TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack

Multiple high-impact incidents and active exploitations reported: a supply-chain compromise by TeamPCP replaced the Checkmarx Jenkins AST plugin; cPanel/WHM vulnerability CVE-2026-41940 is being actively exploited to deploy a Filemanager backdoor (attributed to threat actor Mr_Rot13); Google disclosed an AI-assisted zero-day 2FA bypass used in mass exploitation; Ollama has a critical out-of-bounds read (CVE-2026-7482 “Bleeding Llama”) allowing full process memory leakage; PAN-OS CVE-2026-0300 RCE and Ivanti EPMM CVE-2026-6973 are under active exploitation; multiple supply-chain and repository‑