Bottom line: CI/CD pipeline and developer tool vulnerabilities can lead to significant data breaches and intellectual property theft.
What's happening: Attackers are targeting the Jenkins, GitLab, and CircleCI CI/CD pipelines, as well as the developer tool, GitHub, for exploitation, with an estimated 20% of organizations using unpatched Jenkins versions (CVE-2021-20015) and a 10% increase in GitHub code repositories containing exposed credentials.
What to do: Implement a robust SDLC security posture by regularly scanning and monitoring Jenkins, GitLab, and CircleCI pipelines, and ensure GitHub repositories are secure by using a code review tool like Black Duck or CodeScene.