Cybersecurity Today Startup Accused Of Helping Fake Privacy and Security Audits
Mar 23, 2026
Allegations that a compliance startup produced fabricated audit evidence and exposed sensitive data. A popular security scanner briefly shipped a backdoored release that stole cloud credentials and keys. U.S. agencies warn of social‑engineering attacks that hijack Signal and WhatsApp via malicious QR codes and verification tricks. An Iran‑linked cyberattack disrupted medical implant logistics and delayed surgeries.
AI Snips
Chapters
Transcript
Episode notes
Allegations That Delve Fabricated Audit Evidence
- Delve is accused of automating compliance to the point of fabricating audit evidence and handing pre-made reports to auditors.
- The claim comes from an anonymous former client called Deep Delver and alleges auditors largely rubber-stamped Delve-prepared materials.
Researcher Found Sensitive Delve Data Exposed
- After TechCrunch published, a researcher found sensitive Delve data like employee background checks externally accessible.
- D. Vonn founder Jameson O'Reilly reported multiple significant security holes in Delve's external attack surface.
Trivy Supply Chain Backdoor Harvested Broad Credentials
- Trivy's GitHub build was compromised by TeamPCP, which backdoored release 0.69 and tampered with nearly all action tags so workflows executed malicious code.
- The stealer harvested SSH keys, cloud creds (AWS/Azure/GCP), DB passwords, CI/CD tokens, and more, then exfiltrated encrypted data to a C2 domain.