A critical CI/CD vulnerability named 'Cordyceps' has been uncovered, affecting open-source repositories of major enterprises including Microsoft, Google, Apache, and Cloudflare. According to SlowMist's Chief Information Security Officer, 23pds, attackers can exploit this vulnerability without needing corporate accounts or system permissions. By simply registering a free GitHub account, submitting a malicious pull request, and leaving a comment, attackers can forge approvals, steal server keys, inject malicious code, and potentially take over a company's code repository.