Tracked topic
Trivy is an open source vulnerability scanner for container images, files, and code that detects known security issues in software dependencies.
… The software was subverted on March 19, when attackers referred to as TeamPCP used compromised credentials to publish a malicious Trivy release v0.69.4 , and again on March 22, when malicious Trivy versions v0.69.5 and v0.69.6 were published as DockerHub images. …
… Socket and Google-owned Wiz researchers over the weekend determined that the attack compromised multiple components of the Trivy project: the core scanner, the trivy-action GitHub Action, and the setup-trivy GitHub Action, and force-pushed 75 out of 76 trivy-action tags to malicious versions, meani… …
… Following a report that TeamPCP also breached Cisco's internal development environment and stole source code from credentials swiped via the Trivy attack, Cisco told The Register that it is "aware of the Trivy supply-chain issue that is affecting the industry." MORE CONTEXT 1K+ cloud environments i… …
… Then, just two weeks after Trivy, another supply chain attack hit a different open-source library. …
Cyber-crime Telnyx joins LiteLLM in latest PyPI package poisoning tied to Trivy breach Also, EU probes Snapchat, RedLine suspect extradited, AstraZeneca leak claim surfaces, and more INFOSEC IN BRIEF The cybercrime crew linked to the Trivy supply-chain attack has struck again, this time pushing mal… …
… First, attackers hit Trivy , a vulnerability scanner with more than 100,000 users and contributors that is embedded in thousands of CI/CD pipelines. …
…be even more exhausted by then, because securing Microsoft’s AI helper is not a trivial job Gartner analyst Dennis Xu has half-jokingly suggested banning use of Microsoft’s Copilot AI…
…many deployments still rely on default credentials – the ever-reliable "admin:admin" – making initial access trivial. Worse, on certain versions (6.0.0 through 6.1.1), an older flaw, CVE-2024…
…up, and not by a trivial amount. Microsoft – which recently reported a 60 percent jump in profits – is pointing the finger at component prices. "Due to recent increases in memory and component…
… MORE CONTEXT Anthropic struggling with Chinese competition, its own safety obsession OpenAI patches ChatGPT flaw that smuggled data over DNS Telnyx joins LiteLLM in latest PyPI package poisoning tied to Trivy breach SAP looking to pull more external data into its AI platform with Reltio acquisition… …