On March 19, 2026, a threat actor group known as TeamPCP executed one of the most significant software supply chain attacks of the year - compromising Aqua Security's Trivy vulnerability scanner, an open-source tool trusted by thousands of organizations worldwide to secure their CI/CD pipelines. The irony is unmistakable: a security tool designed to find vulnerabilities became the very weapon used to steal credentials, secrets, and cryptographic keys from the pipelines it was