supply-chain-attacks-hit-ci-cd-secrets-cisco-sd-wan-zero-day-exploited-two-month-yru0bxlws
type: freeform
source: "Backend Digest"
published: 2026-06-25T04:18:05.261Z
updated: 2026-06-25T04:18:30.087Z
tags: ["security", "typescript", "github-actions", "istio"]
reading_time: 5
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Two GitHub Actions supply chain attacks hit CI/CD secrets, Cisco SD-WAN zero-day exploited two months before disclosure

**[Backend Digest](https://daily.dev/sources/backend_digest)** · 5 min read · 0 upvotes · 0 comments

## Summary

A security-heavy roundup covering two GitHub Actions compromised via force-push tag hijacking on June 24 — codfish/semantic-release-action deployed the Miasma credential-stealing toolkit targeting GITHUB_TOKEN and NPM_TOKEN, while simonecorsi/mawesome was also hit. Cisco Catalyst SD-WAN CVE-2026-20245 was exploited two months before disclosure, with attackers planting a backdoor root account via malicious CSV upload. Istio patched 14 Envoy CVEs across three active branches including a use-after-free and OAuth2 padding oracle. TypeScript 7.0 RC ships its Go rewrite with 5-9x faster builds but no programmatic Compiler API yet. Also notable: gRPC-Go CVSS 9.1 auth bypass fixed in v1.79.3, Linkerd 2.20 cuts control plane memory 85%, Debezium 3.6.0.CR1 reduces MySQL connector memory 75%, Linux 7.2 MGLRU yields up to 100% MongoDB throughput gains, and GitLab patches two CVSS 8.7/8.0 XSS vulnerabilities.

## Content

**TLDR:** Two GitHub Actions were compromised on June 24 via force-push tag hijacking — codfish/semantic-release-action and simonecorsi/mawesome — with the semantic-release attack deploying the Miasma credential-stealing toolkit to steal GITHUB_TOKEN and NPM_TOKEN secrets. Separately, Mandiant confirmed attackers exploited CVE-2026-20245 in Cisco Catalyst SD-WAN as early as March 2026, two months before public disclosure, using a malicious CSV upload to plant a backdoor root account. On the runtime side, TypeScript 7.0 RC ships the Go rewrite with 5-9x faster builds, and Linkerd 2.20 claims an 85% reduction in control plane memory. Istio pushed security patches across three active branches covering 14 Envoy CVEs.

---

## codfish/semantic-release-action and simonecorsi/mawesome GitHub Actions compromised via tag hijacking

Both actions were hit on June 24 via force-push attacks that redirected version tags to malicious commits. The semantic-release-action attack is the more dangerous of the two: the payload is a 781 KB obfuscated JavaScript file linked to the Miasma credential-stealing toolkit, run via Bun specifically to bypass Node.js security hooks. It steals GITHUB_TOKEN and NPM_TOKEN, uses GitHub's public commit search API as a dead-drop C2 channel, and attempts to propagate backdoors into other accessible repositories. Any workflow pinned to affected tags (v1.6.1 through v2.2.1 for codfish, major version tags for mawesome) executed attacker-controlled code. Check your workflow files now and pin to verified commit SHAs rather than mutable tags. [Read more](https://daily.dev/feed-by-ids?id=n4jQPH2we&id=CKC9SvQzE&id=Y1H87nKdY)

## Cisco Catalyst SD-WAN CVE-2026-20245 exploited two months before disclosure, attackers planted backdoor root account

Mandiant confirmed the vulnerability was actively exploited as early as March 2026, roughly two months before Cisco's June disclosure. The attack chain started with unauthorized rogue peering connections chaining two prior authentication bypass zero-days, then exploited insufficient input validation in the SD-WAN Controller CLI by uploading a malicious CSV file to create a backdoor root account named 'troot' in /etc/passwd and /etc/shadow. Attackers ran a validation script to confirm all forensic traces were removed before leaving. CISA added the flaw to its known exploited vulnerabilities catalog with a June 23 federal patch deadline. The incident reinforces why network devices are increasingly attractive targets — limited forensic visibility and central control plane access make cleanup hard to verify. [Read more](https://daily.dev/feed-by-ids?id=ci5FfvCVZ&id=IxU9atfQ7&id=IuHsyBeBg)

