'Cordyceps' Attack Poisons Open-Source Pull Requests

A new attack called 'Cordyceps' exploits CI/CD workflows by injecting malicious code into pull requests targeting major projects like Azure Sentinel and Google's AI Agent Kit. The technique bypasses code review by hiding malicious changes in seemingly benign commits. Developers are urged to audit PRs more rigorously to prevent supply-chain compromise.