Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

1. ChainDrop / Shai-Hulud fourth-wave npm worm (keyv / cacheable family) — Self-propagating install-time credential worm still in the 7–14 day operational window. Hundreds of packages, combined reach on the order of 2 billion monthly installs. Atomic Risk 10. First principles: one stolen maintainer token plus CI publish rights equals autonomous republish across the graph; provenance/SLSA did not stop it. Strong Veracode applicability: Package Firewall + SCA + SSCI + Risk Manager.
2. PaperCut NG/MF pre-auth RCE chain (CVE-2026-81578 + CVE-2026-82078) — Zero-day exploitation confirmed from 2026-08-26; emergency patches on 2026-08-27/28. Auth bypass (8.8) chained to unsafe dynamic class loading (9.8) → unauthenticated RCE on the print-management server. Atomic Risk 9. Print servers are high-privilege, often internet-adjacent, historically used as ransomware beachheads. EASM + Risk Manager + DAST + Policy Management.
3. CISA KEV surge 2026-08-26/27 — New catalog entries include JFrog Artifactory path write (CVE-2026-66384), ownCloud pre-auth file access (CVE-2023-49105, CVSS 9.8), Linux kernel IPv6 privilege escalation (CVE-2026-53362), plus the prior-week Citrix NetScaler (CVE-2026-8452) and SQL Server RCE (CVE-2019-1068) batch. Atomic Risk 8. Artifact registries and file-sync platforms sit on the same trust path as SCA. Risk Manager (KEV) + SCA + Container Security + EASM.
4. On-prem SharePoint unauth RCE chain (CVE-2026-55040 + CVE-2026-63520) and Metabase pre-auth SQLi-to-RCE (CVE-2026-72898, CVSS 10) — Public exploit code in circulation; SharePoint already KEV. Atomic Risk 9 / 8. These are internet-facing application control planes. DAST + EASM + Risk Manager + SAST + Fix.
5. Ransomware + dark-web OSINT (secondary reporting only) — Qilin publicly claimed a U.S. federal firearms/explosives agency system; Medusa advisory update documents 500+ critical-infrastructure victims; leak-site volume remains high (The Gentlemen, Akira, DragonForce, new brands Emperador / iah6477). Atomic Risk 8. Initial access remains unpatched edge + stolen creds + OSS worms. Risk Manager + EASM + Package Firewall + Policy Management.

Comprehensive Threats

ChainDrop / Shai-Hulud 4th wave (keyv, flat-cache, file-entry-cache, cacheable, cache-manager, ecto + 400–1,280+ downstream packages)

CVSS: N/A (malware). Exploit status: in-wild worm; install-time preinstall + Bun second stage; stolen npm tokens republish. Affected: npm graph, CI runners, developer workstations, org-scoped packages. Atomic Risk: 10. Immediate mitigation: pin known-good versions; block malicious versions at ingest; rotate npm/GitHub/cloud/K8s/Vault tokens; rebuild from clean lockfiles; hunt .claude/, .vscode/tasks.json, setup.mjs, binding.gyp. Veracode Tool Mapping: Package Firewall + SCA + SSCI.

PaperCut NG/MF chain CVE-2026-81578 + CVE-2026-82078

CVSS: 8.8 / 9.8. Exploit status: actively exploited from 2026-08-26; emergency patch release 2. Affected: all NG/MF prior to v24/v25/v26 Emergency Patch Release 2. Atomic Risk: 9. Immediate mitigation: pull Application Server off the internet; apply Emergency Patch Release 2; hunt IoCs and dropped Java classes; assume compromise if previously exposed. Veracode Tool Mapping: EASM + Risk Manager + DAST + Policy Management.

SharePoint JWT bypass + RCE CVE-2026-55040 + CVE-2026-63520

CVSS: High / Critical. Exploit status: KEV; public exploit for unauth RCE chain on-prem 2016/2019/Subscription. Affected: on-prem SharePoint. Atomic Risk: 9. Immediate mitigation: apply both patches; remove internet exposure; rotate farm secrets; hunt webshells. Veracode Tool Mapping: EASM + DAST + Risk Manager (KEV).

