2026-04-01: TeamPCP's multi-stage supply chain attack on Trivy, LiteLLM

Show Notes - 2026-04-01

Stories Covered

• Today:
• TeamPCP Supply Chain Attack: Trivy, LiteLLM, KICS Compromised (CVE-2025-55182) [Critical Alerts]
• Cisco Source Code Stolen via Trivy Supply Chain Attack [Critical Alerts]
• Axios npm Package Compromised by North Korean Threat Actor UNC1069 [Critical Alerts]
• Kerberos Relay Attack via DNS CNAME Abuse (CVE-2026-20929) [Critical Alerts]
• TrueConf Zero-Day Exploited Against Southeast Asian Government Networks (CVE-2026-3502) [Critical Alerts]
• Iranian Pseudo-Ransomware and Pay2Key Revival [Ransomware & Extortion]
• Iranian Password Spraying Campaign Targets Middle Eastern Municipalities [Business & Infrastructure Threats]
• UK Manufacturers Report 80% Cyberattack Rate [Business & Infrastructure Threats]
• Google Drive Ransomware Detection Now Default for Paying Users [Business & Infrastructure Threats]
• WhatsApp Malware Campaign Delivers VBScript and MSI Backdoors [Business & Infrastructure Threats]
• Venom Stealer: Continuous Credential Harvesting [Business & Infrastructure Threats]
• Stolen Logins Fuel Ransomware and Nation-State Attacks [Business & Infrastructure Threats]
• Windows 11 Emergency Update Fixes Preview Update Install Issues (KB5086672) [Windows / AD Security]
• Microsoft Outlook Classic Crashes Fixed (Teams Meeting Add-in) [Windows / AD Security]
• Claude AI Finds RCE Bugs in Vim and Emacs [General Security News]
• Microsoft CISO Advice: Applying Security Fundamentals to AI [General Security News]
• Unified Exposure Management Becoming Boardroom Priority [General Security News]
• Microsoft: Critical Infrastructure Threat Landscape Changed [General Security News]
• Proton Launches Privacy-Focused Meet Conferencing Platform [General Security News]
• Anritsu Remote Spectrum Monitor Authentication Bypass (CVE-2026-3356) [Vulnerability Disclosures]
• PX4 Autopilot MAVLink Authentication Bypass (CVE-2026-1579) [Vulnerability Disclosures]
• Microsoft Security Update Guide CVE Disclosures [Vulnerability Disclosures]

CVEs Referenced

CVE-2023-52676, CVE-2024-35839, CVE-2024-41013, CVE-2025-49010, CVE-2025-55182, CVE-2025-66037, CVE-2025-66038, CVE-2026-1579, CVE-2026-20929, CVE-2026-3356, CVE-2026-34043, CVE-2026-34714, CVE-2026-3502, CVE-2026-4176

Indicators of Compromise

IP Addresses: 142.11.206.73, 47.237.15.197

Read the full brief