## TypeScript 7.0 RC ships Go rewrite with 5-9x faster builds and 60-70% lower memory

The RC introduces a complete compiler rewrite in Go (codenamed 'Corsa'), shipping as a native binary installable via npm as @typescript/native. Teams with 500+ file codebases will see the biggest gains. The RC has real limitations worth knowing before you commit: no programmatic Compiler API (breaking ts-morph and custom transformers), incomplete --declarationMap support, and gaps in --build mode for complex multi-project setups. The migration path is to run tsgo --noEmit alongside tsc as a parallel safety net rather than replacing tsc outright for production builds yet. [Read more](https://daily.dev/posts/zSaemVTGG)

## Istio 1.28.9, 1.29.5, and 1.30.2 patch 14 Envoy CVEs including CVSS 7.5 DoS and OAuth2 padding oracle

All three active Istio branches received security releases under ISTIO-SECURITY-2026-005. The CVE list covers a lot of ground: HTTP/3 QPACK blocked decoding DoS (CVSS 7.5), Zstd memory exhaustion (CVSS 7.5), use-after-free in ext_authz and OAuth2 filters, a padding oracle in OAuth2 AES-256-CBC cookie decryption (CVSS 6.8), and SAN validation bypass via NUL byte injection (CVSS 4.4). If you're running any 1.28.x, 1.29.x, or 1.30.x deployment, upgrade now — the ext_authz use-after-free alone is enough reason. [Read more](https://daily.dev/feed-by-ids?id=czzzKx40i&id=gJ4QcMIvr&id=1tNuMUmHA&id=JnB76BnMS)

---

## Also notable

- **Linkerd 2.20 cuts control plane memory 85%:** Buoyant claims an 85% reduction in memory for the destination, identity, and proxy-injector components, making Linkerd viable for smaller Kubernetes clusters without sacrificing mTLS or golden metrics — a meaningful gap from Istio's resource footprint. [Read more](https://daily.dev/posts/keTItd8iF)
- **gRPC-Go CVE-2026-33186: CVSS 9.1 auth bypass fixed in v1.79.3:** A canonicalization flaw causes interceptor-based authorization rules to silently fail for paths missing a leading slash; services using deny-with-permissive-fallback policies are exploitable, and gRPC-Go is frequently a transitive dependency pulled in by Kubernetes clients and cloud SDKs — run govulncheck and pin to v1.79.3. [Read more](https://daily.dev/posts/Qus7WSkBb)
- **Debezium 3.6.0.CR1 cuts MySQL connector memory 75%, adds RocksDB off-heap history:** The candidate release introduces off-heap memory management for table history via RocksDB and a 75% reduction in memory allocation plus 31-42% CPU overhead reduction in the MySQL connector's poll path — worth testing if you're running high-throughput MySQL CDC pipelines. [Read more](https://daily.dev/posts/eiXmjK3Z6)
- **Linux 7.2 MGLRU improvement yields up to 100% MongoDB throughput gain on slower I/O:** An improvement to MGLRU's reclaim loop and dirty writeback handling in the Linux 7.2 MM subsystem shows up to 30% throughput gains for MongoDB with NVMe and up to 100% with slower I/O — relevant for anyone running database workloads on kernel 7.2 or planning to. [Read more](https://daily.dev/posts/SwHdndsKo)
- **GitLab patches two CVSS 8.7/8.0 XSS vulnerabilities in 19.1.1, 19.0.3, 18.11.6:** The patch covers 13 CVEs including high-severity XSS in the Analytics Dashboard and Web IDE, an information disclosure issue in Duo Workflows (CVSS 7.7), and authorization bypass issues across CI/CD and DAST — self-managed installations should upgrade immediately as the release includes database migrations that may cause downtime on single-node instances. [Read more](https://daily.dev/posts/fLm7cmPpy)

## Similar posts on daily.dev

- [Supply Chain Compromise: codfish/semantic-release-action Tags Hijacked to Steal OIDC Tokens and Propagate Backdoors](https://daily.dev/posts/supply-chain-compromise-codfish-semantic-release-action-tags-hijacked-to-steal-oidc-tokens-and-prop-y1h87nkdy) · StepSecurity · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#typescript](https://daily.dev/tags/typescript), [#github-actions](https://daily.dev/tags/github-actions), [#istio](https://daily.dev/tags/istio)

[View this post on daily.dev](https://daily.dev/posts/two-github-actions-supply-chain-attacks-hit-ci-cd-secrets-cisco-sd-wan-zero-day-exploited-two-month-yru0bxlws)