FortiClient EMS CVE-2026-35616

CVSS: 9.1–9.8. Exploit status: KEV; ongoing use to drop infostealer via EMS control plane. Affected: FortiClient EMS 7.4.5–7.4.6 (and related 7.x). Atomic Risk: 8. Immediate mitigation: hotfix immediately; no public EMS; rotate endpoint/VPN creds; treat managed fleet as potentially scripted. Veracode Tool Mapping: EASM + Risk Manager (KEV).

Metabase password-reset SQLi CVE-2026-72898

CVSS: 10.0. Exploit status: public exploit to RCE (H2 default and Postgres); KEV-class activity. Affected: exposed Metabase. Atomic Risk: 8. Immediate mitigation: patch; take password-reset off the internet; rotate DB and app secrets. Veracode Tool Mapping: EASM + DAST + Risk Manager.

ownCloud WebDAV pre-signed URL auth bypass CVE-2023-49105

CVSS: 9.8. Exploit status: KEV added 2026-08-27 (due 2026-08-30). Affected: ownCloud ≥10.6.0 without signing key. Atomic Risk: 8. Immediate mitigation: patch or disable unsigned pre-signed URLs; assume file read/write/delete if username known. Veracode Tool Mapping: EASM + Risk Manager (KEV) + DAST.

JFrog Artifactory path restriction CVE-2026-66384

CVSS: 5.3 (KEV). Exploit status: KEV added 2026-08-27 (due 2026-09-10). Affected: Artifactory Docker cache / remote-repo write. Atomic Risk: 7. Immediate mitigation: vendor mitigation; treat as artifact-integrity event; rescan consumed images/packages. Veracode Tool Mapping: SCA + Package Firewall + Container Security + Risk Manager (KEV).

Linux kernel IPv6 CVE-2026-53362

CVSS: 7.8. Exploit status: KEV added 2026-08-27 (due 2026-08-30); forensic triage flagged. Affected: Linux distributions using vulnerable IPv6 path. Atomic Risk: 7. Immediate mitigation: kernel update across fleet and container base images. Veracode Tool Mapping: Container Security + Risk Manager (KEV).

Citrix NetScaler ADC/Gateway CVE-2026-8452

CVSS: High. Exploit status: KEV added 2026-08-26. Affected: NetScaler ADC / Gateway. Atomic Risk: 8. Immediate mitigation: vendor fix; pull management/data plane off public internet if unpatched. Veracode Tool Mapping: EASM + Risk Manager (KEV).

Microsoft SQL Server CVE-2019-1068

CVSS: High. Exploit status: KEV added 2026-08-26. Affected: SQL Server Database Engine. Atomic Risk: 7. Immediate mitigation: patch engine; restrict network path to SQL; credential hygiene. Veracode Tool Mapping: Risk Manager (KEV) + Policy Management.

Windows afd.sys Lazarus zero-day CVE-2026-68820

CVSS: 7.0. Exploit status: exploited in-wild (nation-state); patched Aug 2026 Patch Tuesday; KEV. Affected: Windows (local EoP to SYSTEM after code execution). Atomic Risk: 7. Immediate mitigation: confirm August 2026 OS patches; hunt kernel rootkit/FudModule-class persistence. Veracode Tool Mapping: Risk Manager (KEV).

SPIP unauth RCE CVE-2026-77647

CVSS: Critical. Exploit status: exploited as zero-day; public exploit. Affected: SPIP CMS. Atomic Risk: 8. Immediate mitigation: patch or isolate CMS; hunt webshells. Veracode Tool Mapping: EASM + DAST + Risk Manager.

Ajax.NET Professional deserialization CVE-2021-23758

CVSS: 8.1–9.8. Exploit status: KEV 2026-08-26. Affected: apps embedding AjaxPro. Atomic Risk: 7. Immediate mitigation: remove/replace library; SAST/SCA find usages. Veracode Tool Mapping: SCA + SAST + Veracode Fix + Risk Manager (KEV).

