TCP 130: Checkmarx Data Dump, Linux Copy Fail, ShinyHunters Claims and Security Updates
Summary
This weekly roundup covers Checkmarx’s confirmed 96GB data dump linked to credentials from the TeamPCP-attributed Trivy compromise, Copy Fail Linux LPE, ShinyHunters’ claims involving Medtronic and Carnival, and security industry and insurance findings.
Key points
- Checkmarx confirmed that Lapsus$ published a 96GB archive of its data. The article links access to credentials stolen in the Trivy supply-chain compromise attributed to TeamPCP.
- Researchers disclosed Copy Fail, a Linux local privilege escalation involving the shared page cache. The article says it can enable container or tenant boundary crossing and is not remotely exploitable by itself.
- ShinyHunters claimed to have data from Medtronic and Carnival. Medtronic confirmed a corporate IT incident but did not validate the claimed record count; Carnival attributed its incident to phishing of a single user account.
- Google announced new SecOps agents and agent-governance capabilities; Wiz also announced integrations and AI security features across cloud, development and agent platforms.
- Resilience analysis of manufacturing claims from March 2021 to February 2026 attributed 26% of losses to misconfigured MFA and 90% of total loss to ransomware, which represented 12% of claims.
- Amazon described RuleForge, an AI-assisted detection-rule pipeline with separate generation and evaluation models, synthetic testing, honeypot validation and human approval.
Article Details
- Event Type
- Cybersecurity news roundup covering a software supply-chain compromise and data leak, claimed data breaches, a Linux local privilege-escalation vulnerability, and security product announcements.
- Impact
- Checkmarx confirmed that Lapsus$ published a 96GB archive containing source code, employee data, API keys, and database credentials after attackers used credentials stolen in the Trivy supply-chain compromise attributed to TeamPCP. The article also reports ShinyHunters’ breach claims involving Medtronic and Carnival/Holland America; Medtronic did not validate the claimed record count, and Carnival said the incident involved a phished user account while its assessment continued. Copy Fail was disclosed as a local Linux privilege-escalation flaw with a public PoC and potential container and tenant boundary impacts. Separately, Resilience’s manufacturing claims analysis attributed 26% of losses to misconfigured MFA and 90% of total loss to ransomware.
MITRE ATT&CK
T1078 · Valid AccountsAttackers reportedly used credentials stolen in the Trivy compromise to access Checkmarx’s GitHub.T1195.002 · Compromise Software Supply ChainThe Trivy software supply-chain compromise attributed to TeamPCP involved injecting credential-stealing malware into the software, according to the article.
People
Threat Actors
LAPSUS$Published a 96GB archive of Checkmarx data; the article also says it offered Mercor source code for sale in connection with a related compromise.ShinyHuntersClaimed breaches involving Medtronic and Carnival; the article notes that breach details were incomplete and Medtronic had not validated the claimed record count.TeamPCPThe Trivy supply-chain compromise that led to credential theft and subsequent access to Checkmarx was attributed to TeamPCP.
Vendors
Amazoncompromise—and covers new AI-driven security tooling and vendor developments from Google, Wiz, and Amazon.Aqua SecurityLate Feb: TeamPCP compromises Trivy (Aqua Security’s open source vuln scanner)Checkmarxmajor supply-chain and data-exfiltration incidents—most notably Lapsus$ dumping a 96GB archive from Checkmarx via credentials stolen in the TeamPCP/Trivy compromise—and covers new AI-driven security tooling andGooglein the TeamPCP/Trivy compromise—and covers new AI-driven security tooling and vendor developments from Google, Wiz, and Amazon.ResilienceInsurer Resilience data shows misconfigured MFA accounts for 26% of losses while ransomware generates 90% of total loss from 12% of claims, underscoring gaps in controls and visibility.WizTeamPCP/Trivy compromise—and covers new AI-driven security tooling and vendor developments from Google, Wiz, and Amazon.
Products
Bitwarden CLISame campaign also briefly compromised the Bitwarden CLI npm package (@bitwarden/cli 2026.4.0), live for ~90 minutes, hoovering AWS keys, GitHub tokens, and SSH creds.Gemini Enterprise Agent PlatformGoogle Cloud Next announced new SecOps agents, a Gemini Enterprise Agent Platform with agent identity and governance, and broader Wiz integrations across cloud and agent stacks.GitHub ActionsApril 22: Despite cred revocation and outbound blocks, attackers come back and poison the KICS Docker image, two VS Code/Open VSX extensions, and a GitHub Actions workflowGoogle Threat IntelligenceRemote MCP server support hit GA, dark web intel went into preview in Google Threat Intelligence (Google claims 98% accuracy on millions of daily events, take that with the usual grain of salt), and Darktrace, Gigamon,KICSApril 22: Despite cred revocation and outbound blocks, attackers come back and poison the KICS Docker image, two VS Code/Open VSX extensions, and a GitHub Actions workflowLinuxIt also highlights critical vulnerabilities and breaches, including the Copy Fail Linux LPE, ShinyHunters’ claims on Medtronic and Carnival, and insurer data showing misconfigured MFA as a significant loss driver.LiteLLMAI startup Mercor also got pulled in via the related LiteLLM compromise; Lapsus$ offered 4TB including 939GB of Mercor source code for sale.Trivynotably Lapsus$ dumping a 96GB archive from Checkmarx via credentials stolen in the TeamPCP/Trivy compromise—and covers new AI-driven security tooling and vendor developments from Google, Wiz, and Amazon.
Tools
MadPotð¤ Amazon CISO details RuleForge detection-rule pipeline — Bedrock generator agent proposes rules, separate judge model scores sensitivity vs specificity, MadPot honeypots validate before mergeRuleForgeð¤ Amazon CISO details RuleForge detection-rule pipeline — Bedrock generator agent proposes rules, separate judge model scores sensitivity vs specificity, MadPot honeypots validate before merge
Industries
CybersecurityThis issue of The Cybersecurity Pulse summarizes major supply-chain and data-exfiltration incidents—most notably Lapsus$ dumping a 96GB archive from Checkmarx via credentials stolen in the TeamPCP/Trivy compromise—andManufacturingNew analysis from cyber insurer Resilience, drawn from its manufacturing claims portfolio (March 2021 to February 2026) and synthesized with IBM X-Force and KELA data.