A security scanner trusted by developers worldwide to find vulnerabilities in their infrastructure code was itself compromised. Twice. In 35 days. The attacker was not just stealing credentials. The tool was generating your scan reports and sending them out the back door.
Itron, the Liberty Lake, Washington company whose smart meters sit inside the electric, gas, and water infrastructure of cities across America, disclosed on Friday that an unauthorized third party accessed its internal systems on April 13. The company filed an SEC 8-K, activated its incident response plan, engaged external advisors, and notified law enforcement.
On the surface, the disclosure reads as controlled. Operations continued. Customer-hosted systems were unaffected. Insurance is expected to cover a significant portion of costs. But read between the lines of the filing and the picture is more troubling: the company is still "evaluating what legal filings and regulatory notifications might be required." That language signals the scope of any data exposure is not yet fully understood.
The attacker did not break into your environment. You invited them in. You ran their Docker image. You trusted their scanner. And while it was looking for your vulnerabilities, it was documenting them for someone else.
Itron's products include smart meters, sensors, and management software used by utilities and municipal governments. Its devices are embedded in the operational backbone of how American cities manage power and water. A persistent attacker inside those corporate systems is one degree of separation from understanding exactly how that infrastructure is mapped, managed, and monetized.
No threat actor has claimed responsibility. TechCrunch noted the company declined to comment on who notified them of the intrusion. That is an unusual gap that suggests the detection may have been external, not internal. As of this writing, the investigation remains open.
The Friday SEC filing is your first signal. Organizations disclose on Fridays when they hope the news cycle absorbs it quietly. The fact that no attacker has claimed this breach yet. Itron also declined to say who tipped them off. Both gaps suggest this may be an espionage play, not a ransom play. Espionage actors don't wave flags. Your question this week: does your vendor ecosystem include any OT-adjacent infrastructure suppliers? If yes, this is your trigger to review third-party access logs.
Bitwarden confirmed that @bitwarden/cli@2026.4.0 was compromised via the Checkmarx supply chain attack. The malicious package was live on npm for 93 minutes on April 22. The malware harvested GitHub tokens, npm tokens, SSH keys, and .env files, then used stolen tokens to inject malicious Actions workflows into any CI/CD pipeline it could reach.
Vercel confirmed that initial access came via an employee who installed the Context.ai browser extension and signed into it using their enterprise Google account. The extension embedded a hidden OAuth grant giving read access to Google Drive. The attacker used that access to burrow into Vercel's internal systems. Mandiant is now engaged. A ransom demand of $2 million was reported.
Microsoft revised its Patch Tuesday advisory to confirm that CVE-2026-32202, a Windows Shell spoofing vulnerability, has been actively exploited in the wild. The flaw allows an attacker who gets a victim to open a malicious file to access sensitive information across the network. It was patched this month but active exploitation confirms attackers moved faster than update cycles.