Qilin / Medusa / Gentlemen / Akira ransomware + new leak-site brands

CVSS: N/A. Exploit status: active leak-site claims; Medusa 500+ CI victims; Qilin federal-agency claim. Affected: edge, identity, backups, healthcare, gov, manufacturing. Atomic Risk: 8. Immediate mitigation: patch KEV/edge; MFA; segment; immutable backups; hunt broker access. Veracode Tool Mapping: Risk Manager + EASM + Policy Management.

Dark-web OSINT: new extortion brands (Emperador, iah6477), XSS forum infra shift, French SDIS multi-org claims, stealer-log credential markets

CVSS: N/A. Exploit status: secondary OSINT only — leak-site and forum reporting, not independently validated datasets. Affected: identity, emergency services, enterprise creds. Atomic Risk: 7. Immediate mitigation: assume credential reuse; force rotation on exposed identities; raise Risk Manager urgency on KEV + identity findings. Veracode Tool Mapping: Risk Manager + EASM.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

Persistent high-blast-radius npm supply-chain worm activity (ChainDrop / Shai-Hulud family variants) continues to dominate, with credential-stealing self-propagating malware that compromised high-download packages and cascaded across hundreds of artifacts totaling billions of monthly installs; Atomic Risk 10. This remains the top immediate threat because of automatic propagation via stolen maintainer tokens and CI secrets, enabling rapid ecosystem-wide compromise of developer tooling and downstream applications. Strong Veracode applicability via Package Firewall + SCA + SSCI.

Actively exploited Windows kernel privilege-escalation zero-day (CVE-2026-68820) added to KEV and leveraged in nation-state campaigns for SYSTEM access and rootkit deployment; Atomic Risk 9. First-principles impact is local escalation that converts any foothold into full host control. Strong Risk Manager (KEV) + Policy Management fit.

Critical unauthenticated SQLi in Metabase (CVE-2026-72898, CVSS 10.0) under active exploitation granting database admin and credential theft from connected data sources; Atomic Risk 9. Self-hosted instances remain exposed at scale. Risk Manager (KEV) + DAST/EASM prioritization.

VMware vCenter critical RCE (CVE-2026-59310, CVSS 9.8) under active exploitation leading to reverse shells, lateral movement, and ransomware deployment across hundreds of instances; Atomic Risk 9. Container Security + Risk Manager + EASM.

Secondary dark-web/underground signals (OSINT reporting only) show continued high volume of stealer-log credential dumps, enterprise Azure/Entra directory harvests, and ransomware leak-site activity tied to ongoing campaigns. These amplify urgency for identity and supply-chain controls.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

npm ChainDrop / Shai-Hulud Family Worm

Root cause is compromised maintainer GitHub accounts used to push malicious releases carrying preinstall droppers (or binding.gyp / Phantom Gyp variants in related waves) that execute on npm install. Mechanism: harvest hundreds of credential types (npm/GitHub/cloud/CI/AI-tool tokens), exfiltrate (including via blockchain C2 in some variants), then use stolen tokens to republish poisoned versions of any packages the victim controls — creating automatic worm propagation.

Blast radius is extreme: core packages alone exceed hundreds of millions of weekly downloads and appear in a large percentage of cloud environments; secondary infections reach organizational packages. Dark-web amplification risk exists via stolen secrets fueling further campaigns.

Veracode Control Point: Package Firewall blocks known-malicious and high-risk packages at the registry/policy layer before install; SCA + SSCI continuously monitors dependency graphs and proprietary threat feed for worm signatures and newly compromised artifacts; Risk Manager elevates the finding for immediate remediation.

CVE-2026-68820 — Windows Kernel Privilege Escalation (afd.sys UAF)

Root cause is a use-after-free race condition in the Windows Ancillary Function Driver for WinSock (afd.sys). Mechanism: low-privilege local attacker triggers the race to achieve SYSTEM. Already chained in nation-state operations for kernel rootkits. Blast radius is any Windows endpoint or server with a foothold.

