Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour

Attackers used GitHub issues, pull requests, and comments to rapidly trigger vulnerable CI/CD workflows across 61 public repositories, demonstrating how quickly a single weakness in developer tooling can become a broad supply-chain risk. For CIOs and technology leaders, the key implication is that open-source usage and automated build pipelines are now high-value attack surfaces: if external content can reach privileged workflows, credentials, tokens, and downstream software integrity can all be exposed. IT organizations should treat CI/CD as critical infrastructure, not just developer tooling, and prioritize tighter access controls, isolation of externally triggered jobs, and stronger secret handling.