April 2026 Summaries

On April 30, 2026, two malicious versions of the popular PyPI package "lightning," affecting the deep learning framework previously known as pytorch-lightning, were released, containing hidden code that downloads and executes a credential-stealing payload using the Bun JavaScript runtime. These compromised versions, 2.6.2 and 2.6.3, were identified by the security company Snyk, which rated the threat as critical with a CVSS score of 9.3. The attack represents a compromise of a legitimate package, with the hidden payload designed to harvest credentials and manipulate repositories without altering the visible API, to maintain the package's usability until discovery. The incident follows a similar pattern to previous exploits involving Bun-based payloads, indicating likely reuse of attacker tooling across different ecosystems. PyPI has quarantined the affected project, and Snyk has provided guidance on mitigating exposure, highlighting the need for improved security measures in package publishing, such as trusted-publisher bindings and manual approval processes, to prevent future supply chain attacks.

On April 29, 2026, a supply chain attack compromised four npm packages in the SAP development ecosystem by publishing malicious versions of mbt, @cap-js/db-service, @cap-js/sqlite, and @cap-js/postgres, which contained an obfuscated credential-stealing payload. The attack exploited the npm publish workflow's lack of manual approval, using a preinstall hook to execute a Bun-based JavaScript runtime that harvested credentials and created dead-drop repositories on GitHub, tagged with "A Mini Shai-Hulud has Appeared." Despite the worm-like potential for self-propagation, evidence suggests the attack was limited to the initially affected packages. SAP responded by publishing clean versions of the compromised packages, while Snyk issued advisories and flagged the affected releases. The incident highlights the importance of gating npm publish permissions and auditing for indicators of compromise, such as unexpected GitHub repositories and injected workflow files, to prevent similar attacks in the future.

Modern development teams face challenges with security debt, often caught in a manual "find and fix" cycle that slows innovation and results in ignored tasks and a disconnect between security and development progress. A new integration between Snyk and Atlassian aims to transform this process into an autonomous background function, shifting from DevSecOps to agentic security. This collaboration introduces Snyk Studio, which offers AI-driven workflows and studio-recipes that allow developers to autonomously remediate vulnerabilities without leaving their primary workspace. By integrating with Jira, developers can use an Agentic Development Environment (ADE) to automatically gather context and implement precise fixes through AI agents, drastically reducing mean time to resolution (MTTR) and minimizing context switching. This automation not only enhances fix accuracy by leveraging Jira metadata with Snyk's security intelligence but also frees senior developers from routine security tasks to focus on feature engineering, with these capabilities available immediately for teams to adopt.

CVE-2026-40478 highlights a significant server-side template injection vulnerability in Thymeleaf, a Java-based templating engine used for server-side webpage rendering, with a high CVSS score of 9.1, potentially leading to remote code execution if exploited. This vulnerability allows bypassing Thymeleaf's security sandbox via a tab character, but it only becomes a threat if the code improperly allows user input to directly interact with the expression engine, which signifies a misuse of the framework. Developers are advised to patch to Thymeleaf 3.1.4 or later, regardless of their perceived risk, and to audit their use of dynamic templates or view names constructed from user data. Ensuring that user input is correctly handled and static within templates is crucial to maintaining security. Additionally, developers should scan dependencies and monitor them with tools like Snyk to prevent similar vulnerabilities.

In February 2026, Qinglong, a popular open-source task management platform mainly used by Chinese developers, was exploited for cryptomining due to two authentication bypass vulnerabilities, allowing attackers to run unauthorized code on users' servers. These vulnerabilities, which included issues with URL rewriting and case-sensitive path matching, were formally reported on February 27, 2026. However, users had noticed unusual CPU spikes weeks earlier due to the .fullgc cryptominer, which was injected into Qinglong's configuration files to run persistently in the background. The vulnerabilities were addressed by prioritizing fixes to the authentication layer, emphasizing the importance of addressing root causes over merely blocking attack payloads. This incident underscores the necessity of rigorous security practices for self-hosted applications, such as monitoring for unusual resource usage, ensuring effective authentication, and maintaining up-to-date software to mitigate potential vulnerabilities.

The Python package "elementary-data," a widely used dbt-native data observability tool, experienced a critical supply chain security breach via a GitHub Actions attack vector. The attack leveraged a script injection flaw in the GitHub Actions workflow to publish a malicious version (0.23.3) of the package on PyPI, which included credential-stealing malware. The malware, embedded in a .pth file, activated upon Python interpreter startup, harvesting a wide range of credentials and exfiltrating them to a command-and-control server. The breach, active for approximately eight to ten hours before the package was removed, affected users who installed or updated to the compromised version or used the related Docker image in their CI/CD pipelines. The incident highlighted the vulnerability of GitHub Actions workflows to injection attacks and underscored the importance of securing supply chains by employing best practices such as using short-lived tokens and implementing workflow hardening measures. The Elementary team promptly addressed the issue by removing the malicious package and releasing a clean version (0.23.4), demonstrating a swift response to the security incident.

Snyk's latest innovation, Snyk Agent Fix, marks a shift in security from merely identifying issues to effectively fixing them, utilizing a developer-first approach that integrates AI with Snyk's extensive security intelligence. This evolution, set for release on May 26th, 2026, includes a move from static fine-tuning to dynamic few-shot prompting, enhancing the system's ability to provide real-time security guidance across all Snyk Code-supported languages. By benchmarking against rigorous security integrity, functional logic, and real-world golden tests, Snyk ensures that its models deliver secure and usable code fixes. The integration of Snyk's proprietary database of vulnerabilities with leading LLMs significantly outperforms previous models, achieving a 14.48% increase in evaluation pass rates, and introducing agentic retries to refine insecure outputs. This new dynamic approach allows Snyk to scale language support efficiently, offering comprehensive remediation capabilities across various programming languages, and positions Snyk at the forefront of automatic security debt management within development workflows.

