github-actions

GitHub moved custom runner images out of preview on March 26, exposing a snapshot keyword that turns a workflow run into a versioned VM image — and Copilot's own cloud agent cut another 20 percent off its cold start using it.

Threat actor TeamPCP compromised the widely used Trivy vulnerability scanner through a retained access token from an earlier incomplete remediation, injecting credential-stealing payloads into official releases and GitHub Actions while defacing 44 Aqua Security repositories.

Attackers hijacked 75 of 76 version tags in the widely used trivy-action GitHub Action to steal CI/CD credentials, then deployed a self-propagating npm worm that uses the Internet Computer Protocol as an untakeable-down command-and-control channel.