Supply Chain Attacks and Critical Zero-Days Rattle Global Infrastructure

Meta has halted its partnership with AI data contracting startup Mercor following the LiteLLM supply chain attack. The breach, attributed to TeamPCP, exposed highly sensitive and proprietary AI training data and methodologies belonging to Mercor's high-profile clients, including Meta, OpenAI, and Anthropic. This development significantly escalates the incident's impact, highlighting critical security vulnerabilities within the AI supply chain and causing major financial and reputational damage to Mercor.

Cisco has issued a broader security advisory, now encompassing critical vulnerabilities in its Integrated Management Controller (IMC) in addition to Smart Software Manager On-Prem (SSM On-Prem). The new advisory covers a wider range of affected products, including UCS servers and Catalyst Edge uCPE devices. These flaws allow unauthenticated remote attackers to bypass authentication, escalate privileges, and execute arbitrary commands, leading to full system compromise. While no active exploitation is known, immediate patching is urged due to the expanded scope and critical nature of these vulnerabilities across Cisco's enterprise hardware.

The European Commission data breach update reveals that the Trivy scanner was compromised through its GitHub CI/CD pipeline. Attackers exfiltrated 92 GB of compressed data, which is now confirmed to be 340 GB uncompressed. The notorious ShinyHunters group publicly leaked the data on March 28, 2026. The breach impacts up to 71 EU entities, including 42 internal Commission clients and 29 other EU bodies. Additional MITRE ATT&CK techniques for persistence and exfiltration have also been identified.

New information reveals the Hims & Hers data breach was executed by the notorious ShinyHunters extortion group. The attackers gained unauthorized access to the company's Zendesk instance by compromising an Okta single sign-on (SSO) account, leveraging techniques such as Valid Accounts (T1078) and potentially SAML Evasion (T1606.002). The incident, which occurred between February 4-7, 2026, involved the exfiltration of customer support tickets containing names, contact information, and support request details. Hims & Hers confirmed medical records were not compromised and is offering 12 months of credit monitoring to affected individuals. This update provides crucial attribution and technical specifics on the initial access.