In the evolving landscape of software development, the rise of AI and cloud-native approaches has amplified the problem of "secret sprawl," where sensitive credentials like API keys and passwords are inadvertently distributed across various platforms, creating significant security risks. As AI agents autonomously execute workflows and generate secrets, traditional security measures struggle to keep up with the speed and complexity of these developments, leading to challenges such as alert fatigue, lack of visibility, and costly reactive remediation. Snyk addresses these issues through its integrated platform, Snyk Secrets, which aims to provide total visibility and proactive prevention by employing AI-driven high-precision detection, shifting security measures left to prevent leaks before they occur, and offering unified governance and reporting capabilities. By embedding security into the development process, Snyk helps organizations manage risks associated with AI-generated code, ensuring that sensitive data remains secure while enabling developers to operate efficiently in this new era of agentic development.

JPMorganChase's Global Technology Leadership released a directive titled "Fortifying the enterprise: 10 actions to take now for AI-ready cyber resilience" on April 17, 2026, emphasizing the urgency for large enterprises to adapt their cybersecurity strategies in light of AI's accelerating impact on threat landscapes. The directive outlines ten key actions aimed at enhancing cyber resilience, with Snyk's platform addressing eight of them directly within the developer workflow, while the remaining actions involve network and identity controls beyond Snyk's scope. The document highlights the narrowing window between vulnerability discovery and exploitation due to AI, urging enterprises to shift from quarterly scans to continuous, automated security processes. This shift is crucial as AI systems are increasingly used in coding, leading to a rise in security issues entering codebases, which traditional manual triage cannot keep up with. The directive is positioned as a preview of impending regulatory requirements, underscoring the need for enterprises to operationalize these actions quickly, with Snyk offering a phased approach to achieve this within 90 days.

Anthropic's recent launch of Glasswing and Claude Mythos underscores the dual-edged nature of AI in security, where increased capability uncovers long-hidden vulnerabilities but also introduces new risks. While AI systems like Mythos can autonomously detect and exploit software flaws at unprecedented speed, this advancement highlights the urgent need for control mechanisms that ensure governance and prioritize risk management over mere detection. The tension between discovery and control is evident, as AI-generated code accelerates production, potentially expanding attack surfaces and complicating governance. The security landscape is evolving from a focus on finding risks to controlling them, with governance becoming a critical component in managing systemic risk as AI becomes more integrated into enterprise operations. Organizations must adapt by developing a robust control framework that combines AI capabilities with human expertise to ensure consistent policy enforcement, verified remediation, and rapid incident response, thereby turning AI into a strategic advantage rather than a liability. As Anthropic and others signal, the future of security will be defined by how well risk is controlled, making governance an essential aspect of AI deployment in production environments.

Snyk has announced the general availability of Container Registry Sync and several enhancements to its container security platform, fulfilling its vision for scalable, developer-first security in the AI-driven container lifecycle. The new features include automated monitoring and management of container registry images, reducing manual effort and alert fatigue by focusing on active code and live containers. The platform also introduces a unified experience for visualizing and managing container images, extending visibility and risk prioritization by integrating third-party runtime signals. These enhancements are supported by architectural improvements and expanded ecosystem support, including hardened base images and broader OS distribution coverage. As AI-generated software accelerates, Snyk's updates aim to provide scalable security that aligns with AI advancements, ensuring security governance remains robust and manageable.

A recent incident involving LiteLLM, a widely used open-source package in the AI ecosystem, highlighted the complexities of modern AI systems and the limitations of traditional security measures. LiteLLM, a model gateway facilitating communication with over 100 LLM providers, was compromised with credential-stealing malware, affecting numerous downstream users, including AI recruiting startup Mercor, which suffered large-scale data exfiltration. This event underscores that the risk in AI systems often extends beyond a vulnerable dependency to encompass the entire execution path and the interconnections it facilitates. The compromised LiteLLM demonstrated that understanding AI system behavior requires visibility into how dependencies interact with model providers, tools, and agent workflows, a gap that traditional Software Composition Analysis (SCA) tools may not fully address. Evo AI-SPM is proposed as a solution to provide a comprehensive view of AI systems by mapping dependencies, identifying model gateways, and revealing the broader context of how AI components are utilized, thus enabling more effective governance and risk management.

In 2025, a transformative journey began with the development of Evo, an agentic orchestrator for AI security, aiming to help companies innovate while securing their AI systems. The initiative addressed critical issues like AI sprawl, shadow AI, and the necessity of visibility for security, using Evo's Discovery Agent to reveal the extent of AI models and services in operation. As organizations increasingly rely on custom AI solutions, traditional detection methods prove inadequate, prompting the creation of Custom Discovery to tailor detection to specific customer needs. Evo introduced standardized, automatically-enforced policies for scalable AI governance, shifting from ad hoc reviews to systematic risk prioritization. The Risk Intelligence Agent was developed to provide actionable risk insights, addressing novel challenges in AI model vulnerabilities without existing standards like CVE/CVSS. The initiative emphasized continuous discovery, real-time risk intelligence, and enforceable policies as the future of AI security, underscoring the importance of building solutions collaboratively with customers to navigate this evolving landscape.