SecurityTicks

Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm Packages 2026-03-21 at 13:44 By The threat actors behind the supply chain attack targeting the popular Trivy scanner are suspected to be conducting follow-on attacks that have led to the compromise of a large number of npm packages with a previously undocumented self-propagating worm dubbed […]

CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026 2026-03-21 at 13:44 By The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added five security flaws impacting Apple, Craft CMS, and Laravel Livewire to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch them by April

Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Manager 2026-03-21 at 12:24 By Oracle has released security updates to address a critical security flaw impacting Identity Manager and Web Services Manager that could be exploited to achieve remote code execution. The vulnerability, tracked as CVE-2026-21992, carries a CVSS score of 9.8 out of a

Payment biz pulls plug on open source charity after KYC spat 2026-03-21 at 11:30 By Liam Proven Free Software Foundation Europe says it was asked for supporters’ passwords; Nexi insists it only wanted test credentials to check cancellation flows The Free Software Foundation Europe says its electronic-payments provider Nexi Group unexpectedly “cancelled” its account –

Cryptographers engage in war of words over RustSec bug reports and subsequent ban 2026-03-21 at 02:52 By Thomas Claburn Rust security maintainers contend Nadim Kobeissi’s vulnerability claims are too much Since February, cryptographer Nadim Kobeissi has been trying to get code fixes applied to Rust cryptography libraries to address what he says are critical bugs.

Sorry, Amazon, you couldn’t pick a worse time to bring a phone to market: IDC analyst 2026-03-21 at 02:52 By O’Ryan Johnson The market is contracting Right product, wrong time? Amazon is reported to be developing a new smartphone, its first since 2014, and, according to industry tracker IDC, it will face entrenched competition with

Salesforce snaps up the team who built calendar app Clockwise to work on Agentforce 2026-03-20 at 21:16 By O’Ryan Johnson Just the team, not the tech Salesforce’s Agentforce team is getting an infusion of new talent by hiring the team behind Clockwise, a calendar scheduling app, but the app itself isn’t sticking around.… This article

Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets 2026-03-20 at 21:16 By Trivy, a popular open-source vulnerability scanner maintained by Aqua Security, was compromised a second time within the span of a month to deliver malware that stole sensitive CI/CD secrets. The latest incident impacted GitHub Actions “aquasecurity/trivy-action” and “aquasecurity/setup-trivy,”