Expert perspectives on application security, compliance, and emerging threats
IncidentWhat Happened On April 29, TeamPCP executed a supply chain attack that compromised over 1,800 developer repositories across PyPI, NPM, and PHP ecosystems. The attackers published malicious versions of
IncidentOn a recent weekend, attackers rewrote nearly every version tag in the aquasecurity/trivy-action repository. Within hours, CI/CD pipelines across hundreds of organizations were executing malicious cod
IncidentWhat Happened On January 17, 2025, attackers compromised Aqua Security s Trivy vulnerability scanner through its GitHub Actions repository. The breach affected trivy-action, a GitHub Action wrapper us
IncidentWhat Happened On March 19, 2026, Sonatype Security Research reported two malicious npm packages—sbx-mask and touch-adv—to npm s maintainers. These packages were published through a compromised trusted
Get weekly security insights and compliance updates delivered to your inbox.
IncidentOn January 14, 2025, Checkmarx disclosed that threat actor TeamPCP compromised their GitHub Actions workflows by stealing CI credentials. This incident, similar to a previous attack on Aqua Security s
IncidentOn PyPI, malicious versions of LiteLLM were available for download for about three hours. The attack vector? A compromised Trivy GitHub Action that stole the maintainer s PyPI publishing credentials.
IncidentWhat Happened On March 24, 2026, threat actor TeamPCP released two compromised versions of the Python package litellm—versions 1.82.7 and 1.82.8. These contained a multi-stage attack toolkit, includin
IncidentIncident Overview A threat actor compromised CI/CD pipelines by deploying malicious code through an open source security tool. This attack used an infostealer to exfiltrate cloud credentials, SSH keys
IncidentWhat Happened On March 22, 2026, threat actor TeamPCP compromised the Trivy vulnerability scanner s Docker Hub distribution channel and attacked Aqua Security s GitHub infrastructure. Malicious versio
IncidentIn late 2024, Microsoft s Security Response Center documented a coordinated attempt to manipulate enterprise AI assistants through carefully crafted prompts. Attackers used role-playing scenarios and
IncidentWhat Happened Security researcher Mihalis Haatainen discovered a critical vulnerability in Azure API Management Developer Portals: disabling self-signup in the administrative interface doesn t actuall
IncidentWhat Happened GitGuardian s State of Secrets Sprawl 2026 reported 28.65 million new hardcoded secrets committed to public GitHub repositories during 2025. These included not only API keys from legacy
IncidentWhat Happened The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33017 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a remote code exec
IncidentWhat Happened Malicious versions of LiteLLM, a Python middleware for LLM API calls, were available on PyPI for about two hours. These versions contained malware designed to steal cloud provider keys a
IncidentImmediate Threat Overview On January 16, 2025, researchers disclosed CVE-2026-33017 , a critical vulnerability in Langflow versions 1.8.2 and earlier, allowing unauthenticated remote code execution. W
IncidentWhat Happened Threat actors exploited a code injection vulnerability in Langflow, an AI platform for building LLM-powered applications, within hours of its public disclosure. This vulnerability allowe