Veracode Control Point: Risk Manager surfaces the KEV entry with unified prioritization and due-date context; Policy Management enforces rapid remediation SLAs across the portfolio.

CVE-2026-72898 — Metabase Unauthenticated SQLi (CVSS 10.0)

Root cause is improper input handling in Metabase's password-reset endpoint allowing unauthenticated SQL injection that yields application-database administrator access (including credentials for connected data sources). Mechanism enables full data exfiltration and further lateral movement. Thousands of self-hosted instances were still vulnerable post-disclosure.

Veracode Control Point: Risk Manager (KEV) for prioritization; DAST for runtime confirmation of exposed instances; EASM for discovery of public-facing Metabase.

CVE-2026-59310 — VMware vCenter Syslog Directory Traversal RCE (CVSS 9.8)

Root cause is directory traversal in the vCenter Syslog server enabling unauthenticated remote code execution. Mechanism leads to reverse shells, new admin accounts, credential theft from vmdir, ESXi lateral movement, and ransomware. Hundreds of instances compromised within days of disclosure.

Veracode Control Point: Container Security for vSphere/K8s-adjacent posture; EASM for exposed management interfaces; Risk Manager for urgency scoring.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

The dominant high-blast-radius threat remains the active self-propagating npm supply-chain worm campaign (Shai-Hulud / Mini Shai-Hulud / ChainDrop lineage and related Miasma/Phantom Gyp variants). In the last 7 days a single compromised maintainer account triggered rapid infection of hundreds to over 1,200 packages (including high-download caching libraries) totaling billions of monthly installs; the worm executes at install time, steals developer/CI/cloud credentials, and self-propagates while carrying valid provenance. Atomic Risk 10. First-principles impact: any organization pulling npm packages in the last week faces potential credential compromise and further package poisoning; Veracode Package Firewall + SCA + SSCI provides the direct control point to block malicious packages and surface proprietary threat intelligence.

Multiple critical unauthenticated RCE and authentication-bypass CVEs were added to the KEV catalog in the last 7 days (Progress LoadMaster, JetBrains TeamCity, IBM Langflow, N-able N-central). Atomic Risk 9. These enable immediate remote takeover of internet-facing or management systems and map directly to Risk Manager prioritization plus EASM discovery.

Ransomware activity remains elevated with splintering groups, active exploitation of VPN/appliance flaws, and social-engineering vectors leading to encryption; dark-web secondary OSINT shows continued leak-site postings and stealer-log circulation. Atomic Risk 8. Strong Veracode applicability across SCA, Risk Manager, EASM, and Policy Management for rapid prioritization and governance.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

npm Supply-Chain Worm (Shai-Hulud Lineage)

Root cause: Compromised legitimate maintainer GitHub/npm credentials allow automated republication of packages containing install-time execution (preinstall scripts or binding.gyp / node-gyp abuse). Mechanism: Payload harvests broad credential classes (npm, GitHub, cloud, Kubernetes, SSH, CI secrets), then uses stolen tokens to infect additional packages under the same or related maintainers, achieving worm-like spread within hours. Valid SLSA provenance is generated because the build runs through legitimate workflows.

Blast radius: Packages present in a large percentage of cloud and enterprise environments; any npm install of an affected version executes the stealer before application code runs. Propagation risk is extreme because downstream transitive dependencies amplify reach.

Veracode Control Point: Package Firewall blocks known-malicious and high-risk packages at the point of ingestion; SCA continuously scans dependency trees and flags the specific versions; SSCI supplies proprietary threat-feed context that elevates these packages above generic CVE scoring for immediate policy enforcement.

Recent KEV Unauthenticated RCEs (LoadMaster, TeamCity, Langflow)

Root cause: Insufficient input sanitization or deserialization of untrusted data on management/agent endpoints with no authentication required. Mechanism: Network-reachable crafted requests yield full code execution or admin takeover. Blast radius: Internet-exposed instances (common for these products) become immediate footholds for ransomware or data theft.

