From 8f425ec3ff0c274267add1c31ea53ef8038b73da Mon Sep 17 00:00:00 2001 From: Krrish Dholakia Date: Thu, 26 Mar 2026 15:42:40 -0700 Subject: [PATCH] fix: update ioc to include checkmarx.zone --- docs/my-website/blog/security_update_march_2026/index.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/my-website/blog/security_update_march_2026/index.md b/docs/my-website/blog/security_update_march_2026/index.md index c609cd58fb..9f812806d0 100644 --- a/docs/my-website/blog/security_update_march_2026/index.md +++ b/docs/my-website/blog/security_update_march_2026/index.md @@ -14,7 +14,9 @@ import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; > **Status:** Active investigation -> **Last updated:** March 25, 2026 +> **Last updated:** March 26, 2026 + +> **Update (March 26):** Added `checkmarx[.]zone` to [Indicators of compromise](#indicators-of-compromise-iocs). > **Update (March 25):** Added community-contributed scripts for scanning GitHub Actions and GitLab CI pipelines for the compromised versions. See [How to check if you are affected](#how-to-check-if-you-are-affected). s/o [@Zach Fury](https://www.linkedin.com/in/fryware/) for these scripts. @@ -643,6 +645,8 @@ Review affected systems for the following indicators: - `litellm_init.pth` present in your `site-packages` - Outbound traffic or requests to `models.litellm[.]cloud` This domain is **not** affiliated with LiteLLM +- Outbound traffic or requests to `checkmarx[.]zone` + This domain is **not** affiliated with LiteLLM ## Immediate actions for affected users