Security advisories

Security advisories highlight significant security-related developments or major events to raise awareness of issues that may be relevant to users or services.

May 2026

Stricter Nexus IQ policy enforcement against supply chain attacks

Posted on: 22 May ‘26 / Updated on: NA
Status: Upcoming change (effective 03 June 2026)

In response to recent software supply chain attacks targeting newly published packages, SHIP-HATS is strengthening Nexus IQ policy enforcement. From 03 June 2026:

The following updates will take effect on 03 June 2026.

What is changing

1. Newly Published Packages Will Be Blocked

• The “Age < 7 days” constraint will be enabled and the policy action will be set to Fail.
• Any dependency or component that is less than seven days old will be blocked during evaluation.
• Builds or applications using these components will fail policy evaluation until the component exceeds the seven-day threshold. This will particularly affect pipelines that update dependencies using unpinned versions or the latest tag.

2. Integrity Rating Violations Will Now Fail

• The policy action for Integrity Rating violations will be upgraded from Warn to Fail.
• Applications and components that violate the Integrity Rating policy will now fail evaluation instead of generating a warning.
• CI/CD pipelines integrated with Nexus IQ will fail if these violations are not addressed.

What you should do before 03 June

To minimise disruption to your pipelines, please take the following steps ahead of the enforcement date:

• Audit your existing dependencies: Review your pipelines and identify any components that are currently less than seven days old or are already generating Integrity Rating warnings. These are the components most likely to cause failures on 03 June.
• Resolve existing Integrity Rating warnings: Since warnings will become failures, any component currently flagging an Integrity Rating warning should be investigated and remediated before the cutover.
• Run a dry run in a non-production environment: Where possible, test your pipelines against the updated policy settings before 03 June to surface any issues early.
• Pin your dependency versions: Replace any unpinned, floating, or latest tags with fixed versions. This improves build reproducibility and reduces the risk of consuming newly published or compromised packages.
• Raise a support ticket early: If you are unsure about any of your dependencies or need help assessing the impact on your applications, raise a support ticket now rather than waiting until the enforcement date.

What to expect after 03 June 2026

After the changes take effect, you may experience pipeline failures during dependency scans for components that previously only generated Integrity Rating warnings, as well as blocked builds for any recently published packages pulled into your pipelines.

If you have questions or require assistance, raise a support ticket.

March 2026

Trivy supply chain advisory

Posted on: 24 March ‘26 / Updated on: 25 March ‘26
Status: Monitoring

A publicly reported supply chain security issue affecting Trivy, a widely used scanning tool, was disclosed between 19 March and 22 March 2026.

Several Trivy releases and related GitHub Actions were identified as compromised. Users who utilise Trivy in CI/CD workflows should review their configurations and update to trusted releases.

Affected versions

Action required

1. Update workflows to use trusted releases of the following components and explicitly specify a known safe Trivy version (for example, v0.69.3 or later trusted releases):

   • aquasecurity/trivy-action
   • aquasecurity/setup-trivy
   • Trivy binary or container images

2. If affected versions were used between 19 March and 23 March 2026, rotate the credentials and review your activity logs.

References

• https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/
• https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise
• https://socket.dev/blog/trivy-docker-images-compromised