CheckMarx Jenkins Hit ⚙️, OpenAI Daybreak 🤖, Best Western Breached 🏨

Q: TeamPCP compromised CheckMarx's Jenkins AST plugin by injecting a rogue version (2026.5.09) using cr

TeamPCP compromised CheckMarx's Jenkins AST plugin by injecting a rogue version (2026.5.09) using credentials stolen in a prior Trivy breach that were never rotated — users should roll back to version 2.0.13-829.

Q: A Shai-Hulud npm worm hit 42 @tanstack/* packages via GitHub Actions cache poisoning and OIDC token

A Shai-Hulud npm worm hit 42 @tanstack/* packages via GitHub Actions cache poisoning and OIDC token theft, harvesting AWS, GCP, Kubernetes, and SSH credentials and using GitHub's commit search as a P2P C2 channel.

Q: BWH Hotels (Best Western parent) suffered a 6-month breach of its reservation system exposing guest

BWH Hotels (Best Western parent) suffered a 6-month breach of its reservation system exposing guest names, addresses, and stay dates — affected guests should treat all inbound booking-related communications as likely phishing.

TLDR·Wednesday, May 13, 2026·8 min read

Security AI/ML Engineering

Share𝕏 in

AI Summary

This cybersecurity newsletter covers a supply-chain attack on CheckMarx's Jenkins plugin by TeamPCP, a Shai-Hulud npm worm that compromised 42 @tanstack/* packages via GitHub Actions cache poisoning and OIDC token theft, and a months-long breach of BWH Hotels' reservation system. It also highlights Google's threat intelligence on AI-assisted adversarial operations, OpenAI's new Daybreak cybersecurity program, and new open-source defensive tooling.

Key Facts

✓TeamPCP compromised CheckMarx's Jenkins AST plugin by injecting a rogue version (2026.5.09) using credentials stolen in a prior Trivy breach that were never rotated — users should roll back to version 2.0.13-829.

✓A Shai-Hulud npm worm hit 42 @tanstack/* packages via GitHub Actions cache poisoning and OIDC token theft, harvesting AWS, GCP, Kubernetes, and SSH credentials and using GitHub's commit search as a P2P C2 channel.

✓BWH Hotels (Best Western parent) suffered a 6-month breach of its reservation system exposing guest names, addresses, and stay dates — affected guests should treat all inbound booking-related communications as likely phishing.

Author Takes

SkepticalTLDR InfoSec

AI code scanning tools

Mythos's lighter haul on curl reflects diminishing returns on a heavily fuzzed codebase, and AI tools still only surface known bug classes — not novel ones; practitioners should discount 'dangerously good' vendor framing until independent results land.

NeutralTLDR InfoSec

AI code analyzers as baseline security

AI code analyzers are now table-stakes — any project that hasn't run one likely has a backlog of findings waiting — but must be paired with traditional defenses.

More from TLDR

Claude small business 💼, Anthropic CFO interview 💰, AI adoption data 📊

Anthropic launched Claude for Small Business with integrations into QuickBooks, PayPal, HubSpot, and Microsoft 365, and surpassed OpenAI in business a

May 14

Foxconn Ransomware Hit 🏭, Android Spyware Logging 📱, Open Defense Initiative 🛡️

This edition covers Foxconn's ransomware attack by the Nitrogen gang who claim to have stolen 8TB of data from major tech clients, a new Android intru

May 14

Autonomous Enterprise Arrives 🤖, Wi-Fi Getting Smarter 📶, AI Tool Sprawl 😵

SAP launched an 'Autonomous Enterprise' framework using specialized AI agents across finance, supply chain, and HR, backed by a €100M partner fund and

May 14