Back Ground.News

Checkmarx tackles another TeamPCP intrusion as Jenkins plugin sabotaged

Ground.News • May 11, 2026

TeamPCP has infected the Checkmarx Jenkins AST plugin with malware. CVSS 9.4. Check your plugin version and rotate your secrets immediately.

Cybercrooks ruin engineers’ weekends with Saturday attack This article has been indexed from – Articles Read the original article: Checkmarx tackles another TeamPCP intrusion as Jenkins plugin sabotaged

A malicious version of the plugin was published to the Jenkins Marketplace late last week.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Checkmarx Jenkins Plugin Compromised by TeamPCP Malware Attack Checkmarx reported a malicious version of its Jenkins AST plugin was uploaded to the Jenkins Marketplace on May 9, 2026. This backdoored plugin, which affects security scans in Jenkins CI pipelines, poses a significant risk as it can compromise multiple projects by exploiting trusted infrastructure. Users are advised to verify they are using the correct version (2.0.13-829.vc72453fa_1c16) released on December 17, 2025. The attack is attributed to TeamPCP, which has previously targeted Checkmarx's tools, including its GitHub Actions plugin and KICS static analysis tool. The malware, dubbed Shail-Hulud, has a CVSS score of 9.4, indicating a critical vulnerability. This incident marks the third compromise of Checkmarx's packages in recent months, raising concerns about the company's security practices. Checkmarx is actively working to remove the malicious plugin and has urged users to rotate their secrets immediately. 9 sources 73

Extracted Entities

Checkmarx tackles another TeamPCP intrusion as Jenkins plugin sabotaged

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Companies (1)

MITRE ATT&CK (1)

Platforms (1)