📰 Continuing coverage: OpenAI confirms TanStack supply chain attack hit two employee Macs

Checkmarx confirmed that a malicious update for its Jenkins AST plugin made it to the Jenkins Marketplace over the weekend. The company urged users to check their plugin versions right away, warning that any installation of the fake update could let attackers run arbitrary code on Jenkins servers. The affected version, 2.0.13-829.vc72453fa_01c16, was pushed without Checkmarx’s approval and includes code that isn’t in the legitimate release. Users who installed it should uninstall it immediately and switch to the verified version released on December 17, 2025, or earlier. Checkmarx didn’t say how many users downloaded the malicious update, but Jenkins admins should treat this as an active threat until they confirm their systems are clean.

The attack comes weeks after hackers breached KICS, a rival static analysis tool, and used its supply chain to push malicious updates to thousands of users. Unlike KICS, where attackers gained direct access to the vendor’s build pipeline, the Jenkins plugin compromise appears to have been a fake update uploaded to the public marketplace. Still, the pattern shows attackers are targeting open-source CI/CD tools to spread malware through trusted channels. Jenkins is one of the most widely used automation servers, so a successful breach could give attackers a foothold in countless development pipelines.

Jenkins Marketplace compromised again

This isn’t the first time attackers have abused the Jenkins Marketplace. In 2023, researchers found over 100 malicious plugins uploaded to the platform, some of which stole credentials or mined cryptocurrency. Jenkins Marketplace relies on community contributions, so security checks aren’t as strict as they are for official vendor channels. Users often trust plugins from the marketplace without verifying signatures or hashes, making it an attractive target for supply chain attacks. Checkmarx’s advice to stick to version 2.0.13-829.vc72453fa_1c16 is a reminder that even trusted vendors can be tricked into publishing bad updates.

What users should do now

Jenkins administrators need to act fast. First, check the plugin manager to see which version is installed. If it’s 2.0.13-829.vc72453fa_01c16 or anything labeled “Checkmarx Jenkins AST Plugin” without a verified signature, remove it immediately. Then install the correct version from Checkmarx’s official site or a trusted source. Jenkins also lets admins block specific plugin versions, so restricting installations to signed releases could prevent future attacks. Companies should scan their Jenkins servers for signs of compromise, like unexpected network traffic or new admin accounts, just in case the malicious plugin was active long enough to do damage.

Checkmarx says it’s working with Jenkins maintainers to tighten controls on the marketplace, but for now, users are on their own. The company hasn’t disclosed how the fake update got past its checks, but supply chain attacks like this one often start with stolen credentials or a compromised developer’s machine. Jenkins isn’t the only target—last month, attackers pushed a malicious VS Code extension through Microsoft’s extension store, showing how attackers are exploiting every corner of the dev tool ecosystem.

The broader risk here isn’t just bad code running on a server. If an attacker can control a Jenkins pipeline, they can steal source code, inject backdoors, or pivot to other systems inside a company’s network. Small teams that rely on free plugins from public stores are especially vulnerable because they often lack the resources to vet every update. Checkmarx’s warning is a wake-up call: even tools you trust can be weaponized, and the only way to stay safe is to verify everything yourself.

What You Need to Know

  • Source: The Hacker News
  • Published: May 11, 2026 at 18:30 UTC
  • Category: Security
  • Topics: #hackernews · #security · #vulnerabilities · #cybersecurity · #team · #compromises-checkmarx-jenkins

Read the Full Story

This is a curated summary. For the complete article, original data, quotes and full analysis:

Read the full story on The Hacker News →

All reporting rights belong to the respective author(s) at The Hacker News. GlobalBR News summarizes publicly available content to help readers discover the most relevant global news.

Curated by GlobalBR News · May 11, 2026

🇧🇷 Resumo em Português

Um plugin essencial para o desenvolvimento seguro de software no Brasil foi infectado por hackers semanas depois de outra grave brecha de segurança na cadeia de suprimentos. A Checkmarx, empresa especializada em segurança de aplicações, confirmou que uma versão maliciosa do seu plugin Jenkins AST foi injetada no mercado oficial da plataforma, colocando em risco empresas e desenvolvedores que dependem da ferramenta para identificar vulnerabilidades no código.

O ataque ocorreu semanas após a própria Checkmarx ter sido vítima de um supply chain attack por meio da ferramenta KICS, o que demonstra como os cibercriminosos estão explorando cadeias de suprimentos de segurança para distribuir malwares. No Brasil, onde o desenvolvimento de software tem crescido exponencialmente, especialmente em setores como fintechs e govtech, a notícia acende um alerta vermelho: milhares de organizações podem estar usando a versão comprometida sem saber, expondo seus sistemas a ataques ainda mais graves. A recomendação é imediata: verificar a versão instalada do plugin e, se necessário, removê-lo e substituí-lo pela versão oficial.

O episódio reforça a necessidade de auditorias constantes em ferramentas de segurança e uma revisão urgente nos protocolos de validação de atualizações por parte das empresas brasileiras.