Vendor

Aqua Security

2 mentions in 7 days · 4 in 30 days · 5 total · first seen Aug 12, 2026 · last 4d ago

Timeline5 articles

Top 10 Best CNAPP (Cloud-Native Application Protection) Platforms in 2026

GBHackers ranks 10 CNAPP platforms for 2026, naming Wiz, Prisma Cloud, and Microsoft Defender for Cloud as category leaders.

The guide describes CNAPP as the umbrella combining CSPM, CWPP, CIEM, and DSPM, arguing that cross-pillar correlation of attack paths is the platform's core value. Wiz is ranked best for graph-based correlation, Prisma Cloud for the broadest module set, and Microsoft Defender for Cloud for Azure economics. It also cites Google's approximately $32 billion agreement to acquire Wiz, announced in March 2025, as buyer leverage and a reason to seek roadmap and neutrality protections in multi-year contracts.

Cyber Security NewsSep 11, 07:21 UTC · 4d agoIndustry1

Top 10 Best Cloud Workload Protection (CWPP) Solutions in 2026

Editorial scorecard ranks 2026 cloud workload protection platforms, placing Prisma Cloud first, Sysdig second, and CrowdStrike third on detection quality.

A research-based scorecard rates ten cloud workload protection (CWPP) platforms across runtime depth, container/Kubernetes support, coverage breadth, cloud context, and value. Palo Alto Prisma Cloud leads at 8.9, followed by Sysdig at 8.8 and CrowdStrike at 8.6, with Aqua Security tying CrowdStrike at 8.6. The piece argues agent-versus-agentless is a false choice, with leaders now pairing agentless visibility with eBPF-based runtime sensors. Scores are editorial assessments, not lab benchmarks.

Cyber Security NewsSep 11, 07:15 UTC · 4d agoIndustry1

Two alleged TeamPCP members arrested and charged after months of software supply

Australian Federal Police, with FBI support, arrested two alleged TeamPCP members behind supply-chain attacks that compromised over 1,000 organizations.

The AFP charged two Western Australian men, identified by media as Ruben Ian Thomson (21) and Louis Michael Gaebler (23), with 14 combined offences including unauthorized data modification and dealing in criminal proceeds. TeamPCP is blamed for poisoning open-source software releases including Trivy, LiteLLM, and the mini Shai-Hulud worm campaign, exposing over 500,000 credentials and at least 300 GB of data. Victims included the European Commission and GitHub, with remediation costs estimated in the hundreds of millions of dollars. Researchers from Flare traced one suspect through leaked passwords, a GitHub alias, and a Steam profile.

CyberScoopAug 27, 14:32 UTC · 19d agoPolicy & legal1

Two Arrests, One Supply-Chain Attack, and a Lot of Stolen Credentials

AFP charges two men over TeamPCP open-source supply-chain attacks that stole 500,000+ credentials from 1,000+ organizations via four malware families.

Australian police charged two Western Australian men as principal participants in TeamPCP, which allegedly inserted malicious code into open-source software to steal credentials and sensitive data from government, academia, and private sector organizations worldwide. The campaign compromised more than 1,000 organizations, harvested over 500,000 credentials, and exfiltrated at least 300 GB of data, with remediation costs in the hundreds of millions of dollars. Four malware families were deployed: CanisterWorm (cloud token harvesting), SANDCLOCK (AWS and Kubernetes credential theft), Mini Shai-Hulud (self-replicating npm/PyPI worm), and Miasma (credential-harvesting worm variant). Trojanized tools included Trivy, KICS, LiteLLM, and the Telnyx Python SDK, with exfiltration via GitHub repositories tpcp-docs and docs-tpcp.

Security AffairsAug 27, 14:09 UTC · 19d agoThreat actor in the wild1

Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

Malicious LiteLLM 1.82.7/1.82.8 PyPI releases tied to the Trivy TeamPCP campaign harvested cloud, SSH, and database credentials, potentially exposing 2,500+ organizations.

CloudSEK reported that two malicious LiteLLM releases on PyPI (versions 1.82.7 and 1.82.8, live about 40 minutes on March 24) harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords, with captured loot files mapping potential exposure to more than 2,500 organizations including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp. The campaign is part of TeamPCP (tracked by Google as UNC6780), linked to the Aqua Security Trivy scanner compromise tracked as CVE-2026-33634 and added to CISA's Known Exploited Vulnerabilities catalog on March 26. The payload used a litellm_init.pth file executed at Python interpreter startup and exfiltrated secrets to models.litellm[.]cloud; the FBI's FLASH-20260702-01 advisory urged rotation of CI/CD, publishing, and cloud credentials.

The Hacker NewsAug 12, 08:05 UTC · Aug 12, 2026Data breach in the wildCVE-2026-33634

Related CVEsby mentions

CVE-2026-336349.459%
Embedded Malicious Code in Aquasecurity Trivy, trivy-action, and setup-trivy Releases
CVE-2026-33634 is an embedded malicious code (supply chain) vulnerability in which a threat actor using compromised Aquasecurity credentials published a backdoored Trivy v0.69.4 release on March 19, 2026, force-pushed 76 of 77 version tags in the aquasecurity/trivy-action GitHub Action to credential-stealing malware, and replaced all 7 tags in aquasecurity/setup-trivy with malicious commits. The malicious code executes when CI/CD pipelines pull or run the affected Trivy Go module/container image or when workflows resolve the compromised mutable version tags, including runs on March 19-20, 2026 that referenced tags instead of pinned commit SHAs. An attacker gains code execution in developer CI environments and can steal secrets (cloud, registry, and other credentials accessible to affected pipelines), with a repository named 'tpcp-docs' appearing in an organization indicating the fallback exfiltration mechanism fired and secrets were taken. Anyone who pulled or executed Trivy 0.69.4 or referenced affected trivy-action (0.0.1-0.34.2) or setup-trivy (0.2.0-0.2.6) tags is affected, and related malicious LiteLLM releases tied to the same campaign may have exposed 2,100+ organizations. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on March 26, 2026, EPSS estimates a 59.2% probability of exploitation within 30 days, and the FBI reports the TeamPCP actor compromised developer tools to steal cloud credentials.
· Aquasecurity (Aquasec) Trivy (Go module / container image) 0.69.4 (known safe: 0.69.2 and 0.69.3) · Aquasecurity (Aquasec) trivy-action (GitHub Action) 0.0.1 through 0.34.2 (76 of 77 tags force-pushed with malicious commits; known safe: 0.35.0) KEV PoC ×2large

Appears with

organization FBI 3 product LiteLLM 3 threat actor TeamPCP 3 product Trivy 3 vendor Palo Alto Networks 2 vendor Wiz 2 vendor Sysdig 2 malware mini Shai-Hulud 2 vendor CrowdStrike 2 organization Australian Federal Police 2 organization Western Australia Police Force 2 vendor Microsoft 2 organization Google 2 organization Aqua Security 2 organization LiteLLM 1 organization CrowdStrike 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.