Wow, TeamPCP is hacking open-source developers faster than we can report on them. The latest (that I'm aware of, anyway) is LiteLLM. They worked with Trivy but didn't bother to change their credentials after Trivy was hacked, despite an ample amount of advice to do so.
Folks, if any of you used LiteLLM, now is the time to change your credentials, in an atomic way. Now, as in immediately.
The most interesting supply chain attack I've ever seen: #trivy
The attack is really bizarre. I learned a lot about GitHub Actions and how the attack was performed.
- https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/
- https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation
- https://ramimac.me/trivy-teampcp/#timeline
- https://snyk.io/articles/trivy-github-actions-supply-chain-compromise/
#cybersecurity #supplychain #github #glassworm #githubactions #attack #TeamPCP #c2
Open Source Security Advisory Update: Monday, March 23, 2026 Boston, MA 2:00 AM ET We are providing this update to share new developments identified during our ongoing investigation into the Trivy open source incident described below. Over the weekend, the Trivy team continued analysis of the previously reported incident and started implementing additional security measures across repositories and automation …
With this structure, the variables in “host_vars” and “group_vars” are not loaded. This is because the inventory file is not in the root directory. Is there a way to have the inventory file in an inventory folder?
🎉 First WIN of 2026: the Austrian DPA has ordered Microsoft to stop tracking school children
https://noyb.eu/en/noyb-win-microsoft-ordered-stop-tracking-school-children
Do not store your Bitlocker encryption keys on Microsoft's servers if your threat model includes governments or law enforcement. As this article points out, this is the result of a design choice Microsoft made. It didn't have to be this way.
RE: https://infosec.exchange/@netresec/115905237000922504
Here’s a good example on why you should have network egress filtering on your network. Nobody uses the finger protocol any more. But the binary still exists in Windows! And if you don’t block outbound port 79/tcp your users are at risk #cybersecurity #LOLBIN
Dan Goodin
noyb.eu
evacide
Brian Clark