Sysdig’s March 2026 Briefing Tracks Rapid Exploitation and TeamPCP Supply-Chain Attacks
Summary
Sysdig's March 2026 briefing reviews rapid exploitation of Pac4j, Ingress-NGINX and Langflow flaws, a TeamPCP-attributed CI/CD supply-chain campaign, botnet takedowns and AI-related leaks, with guidance on runtime monitoring and AI asset inventory.
Key points
- Pac4j CVE-2026-29000 enabled authentication bypass through JWT public-key interpretation; the briefing recommends strict key validation and rotating keys and sessions after patching.
- Ingress-NGINX CVE-2026-3288 enabled RCE through crafted Ingress path fields; the article warns that controllers may have access to secrets and internal services.
- Sysdig's Threat Research Team reported active exploitation of unauthenticated Langflow CVE-2026-33017 within about 20 hours of disclosure, with attackers able to extract keys and credentials through an HTTP request.
- The article attributes a supply-chain campaign to TeamPCP: activity moved from Trivy GitHub Actions to Checkmarx, while LiteLLM and Telnyx packages were also reported hijacked; Databricks and Cisco were investigating possibly linked compromises.
- The briefing says 76 of 77 Trivy GitHub Action version tags were force-pushed to malicious commits in one operation.
- Federal authorities dismantled C2 infrastructure for four DDoS botnets; the article warns that previously infected IoT devices may remain compromised and recommends segmentation and updates.
- The article reports that Anthropic's Mythos model was leaked March 30 and Claude Code source was made public March 31.
Article Details
- Event Type
- March 2026 cybersecurity briefing covering rapid exploitation of public-facing vulnerabilities, a supply-chain campaign attributed to TeamPCP, botnet infrastructure takedowns, and AI-related leaks.
- Impact
- Reported incidents included authentication bypass in Pac4j, remote code execution in Ingress-NGINX and exposed Langflow instances, and theft or exfiltration of credentials and keys. The TeamPCP campaign compromised CI/CD workflows and packages, with potentially linked compromises under investigation. The article also reports public leaks of Anthropic’s Mythos model and Claude Code source code, and warns that previously infected IoT devices may remain vulnerable after botnet infrastructure was dismantled.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe article describes keys and credentials being exfiltrated through HTTP requests after exploitation.T1078 · Valid AccountsThe article associates authentication bypass with Pac4j JWT signature validation weaknesses that allowed access without valid credentials.T1190 · Exploit Public-Facing ApplicationThe article identifies exploitation of public-facing Langflow and Ingress-NGINX services to gain access and achieve remote code execution.T1195 · Supply Chain CompromiseThe article reports that TeamPCP abused a misconfigured GitHub Actions workflow in Trivy and spread credential-stealing activity through other workflows and packages.T1552 · Unsecured CredentialsThe article reports that attackers exfiltrated keys and credentials from exposed Langflow instances and compromised packages.
CVE
CVE-2026-22557Ubiquiti Inc · UniFi Network ApplicationUbiquiti UniFi: CVE-2026-22557 is a maximum-severity vulnerability in Ubiquiti’s UniFi Network Application that was published on March 19.CVE-2026-24512Kubernetes · ingress-nginx[CVE ] referenced vulnerabilities – CVE-2026-29000 (Pac4j authentication bypass), CVE-2026-33017 (Langflow unauthenticated RCE), and other CVEs like CVE-2026-3288 and CVE-2026-24512.CVE-2026-29000pac4j · pac4j-jwtCritical JWT signature validation flaw in Pac4j (CVE-2026-29000) allowed authentication bypass by manipulating public-key interpretation.CVE-2026-3288Kubernetes · ingress-nginxIngressâNGINX configuration injection (CVE-2026-3288) enabled remote code execution via crafted Ingress path fields, exposing secrets and internal services.CVE-2026-33017langflow-ai · langflowLangflow (CVE-2026-33017) was exploited for unauthenticated RCE and key/credential exfiltration within ~20 hours of disclosure.
People
Threat Actors
Vendors
AnthropicAnthropic’s Mythos model and Claude Code source were leaked, increasing risk for AI-driven attack/defense escalation.Checkmarxattributed to TeamPCP abused GitHub Actions to spread credentialâstealing backdoors across Trivy, Checkmarx, PyPI packages, and more, highlighting the need for runtime detection and AIâinfrastructureCiscoPyPI’s LiteLLM and Telnyx were also hijacked within a week of the original breach, and as of March 31, Databricks and Cisco were also investigating possibly linked compromises.DatabricksPyPI’s LiteLLM and Telnyx were also hijacked within a week of the original breach, and as of March 31, Databricks and Cisco were also investigating possibly linked compromises.GitHubA supplyâchain campaign attributed to TeamPCP abused GitHub Actions to spread credentialâstealing backdoors across Trivy, Checkmarx, PyPI packages, and more, highlighting the need for runtime detection andSysdigSysdig’s March security briefing provides the receipts: vulnerabilities are being weaponized in real time, and if you aren’t watching your back(end), someone else probably is.TelnyxPyPI’s LiteLLM and Telnyx were also hijacked within a week of the original breach, and as of March 31, Databricks and Cisco were also investigating possibly linked compromises.UbiquitiUbiquiti UniFi: CVE-2026-22557 is a maximum-severity vulnerability in Ubiquiti’s UniFi Network Application that was published on March 19.
Products
Claude CodeAnthropic’s Mythos model and Claude Code source were leaked, increasing risk for AI-driven attack/defense escalation.GitHub ActionsA supplyâchain campaign attributed to TeamPCP abused GitHub Actions to spread credentialâstealing backdoors across Trivy, Checkmarx, PyPI packages, and more, highlighting the need for runtime detection andIngress-NGINXMar 9: Ingress-NGINX RCE CVE-2026-3288Langflowof public-facing services and AI infrastructure—critical flaws in Pac4j, IngressâNGINX, and Langflow enabled authentication bypasses and unauthenticated RCE that were weaponized within hours.LiteLLMTeamPCP executed a fast-moving supply chain campaign by compromising GitHub Actions in Trivy, then spreading identical credentialâstealing activity to Checkmarx, PyPI packages (LiteLLM), and other vendors.MythosAnthropic’s Mythos model and Claude Code source were leaked, increasing risk for AI-driven attack/defense escalation.Pac4jsaw rapid, machine-speed exploitation of public-facing services and AI infrastructure—critical flaws in Pac4j, IngressâNGINX, and Langflow enabled authentication bypasses and unauthenticated RCE that wereSysdig SecureThe team built four high-confidence Falco detections for Sysdig Secure users, but the blog is an important asset for anyone to read who is looking to secure Claude Code or otherwise.Trivycampaign attributed to TeamPCP abused GitHub Actions to spread credentialâstealing backdoors across Trivy, Checkmarx, PyPI packages, and more, highlighting the need for runtime detection and AIâinfrastructureUniFi Network ApplicationUbiquiti UniFi: CVE-2026-22557 is a maximum-severity vulnerability in Ubiquiti’s UniFi Network Application that was published on March 19.