Ransomwarehigh
OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-33634 | Embedded Malicious Code in Aquasecurity Trivy, trivy-action, and setup-trivy Releases | 9.4 | 60% | KEVPoC ×2 | KEV |
From the original article
7 min read at thehackernews.com
OpenAI revealed a GitHub Actions workflow used to sign its macOS apps led to the download of the malicious Axios library on March 31, but noted that no user data or internal system was compromised. "Out of an abundance of caution, we are taking steps to protect the process that certifies our macOS applications are legitimate OpenAI apps," OpenAI said in a post last week.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.