Guidance for detecting, investigating, and defending against the Trivy supply chain compromise

In this article 1. Analyzing the Trivy supply chain compromise 2. Detection and investigation 3. Mitigation and protection guidance 4. Advanced hunting queries 5. References 6. Learn more On March 19, 2026, Trivy, Aqua Security’s widely used open-source vulnerability scanner, was reported to have...

Your AI Stack Just Handed Over Your Root Keys: Inside the litellm PyPI Breach

Litellm PyPI breach explained: malicious versions steal cloud credentials, SSH keys, and Kubernetes secrets. Learn impact and urgent mitigation steps...

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx, related to unlimited resource allocation, allows a attacker to cause a service failure.

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx is related to unlimited resource allocation. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 via Trivy CI/CD Compromise

TeamPCP, the threat actor behind the recent compromises of Trivy and KICS, has now compromised a popular Python package named litellm, pushing two malicious versions containing a credential harvester, a Kubernetes lateral movement toolkit, and a persistent backdoor. Multiple security vendors,...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.1

cert-manager Operator for Red Hat OpenShift 1.17.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: multicluster engine for Kubernetes v2.7.9 security update

The multicluster engine for Kubernetes 2.7 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. The multicluster engine for Kubernetes v2.7 images The multicluster engine for Kubernetes provides the foundational components that are...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.12.8 security update

Red Hat Advanced Cluster Management for Kubernetes 2.12 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. Red Hat Advanced Cluster Management for Kubernetes 2.12 images Red Hat Advanced Cluster Management for Kubernetes provides...

New CanisterWorm Targets Kubernetes Clusters, Deploys “Kamikaze” Wiper

CanisterWorm spreads via npm supply chain attack, hijacks developer accounts, targets Kubernetes clusters, and deploys destructive Kamikaze wiper payload...

GO-2026-4796 ingress-nginx comment-based nginx configuration injection in k8s.io/ingress-nginx

ingress-nginx comment-based nginx configuration injection in k8s.io/ingress-nginx...

GO-2026-4777 Juju has unauthorized access to out-of-scope Kubernetes secrets in github.com/juju/juju

Juju has unauthorized access to out-of-scope Kubernetes secrets in github.com/juju/juju...

GHSA-3M6G-2423-7CP3 vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails, ruby, ruby4.0-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-rails, cinc-auditor, ruby3.4-rails, ruby3.2-rails, ruby3.4-fluentd-kubernetes-daemonset, logstash...

GHSA-3M6G-2423-7CP3 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-fluentd-kubernetes-daemonset, gitlab-cng, ruby4.0-fluentd-kubernetes-daemonset, cinc-auditor, ruby, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-rails, ruby3.4-rails, logstash, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails...

CVE-2026-33210 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-fluentd-kubernetes-daemonset, gitlab-cng, ruby4.0-fluentd-kubernetes-daemonset, cinc-auditor, ruby, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-rails, ruby3.4-rails, logstash, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-rails...

Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper

Cybersecurity researchers have uncovered malicious artifacts distributed via Docker Hub following the Trivy supply chain attack, highlighting the widening blast radius across developer environments. The last known clean release of Trivy on Docker Hub is 0.69.3. The malicious versions 0.69.4,...

Server-Side Request Forgery (SSRF)

kube-controller-manager is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of requests in the in-tree Portworx StorageClass, which allows an attacker to leak sensitive information from internal or unprotected endpoints within the control plane’s hos...

AWS VDP: Encryption context keys and values logged at INFO level

Component: cmd/server/main.go:101-106 Affected Version: aws-encryption-provider @ 4341c70 all versions Found by: Source audit TLP: TLP:Amber --- Summary The server startup code logs all encryption context key-value pairs at INFO level. Encryption context is metadata associated with KMS operations...

EUVD-2026-13831

A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequenc...

NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter

A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequenc...

GHSA-2MJQ-54QG-7W6J NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter

A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequenc...

CVE-2026-3864

A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequenc...