company
Communications platform whose software package was named among the March 2026 TeamPCP supply-chain compromises.
Nick Khami's Call4me lets Claude Code, Codex and other MCP agents phone businesses for $0.25 a minute of talk time. Its sample calls show the agent changing real bookings for a user, who still has to check what each business actually agreed to.
Reality
An operator's log of four rotations across two self-hosted n8n instances puts every failure in a consumer copy, a derived URL token, or a hardcoded header, and none of the three tripped an alert.
Reality
Two suspects in Western Australia are in custody over the supply-chain worm that hit Trivy, KICS, LiteLLM and Telnyx. The 500,000 credentials it harvested stay valid until someone rotates them. Only 78,000 have surfaced publicly.
Reality
Unit 42 says the group backdoored Trivy, KICS, LiteLLM and Telnyx's Python SDK, tools that run inside CI with the privileges needed to reach production secrets, which is also why the headline counts deserve a slow read.
Reality
Check Point Research says a nonce bug in every public VECT build leaves files above 131,072 bytes unrecoverable, by the attacker as well. That turns extortion into destruction.
Reality