The latest articles on DEV Community by phani rudra (@phani_rudra9). https://dev.to/phani_rudra9 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3047459%2F7681e0f5-4093-4260-ab66-81e659f506ab.JPG https://dev.to/phani_rudra9 en phani rudra Sun, 13 Apr 2025 15:23:51 +0000 https://dev.to/phani_rudra9/recent-security-alerts-github-actions-hijack-and-kubernetes-ingress-nginx-vulnerability-2ap8 https://dev.to/phani_rudra9/recent-security-alerts-github-actions-hijack-and-kubernetes-ingress-nginx-vulnerability-2ap8 <h2> Hello friends </h2> <p>Recently, two important security issues were brought up by Wiz. These issues affect GitHub Actions and the Kubernetes Ingress-NGINX controller. If you are working in DevOps or managing infrastructure, please take these seriously. In this blog, I will explain them in simple language and also tell you how to fix them.</p> <h2> GitHub Actions Hijack Issue </h2> <h3> What happened? </h3> <ul> <li>A popular GitHub Action <code>tj-actions/changed-files</code> was compromised</li> <li>Malicious code was pushed and released in a version</li> <li>Using <code>@v35</code> or other tags may fetch compromised code</li> </ul> <h3> What should you do? </h3> <ul> <li>Use full commit SHA instead of version tag </li> </ul> <div class="highlight js-code-highlight"> <pre class="highlight yaml"><code><span class="na">uses</span><span class="pi">:</span> <span class="s">tj-actions/changed-files@9e5e6c7f3d2b84aafc35f45d2e80b2e3a1743b70</span> </code></pre> </div> <ul> <li>Audit third-party actions</li> <li>Prefer verified sources</li> </ul> <h2> Kubernetes Ingress-NGINX Vulnerability (CVE-2025-1974) </h2> <h3> What happened? </h3> <ul> <li>Ingress-NGINX controller had a serious vulnerability</li> <li>Older versions (1.12.0 or below) allow unauthenticated command execution</li> </ul> <h3> What should you do? </h3> <ul> <li>Upgrade to 1.11.5 or 1.12.1 or newer</li> <li>Use AWS ALB Ingress Controller if on Amazon EKS</li> <li>Ensure <code>ingress-nginx-controller-admission</code> is not publicly exposed</li> </ul> <h2> Conclusion </h2> <ul> <li>Stay updated on security alerts</li> <li>Review and secure your GitHub workflows</li> <li>Upgrade Ingress controllers on your clusters</li> <li>Reach out if you need help</li> </ul> <p><strong>Lakshmi Phanindra Rudra</strong><br><br> Technical Lead - DevSecOps and Cloud Engineering</p> devsecops awscloud cloudsecurity githubactions