⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers & More

Summary: Attackers backdoored Trivy, the open-source vulnerability scanner from Aqua Security with over 32,000 GitHub stars and more than 100 million Docker Hub downloads, injecting credential-stealing malware into official releases and GitHub Actions used by thousands of CI/CD workflows. The breach cascaded into further supply-chain compromises where affected projects and organizations did not rotate secrets, distributing a self-propagating worm called CanisterWorm.
What's compelling: A scanner that thousands of pipelines trust to find flaws was itself the delivery mechanism, and the worm that followed spread through secrets nobody rotated - the damage landed in the gap between a patch and a deployment.

Read the original at The Hacker News ↗

Topics: Malware
Mentions: CVE-2025-14986 CVE-2026-20643 CVE-2026-21570 CVE-2026-21643 CVE-2026-21884 CVE-2026-21992 CVE-2026-22557 CVE-2026-22558 CVE-2026-24291 CVE-2026-25769 CVE-2026-26189 CVE-2026-31381 CVE-2026-31382 CVE-2026-32297 CVE-2026-32298 CVE-2026-32635 CVE-2026-32746 CVE-2026-33001 CVE-2026-33002 CVE-2026-33017 CVE-2026-3564 CVE-2026-3864 CVE-2026-3888 CVE-2026-4276 CVE-2026-4439 CVE-2026-4440 CVE-2026-4441
Related: CVE-2026-21643: Fortinet Forti Client EMS SQL Injection Vulnerability Known Exploited Vulnerabilities · Apr 13, 2026
CVE-2026-33017: Langflow Code Injection Vulnerability Known Exploited Vulnerabilities · Mar 25, 2026
Fortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code Execution Cyber Risks ·