https://pwn.watch/t/checkmarx Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 31 Mar 2026 00:00:00 GMT https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain Tue, 31 Mar 2026 00:00:00 GMT critical <p>Threat actors tracked as TeamPCP compromised Trivy releases and GitHub Actions (including trivy-action / setup-trivy), then expanded into Checkmarx AST and KICS Actions and related artifacts. Malware stole CI/CD credentials (exfil as tpcp.tar.gz). Microsoft, Sysdig, CSA Singapore and Checkmarx published guidance in March 2026.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> trivy-action &gt;= v0.35.0, setup-trivy &gt;= v0.2.6, Checkmarx AST/KICS patched releases per Checkmarx updates</p> <p><strong>Latest updates:</strong></p><ul><li>2026-03: Trivy compromise disclosed; Microsoft guidance published.</li><li>2026-03: Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates).</li></ul>