Sometime in early 2026, a routine vulnerability scan turned into something far worse for machine learning teams that depend on PyTorch. Attackers had quietly poisoned the supply chain of Trivy, the ...

Users who deployed the nightly builds of PyTorch between Christmas and New Year’s Eve likely received a rogue package as part of the installation that siphoned off sensitive data from their systems.

PyTorch has identified a malicious dependency with the same name as the framework's 'torchtriton' library. This has led to a successful compromise via the dependency confusion attack vector. PyTorch ...