On May 9, 2026, a backdoored version of the Checkmarx Jenkins Application Security Testing (AST) plugin appeared on the official Jenkins Marketplace — not from Checkmarx's release pipeline, but from TeamPCP, the same threat actor that compromised Checkmarx's KICS Docker image and VS Code extensions weeks earlier. Assigned CVE-2026-33634 with a CVSS score of 9.4, this incident turns a trusted security scanning tool into a credential-harvesting weapon inside CI/CD pipelines.

How the Attack Unfolded

Between 01:25 UTC on May 9 and 08:47 UTC on May 10, rogue plugin version 2026.5.09 sat on repo.jenkins-ci.org available for download. Any Jenkins instance configured to auto-update — or any engineer who manually pulled the latest — received code that silently exfiltrated environment variables, API tokens, and build secrets to an external endpoint controlled by TeamPCP. The malicious payload referenced domains including checkmarx.zone and downloaded a secondary archive (tpcp.tar.gz) to extend its foothold within the build environment.

This was not an isolated move. TeamPCP had already demonstrated a persistent interest in Checkmarx's ecosystem: their earlier compromise injected credential-stealing malware into the KICS Docker image used for Infrastructure-as-Code scanning, two VS Code extensions, and a GitHub Actions workflow. The Jenkins plugin attack represents an escalation — targeting the CI server itself rather than peripheral developer tools.

CVE-2026-33634: Technical Breakdown

The vulnerability stems from insufficient integrity verification in the Jenkins plugin distribution chain. TeamPCP exploited maintainer access — likely obtained through credential theft or token compromise — to push an out-of-band release that bypassed Checkmarx's internal build and signing process. Once loaded into a Jenkins controller or agent, the malicious plugin executed during the AST scan stage, a phase where it naturally has access to source code repositories, artifact stores, and deployment credentials.

The CVSS 9.4 rating reflects the combination of network-level exploitability, no required user interaction beyond a routine plugin update, and the high impact on confidentiality. Stolen tokens could grant attackers access to cloud infrastructure, container registries, secret management vaults, and downstream production environments.

Why This Matters for Saudi Financial Institutions

SAMA's Cyber Security Common Controls (CSCC) framework explicitly mandates secure software development lifecycle practices under Domain 3 (Technology Operations and Architecture). Institutions that run Jenkins-based CI/CD pipelines — common across banking core modernization projects, open banking API development, and fintech integrations — face a direct compliance exposure if their build infrastructure was compromised during the 31-hour attack window.

NCA's Essential Cybersecurity Controls (ECC) reinforce this through controls on supply chain risk management (ECC 2-7-1) and secure configuration management. A backdoored security scanning tool is the worst kind of supply chain failure: it sits at the intersection of trust and access, scanning every line of code while quietly siphoning secrets. For institutions subject to PCI-DSS, compromised CI/CD credentials could cascade into cardholder data environment exposure, triggering Requirement 6 (Develop and Maintain Secure Systems) violations.

The Broader CI/CD Supply Chain Problem

This incident is part of a disturbing trend. The TanStack npm supply chain attack earlier this month, the Vercel OAuth breach traced back to a compromised AI tool, and now TeamPCP's multi-vector campaign against Checkmarx all point to a single reality: attackers are systematically targeting the tools that developers and security teams trust implicitly. Jenkins plugins, npm packages, Docker images, and IDE extensions share a common weakness — organizations rarely verify the integrity of updates to tools they already approved.

The attack surface is massive. A typical enterprise Jenkins deployment runs dozens of plugins, each with its own maintainer, release cadence, and update mechanism. Most organizations have no process to validate plugin integrity beyond the initial procurement review. TeamPCP exploited this gap precisely.

Recommendations and Immediate Actions

  1. Audit Jenkins plugin versions immediately. Check whether any Jenkins instance in your environment loaded Checkmarx AST plugin version 2026.5.09 between May 9 and May 10. The last known safe version is 2.0.13-829.vc72453fa_1c16. Review Jenkins update logs and plugin manifests across all controllers and agents.
  2. Rotate all CI/CD credentials. If exposure is confirmed or cannot be ruled out, rotate every secret accessible from the Jenkins environment: API tokens, cloud provider credentials, container registry passwords, database connection strings, and SSH keys. Prioritize secrets that grant access to production environments or cardholder data zones.
  3. Pin plugins to verified SHA hashes. Disable auto-update for all Jenkins plugins. Implement a policy where plugin updates require manual review and hash verification before deployment. This aligns with SAMA CSCC's change management requirements and NCA ECC configuration baselines.
  4. Scan CI/CD logs for indicators of compromise. Search build logs for references to tpcp.tar.gz, checkmarx.zone, or unexpected outbound network connections from Jenkins agents. Feed these IOCs into your SIEM and threat intelligence platform.
  5. Implement pipeline integrity controls. Deploy artifact signing and verification across your CI/CD pipeline. Use tools like Sigstore or in-toto to create verifiable provenance records for every build artifact. SAMA CSCC Domain 3 supports this under secure development practices.
  6. Review third-party tool governance. Establish a formal process for evaluating and monitoring the security posture of every tool in your development toolchain — not just at procurement, but continuously. Include supply chain compromise scenarios in your incident response playbook.

Conclusion

The TeamPCP campaign against Checkmarx is a textbook example of how threat actors exploit trust relationships in the software supply chain. A security scanning tool — the very tool meant to catch vulnerabilities — became the attack vector. For Saudi financial institutions operating under SAMA, NCA, and PCI-DSS mandates, this incident is a direct call to audit CI/CD pipeline integrity, enforce strict plugin governance, and treat developer tooling as a critical attack surface.

Is your CI/CD pipeline secure? Contact Fyntralink for a complimentary SAMA Cyber Maturity Assessment that includes DevSecOps supply chain risk evaluation.