Malware Attack Targets Checkmarx: Jenkins Plugin Compromised
On May 11, 2026, Checkmarx confirmed a troubling security incident involving a compromised version of its Jenkins AST plugin, published on the Jenkins Marketplace. This breach is linked to the notorious cybercrime group TeamPCP, which has been active in a series of supply chain attacks.
The malicious plugin version, released after a previous compromise earlier this year, potentially affects countless developers who rely on Checkmarx tools. Users are urged to ensure they are utilizing version 2.0.13-829, released on December 17, 2025, or earlier, to avoid exploitation.
The impact of this attack could be significant, leading to unauthorized access to sensitive developer secrets. To protect against such threats, users should regularly update their software and monitor for unusual activities.
Given the nature and frequency of these attacks, the risk level is categorized as High. Stay vigilant and prioritize cybersecurity hygiene to mitigate potential risks.
Source: View Original Report
