Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets
2026-03-20T19:24:14Z•fb59e0075484654982655739b6fd35531119455d3abfc3d5e1003bc11ba30995
active-exploitationandroid-malwarebyovdci-cdcisco-fmcedr-evasiongithub-actionsios-exploit-kitiot-botnetmagentomalwareofacpolicy-changeransomwaresecret-theftsideloadingsupply-chaintelnetdubuntuwebkitzero-day
What happened
A high-impact news roundup: multiple critical vulnerabilities are being actively exploited (notably Langflow CVE-2026-33017 and Cisco FMC CVE-2026-20131), a supply-chain compromise of Aqua Security's Trivy GitHub Actions packages led to hijacked tags and CI/CD secret theft, and several other severe flaws (GNU telnetd CVE-2026-32746, Ubuntu CVE-2026-3888, Apple WebKit CVE-2026-20643) and exploit kits (DarkSword) are in the wild. Concurrent campaigns and threats include ransomware (Interlock, LeakNet), new malware families (Speagle, Perseus), widespread EDR-evasion via BYOVD abusing signed, vuln
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- fb59e0075484654982655739b6fd35531119455d3abfc3d5e1003bc11ba30995
- Enrichment time
- 2026-03-20T19:24:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.