Sometime in early 2026, a routine vulnerability scan turned into something far worse for machine learning teams that depend on PyTorch. Attackers had quietly poisoned the supply chain of Trivy, the ...