Sunday 26 July 2026 11:22:30 GMT+02:00
Netcrook
#Jenkins AST
The Jenkins Plugin That Turned a Safety Net Into a Supply-Chain Risk
A rogue release in a CI/CD security plugin shows why build systems now have to trust their tools less, not more.
Trusted Plugins, Untrusted Payloads: The Jenkins Supply-Chain Trap Hiding in Plain Sight
A reported campaign around the Checkmarx Jenkins AST Plugin shows how security tooling itself can become a high-value target inside DevSecOps pipelines.
When a Trusted Plugin Turns Suspicious: Jenkins’ Update Path Under the Microscope
Checkmarx confirmed a modified version of its Jenkins AST plugin was published through the Jenkins distribution path, a reminder that software trust chains are as valuable to attackers as the code they deliver.
A Poisoned Plugin in the Build Chain Turns CI Trust Inside Out
A malicious Checkmarx Jenkins AST Plugin release shows how a security tool can become part of the attack path when software distribution itself is tampered with.