Blog

CodeBreach: Two Missing Regex Characters Nearly Handed Attackers the Keys to AWS's Own GitHub Repos

A webhook filter missing two regex anchor characters let researchers predict a trusted GitHub actor ID and hijack AWS's own CodeBuild pipelines, gaining admin access to repos like aws-sdk-js-v3. No CVE, no exploit code, just patient bot-account math.