This Week in Security: Second Verse, Worse Than the First

https://fed.brid.gy/r/https://hackaday.com/2026/03/27/this-week-in-security-second-verse-worse-than-the-first/

⚠️📢 Version 1.0: Der Open-Source-Schwachstellenscanner #Trivy von Aqua Security ist seit dem 19.03.2026 von einem Supply-Chain-Angriff betroffen, der zu Kompromittierungen in Deutschland führt.

❗️ Sollte ein Download von Versionen/Actions in diesem Zeitraum stattgefunden haben, sollte von einer Kompromittierung ausgegangen werden. Alle in diesen Runner-Umgebungen zugänglichen Geheimnisse müssen als abgeflossen angesehen werden.

Mehr Informationen findet ihr hier: 👉️ https://www.bsi.bund.de/dok/1195584

Guidance for detecting, investigating, and defending against the Trivy supplychain compromise - https://www.redpacketsecurity.com/guidance-for-detecting-investigating-and-defending-against-the-trivy-supplychain-compromise/

#threatintel
#trivy
#supply chain attack
#github actions
#ci/cd security
#credential theft

At the risk of spilling the beans too early... I grew tired of the constant barrage of supply-chain attacks afflicting the open-source community and decided to create a new open-source #malware scanner, named #Litmus.

This is part of a larger vision for intercepting supply-chain attacks, called The #Atomdrift Project. I want to empower everyone, from software marketplaces to teenagers at home, to catch the sorts of attacks we've recently seen against #Trivy and #OpenClaw.

＞2026年3月Trivyサプライチェーン攻撃とDockerイメージのバージョンピニング #trivy #docker #security - Tech Blog｜クリエーションライン
https://www.creationline.com/tech-blog/cloudnative/docker/83207

とりあえず latest バージョンを使っておけばいいか，という長閑な時代は終わったということやね。またひとつパンドラの匣を開けてしまったのか

このレベルで攻撃されるのか・・インターネッツは「性善説って何？」って感じの治安になりつつあるな。

2026年3月Trivyサプライチェーン攻撃とDockerイメージのバージョンピニング #trivy #docker #security - Tech Blog｜クリエーションライン
https://www.creationline.com/tech-blog/cloudnative/docker/83207

Se volete sapere come lo scanner di sicurezza più usato al mondo è stato compromesso, sentite qua.

Trivy, di Aqua Security, è quello che dovrebbe proteggere le pipeline CI/CD, invece è diventato il cavallo di Troia di un attacco che ha infettato migliaia di ambienti cloud, avvelenato npm e Docker Hub, e colpito LiteLLM (3,4 milioni di download al giorno).

Qui problema non è la classica sostenibilità dell'open source: è un problema di processo e di fiducia cieca.

https://youtu.be/qKxKxFFz30M?si=EYxfzIpipUYhKGc0

#trivy #supplychain #cybersecurity #litellm