YusufOnSecurity.com · 2026-05-09 · 30 min
Enjoying the content? Let us know your feedback! Today's episode is one of those stories that, when you start pulling the thread, the whole thing just keeps unravelling. We are going to talk about the Mercor breach. Now, if that name doesn't ring a bell, Mercor is a ten-billion-dollar AI recruiting startup. They match human experts with companies like OpenAI, Meta, and Anthropic to help train AI models. Big clients. Big data. Big target. Towards the end of March of this year, a threat group called TeamPCP and no, that is not a household cleaning detergent type of product - managed to steal roughly four terabytes of data from Mercor. And the way they did it? They didn't attack Mercor directly. They didn't even attack the software Mercor relied on directly. They attacked the security tool that was supposed to protect that software. Let me say that again. They compromised the vulnerability scanner. We have all that coming up next in this week's episode. - : LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP supply chain campaign - : SecurityWeek - Mercor Hit by LiteLLM Supply Chain Attack: Be sure to subscribe!
276 - copy.fail Explained-The Linux Kernel Bug That Turns Any User Into Root55 / 100274 - Ransomware Hit a Water Plant - Why Your Tap Water Is a Cybersecurity Problem273 - Project Glasswing (Mythos) - Anthropic Watershed Moment for Cybersecurity - Part 2272 - Project Glasswing (Mythos) - Anthropic Watershed Moment for Cybersecurity - Part 1271 - $21 Billion Lost to Cybercrime - FBI's 2025 Report and Microsoft's Massive April Patch Tuesday