The exploit hit before anyone saw it coming. A Mercurial Zero Day Vulnerability, active in the wild, ripping through repositories without warning. No patch. No advisory. Just immediate exposure for every system running unprotected versions of the Mercurial source control tool.
Mercurial is a fast, distributed version control system used by thousands of teams to manage code. A zero day makes it dangerous because attackers can weaponize it before maintainers release a fix. This particular flaw allows remote code execution through crafted repository data. No authentication. No sandbox escape. Just input that flips the system from storage to attack vector.
Once triggered, the vulnerability can spread across mirrors, clones, and automated build pipelines. It hits CI/CD environments hard, especially those pulling from public or shared repos without strict validation. This means compromised repositories can poison downstream builds, inject malicious binaries, or leak sensitive credentials directly from developer machines.