Malware e strumenti · Supply chain
Compromissione di Trivy GitHub Actions Espone Segreti CI/CD I repository GitHub Actions di Aqua Security per Trivy sono stati force-pushed e 75 tag sostituiti con versioni malevole. Il payload iniettato è stato eseguito sui runner di GitHub Actions e ha esfiltrato token GitHub/PAT, credenziali cloud, chiavi SSH e token Docker e Kubernetes.
11 fonti · 25 mar
Cronologia Fonti 25 mar SecurityWeek
From Trivy to Broad OSS Compromise: TeamPCP Hits Docker Hub, VS Code, PyPI
The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.
originale 25 mar Microsoft Security Blog
Guidance for detecting, investigating, and defending against the Trivy supply chain compromise | Microsoft Security Blog
This analysis walks through the Trivy supply‑chain compromise, attacker techniques, and concrete steps security teams can take to detect and defend against similar attacks.
originale 25 mar The Hacker News
TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 via Trivy CI/CD Compromise
Malicious LiteLLM 1.82.7–1.82.8 via Trivy compromise deploys backdoor and steals credentials, enabling Kubernetes-wide persistence and lateral spread.
originale Part of the PlainSec briefing for 2026-03-27
Every edition of this story: Compromissione di Trivy GitHub Actions Espone Segreti CI/CD
Altro da oggi Malware e strumenti · Supply chain
Compromissione di Trivy GitHub Actions Espone Segreti CI/CD I repository GitHub Actions di Aqua Security per Trivy sono stati force-pushed e 75 tag sostituiti con versioni malevole. Il payload iniettato è stato eseguito sui runner di GitHub Actions e ha esfiltrato token GitHub/PAT, credenziali cloud, chiavi SSH e token Docker e Kubernetes.
11 fonti · 25 mar
Cronologia Fonti 25 mar SecurityWeek
From Trivy to Broad OSS Compromise: TeamPCP Hits Docker Hub, VS Code, PyPI
The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.
originale 25 mar Microsoft Security Blog
Guidance for detecting, investigating, and defending against the Trivy supply chain compromise | Microsoft Security Blog
This analysis walks through the Trivy supply‑chain compromise, attacker techniques, and concrete steps security teams can take to detect and defend against similar attacks.
originale 25 mar The Hacker News
TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 via Trivy CI/CD Compromise
Malicious LiteLLM 1.82.7–1.82.8 via Trivy compromise deploys backdoor and steals credentials, enabling Kubernetes-wide persistence and lateral spread.
originale Part of the PlainSec briefing for 2026-03-27
Every edition of this story: Compromissione di Trivy GitHub Actions Espone Segreti CI/CD
Altro da oggi