TLDR Tech / IT
Checkmarx Jenkins plugin compromised in new supply chain attack
The Checkmarx Jenkins AST plugin version 2026.5.09 is compromised by TeamPCP, carrying a 9.4 CVSS score (CVE-2026-33634). Attackers targeted cloud credentials and SSH keys. Users must immediately downgrade to version 2.0.13-829.vc72453fa_1c16 and rotate all exposed secrets to mitigate potential unauthorized access to enterprise environments.
Read the full story