Trellix Suffers Supply Chain Breach

A threat actor recently gained unauthorized access to a portion of Trellix's source code repository, with the company stating that its investigation has found no evidence that its source code release or distribution process was affected. The breach occurred in May 2026 and is believed to be related to supply chain attacks, similar to recent incidents involving TeamPCP, which compromised Trivy and KICS in March. No threat actor has claimed credit for the attack, but it highlights growing concerns about security vendors' source code being exploited by nation-state actors or other groups. The attackers may have gained read-only access to part of the repository, raising concerns among downstream customers who rely on Trellix's products; however, there is currently no indication that they also obtained CI/CD access, signing keys, package publishing credentials, etc., which could allow them to modify what gets shipped to end users.