Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets

The Hacker News

March 20, 2026 at 5:47 PM

Actively Exploited

Overview

Trivy, an open-source vulnerability scanner developed by Aqua Security, has been compromised for the second time in a month. This breach specifically targeted the GitHub Actions workflows 'aquasecurity/trivy-action' and 'aquasecurity/setup-trivy', which are commonly used for scanning Docker container images for vulnerabilities. Attackers hijacked 75 tags to deliver malware that aims to steal sensitive continuous integration and continuous delivery (CI/CD) secrets. This incident is particularly concerning as it exposes users relying on these tools to potential data breaches and security risks. Organizations using these GitHub Actions should take immediate action to secure their environments and monitor for any unauthorized access or data leaks.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: aquasecurity/trivy-action, aquasecurity/setup-trivy
Action Required: Users should audit their GitHub Actions workflows, revoke any compromised secrets, and update to the latest versions of the affected actions as soon as possible.
Timeline: Ongoing since October 2023

Original Article Summary

Trivy, a popular open-source vulnerability scanner maintained by Aqua Security, was compromised a second time within the span of a month to deliver malware that stole sensitive CI/CD secrets. The latest incident impacted GitHub Actions "aquasecurity/trivy-action" and "aquasecurity/setup-trivy," which are used to scan Docker container images for vulnerabilities and set up GitHub Actions workflow

Impact

aquasecurity/trivy-action, aquasecurity/setup-trivy

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since October 2023

Remediation

Users should audit their GitHub Actions workflows, revoke any compromised secrets, and update to the latest versions of the affected actions as soon as possible.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Vulnerability, Malware.

Read Original Article

Related Coverage

UK Cyberspying Chief Calls AI ‘an Unstoppable Force’ and Warns About Russia

SecurityWeek

In a recent speech, the UK's chief of cyberspying warned that Russia is increasing its aggressive activities in a 'gray zone' that doesn't quite reach the level of war. This reflects ongoing concerns among intelligence experts about Russia's tactics, which may include cyber operations and disinformation campaigns aimed at destabilizing countries without triggering direct military conflict. The chief emphasized the role of artificial intelligence in these operations, describing it as an 'unstoppable force' that could amplify Russia's capabilities in this area. This warning serves as a reminder for nations to remain vigilant and prepared for potential cyber threats that could disrupt security and stability. The implications of these developments are significant, as they suggest a shift in how conflicts may be waged in the future, particularly with non-traditional warfare tactics.

May 27, 2026

Latin American Cybercriminals Hoover Up Government Data

darkreading

Cybercriminals have leaked 5.8 million records of Uruguayan citizens, marking another instance of hackers targeting government databases to sell personal information. This breach raises serious concerns about the security of sensitive data held by government agencies and the potential for identity theft and fraud. The leaked information could be used for various malicious purposes, including financial scams and phishing attacks. As more government data becomes accessible online, the risks to citizens increase, highlighting the need for stronger security measures to protect personal information. This incident serves as a stark reminder for governments to prioritize cybersecurity to safeguard their citizens' data.

May 27, 2026

Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users

The Hacker News

Recent reports from WatchGuard and ESET reveal two banking trojan campaigns targeting users in Latin America and Europe. The Grandoreiro malware is aimed at Windows devices, while the BTMOB RAT is designed for Android users. These campaigns specifically target companies in Spain, Portugal, and Mexico, as well as mobile users in Brazil. The malware's ability to siphon sensitive financial information poses a significant risk to both businesses and individual users. As cybercriminals continue to adapt their tactics, it's crucial for users to remain vigilant and implement security measures to protect their devices and data.

May 27, 2026

CrowdStrike, Google Take Down Glassworm Botnet

Infosecurity Magazine

CrowdStrike and Google have successfully dismantled the Glassworm botnet, which has been targeting software developers since early 2025. This botnet is notable for its focus on compromising development environments, potentially allowing attackers to introduce malicious code into legitimate software projects. The operation highlights the risks that developers face, as their tools and platforms can be exploited by cybercriminals. By disrupting this botnet, the companies aim to protect software development processes and ensure the integrity of the applications being created. This incident serves as a reminder of the ongoing cybersecurity challenges in the software development sector.

May 27, 2026

Glassworm botnet disrupted after resilient C2 infrastructure takedown

BleepingComputer

The Glassworm botnet, which has been targeting software developers through supply-chain attacks, has been disrupted following the dismantling of its command-and-control infrastructure. Researchers focused on the botnet's unique reliance on Solana blockchain transactions and the BitTorrent DHT network for its operations. This disruption is significant as it affects developers who are increasingly targeted in cyberattacks aimed at compromising software supply chains. By taking down these systems, researchers have potentially reduced the risk of further attacks on vulnerable development environments. The incident underscores the ongoing challenges in securing software development processes against advanced threats.

May 27, 2026

All Major LLMs Exposed to Multi-Turn Manipulation, Warn Researchers

Infosecurity Magazine

Researchers have discovered that all major large language models (LLMs) are vulnerable to a type of manipulation called multi-turn manipulation. This means that attackers could exploit these models to generate misleading or harmful content over multiple interactions, potentially affecting how users perceive information. The models at risk include those from leading companies in the AI space, which could have serious implications for users relying on these technologies for accurate information. The research highlights the need for developers to implement stronger safeguards against such manipulations, as the integrity of AI-generated content is essential for trust and safety in various applications. This vulnerability raises concerns about the reliability of AI systems, especially when used in sensitive areas like healthcare, finance, and education.

May 27, 2026