60
60
60
60
60
Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
Australian Federal Police charges two men with 14 offences over TeamPCP supply chain backdoors in Trivy, Checkmarx KICS, and LiteLLM affecting 1,000+ organizations.
The Australian Federal Police charged two Western Australian men, aged 21 and 23, with 14 offences for their alleged principal roles in TeamPCP's March 2026 supply chain attacks; they appeared in Perth Magistrates Court on August 27, 2026. The group stole publishing credentials from trusted open-source projects and pushed poisoned releases across five ecosystems - GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX - with LiteLLM's unpinned Trivy install enabling token theft and backdoored LiteLLM releases. The FBI said the malicious code potentially compromised more than 1,000 organizations, enabled theft of over 500,000 credentials, and exfiltrated at least 300 GB of data. Oligo Security linked the group's infrastructure to activity back to 2020, previously tracked as TA-NATALSTATUS and IronErn.
72
60
⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
60
60
60
60
60
60
EU's Cyber Resilience Act starts the 24-hour vulnerability clock
EU Cyber Resilience Act reporting rules take effect, requiring manufacturers to disclose actively exploited vulnerabilities to ENISA within 24 hours, with fines reaching €15 million.
The Cyber Resilience Act's Article 14 mandatory reporting duties became applicable, requiring makers of products with digital elements sold in the EU — regardless of where they are based — to file an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a detailed notification within 72 hours, and a final report within 14 days of releasing a fix. Reports must be submitted through ENISA's Single Reporting Platform to the designated CSIRT, and non-compliance with these core duties can trigger fines up to €15 million or 2.5 percent of annual turnover. Manufacturers must also inform affected users of available fixes without undue delay, and most remaining CRA provisions, including mandatory SBOMs and security-by-design requirements, become applicable on December 11, 2027.
80
Two alleged TeamPCP hackers arrested over global supply chain attacks
AFP and FBI arrested two alleged TeamPCP hackers behind open-source supply chain attacks that stole 500,000+ credentials from 1,000+ organizations.
Australian Federal Police, working with the FBI and Western Australia Police, arrested a 21-year-old from Cottesloe and a 23-year-old from Mandurah on August 26, 2026, over alleged membership in the TeamPCP cybercrime group. The group allegedly planted malicious code in open-source packages, harvesting credentials, authentication tokens and at least 300 GB of data from over 1,000 organizations, with remediation costs estimated in the hundreds of millions of dollars. TeamPCP has been linked to supply chain attacks on GitHub, Telnyx, LiteLLM, Aqua Trivy, Checkmarx KICS, TanStack, MistralAI and Red Hat using a cloned self-replicating worm dubbed Shai-Hulud. Researchers note TeamPCP cloned the Shai-Hulud worm but was not behind the original 2025 attacks.
78
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Malicious LiteLLM 1.82.7/1.82.8 PyPI releases tied to the Trivy TeamPCP campaign harvested cloud, SSH, and database credentials, potentially exposing 2,500+ organizations.
CloudSEK reported that two malicious LiteLLM releases on PyPI (versions 1.82.7 and 1.82.8, live about 40 minutes on March 24) harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords, with captured loot files mapping potential exposure to more than 2,500 organizations including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp. The campaign is part of TeamPCP (tracked by Google as UNC6780), linked to the Aqua Security Trivy scanner compromise tracked as CVE-2026-33634 and added to CISA's Known Exploited Vulnerabilities catalog on March 26. The payload used a litellm_init.pth file executed at Python interpreter startup and exfiltrated secrets to models.litellm[.]cloud; the FBI's FLASH-20260702-01 advisory urged rotation of CI/CD, publishing, and cloud credentials.
78
60
Containers on fire: from container escapes to supply chain attacks
60
60
60
60
60
60
60
60
60
60
CISA Warns of Sitecore RCE Flaws; Active Exploits Hit Next.js and DrayTek Devices
60
60
60
60
60
60
Week in review: Attackers use phishing emails to steal NTLM hashes, Patch Tuesday forecast
60
60
60
60
New Apache Log4j Update Released to Patch Newly Discovered Vulnerability
60
60
60