InfoSecBulletin Cybersecurity for mankind
Trellix reported a security flaw that impacted part of its source code repository, but the company states there is no evidence of code being used wrongly. It quickly started a probe with experts and informed the law enforcement agency.
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
“Trellix recently identified unauthorized access to a portion of our source code repository. Upon learning of this matter, we immediately began working with leading forensic experts to resolve it. We have also notified law enforcement.” reads the update published by the security firm. “Based on our investigation to date, we have found no evidence that our source code release or distribution process was affected, or that our source code has been exploited. As part of our commitment to our broader security community, we intend to share further details as appropriate once our investigation is complete.”
The company did not say who did the attack or how he did it. It is not clear how long the attackers had access to the repository.
Unauthorized access to a part of a source code can reveal important details, APIs, or passwords. Attackers might look at the code to find weaknesses, create attacks, or plan specific strikes. This can also result in stolen ideas, damage to reputation, and risks to the supply chain if changed code is shared with customers or partners.
Source code repositories are main targets for attackers who want to find weak spots, insert backdoors, or carry out supply chain attacks on customers.
The event is like other big code hacks that hit Microsoft, Okta, and LastPass in the last few years. Trellix has pledged transparency, stating it intends to share further technical details with the broader security community once its investigation concludes.