Veracode Control Point: Risk Manager ingests KEV status and applies elevated priority scoring with due-date context; EASM discovers external exposure of the affected products so remediation can be forced on the highest-risk assets first.

Ransomware & Dark-Web Signals

Root cause: Combination of appliance zero-days / incomplete patches plus social engineering (Teams vishing) and ready-made RaaS tooling. Mechanism: Initial access → credential dumping → rapid encryption or data exfiltration to leak sites. Dark-web secondary reporting confirms elevated leak-site postings and stealer-log circulation, increasing the value of any compromised credentials.

Veracode Control Point: Risk Manager unifies KEV and dark-web-informed urgency into a single prioritized queue; Policy Management enforces consistent blocking and remediation SLAs across SCA, SAST, and container findings.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

Active self-propagating supply-chain worms in the npm/PyPI ecosystems (Miasma / Shai-Hulud lineage variants including Phantom Gyp binding.gyp execution and Hades .pth loaders, plus the July 14 AsyncAPI CI-pipeline compromise delivering multi-stage credential-harvesting payloads) remain the highest-blast-radius threat. Impact: rapid lateral propagation via stolen maintainer tokens, CI secrets, and cloud credentials into downstream developer workstations and build systems; Atomic Risk 10. First-principles: install-time or import-time execution bypasses many traditional script controls and turns every compromised package into a new distribution node. Strong Veracode applicability via Package Firewall + SCA + SSCI.

Two critical KEV additions with confirmed in-wild exploitation (Microsoft SharePoint deserialization RCE enabling machine-key theft for post-patch persistence, and Check Point SmartConsole authentication bypass granting unauthenticated full administrative control of management servers) create immediate total-control risk on internet-exposed assets; Atomic Risk 9–10. WordPress Core unauthenticated RCE chain (wp2shell) via REST batch-route confusion + SQL injection is also KEV-listed and actively scanned/exploited. Strong Veracode applicability via Risk Manager (KEV prioritization) + EASM.

Infostealer-driven ransomware activity continues at elevated volume, with credential dumps fueling rapid initial access for multiple active groups; Atomic Risk 8. Veracode applicability via Risk Manager dark-web-informed urgency scoring and EASM exposure reduction.

All findings map directly to Platform controls for detection, blocking, prioritization, and remediation.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Supply-Chain Worms (Miasma / Phantom Gyp / Hades / AsyncAPI)

Supply-chain worms succeed because package registries and CI systems treat published artifacts as trusted by default. Root cause is compromised maintainer credentials or misconfigured GitHub Actions (pull_request_target / OIDC token abuse) that allow an attacker to inject a binding.gyp (Phantom Gyp) or .pth file that executes during legitimate install or Python startup.

Mechanism: node-gyp rebuild or Python site-packages import triggers shell expansion or Bun runtime download, leading to credential scraping (npm/GitHub/cloud/SSH/Kubernetes tokens), encrypted exfiltration to attacker-controlled repos or IPFS, and automated re-publication of poisoned packages under the victim's identity. Blast radius is exponential: each new compromised account becomes a distribution node; lockfiles generated during the short live window remain poisoned indefinitely. Dark-web secondary reporting shows stealer logs containing the harvested secrets appear on underground channels within days, amplifying ransomware initial-access brokers.

Veracode Control Point: Package Firewall blocks the malicious artifact at the registry proxy or policy gate before it ever reaches the build; SCA + SSCI continuous scanning and proprietary threat feed detect the known worm signatures and anomalous lifecycle hooks; Risk Manager elevates the finding with KEV-style urgency even without a formal CVE.

SharePoint CVE-2026-50522 — Deserialization RCE / Machine-Key Theft

SharePoint CVE-2026-50522 is a classic untrusted-data deserialization path in the SessionSecurityTokenHandler / WS-Federation flow. An unauthenticated network request delivers a crafted BinaryFormatter payload that executes in the SharePoint application-pool context and extracts machine keys. Once keys are stolen, the attacker retains the ability to forge valid tokens after the server is patched.

Blast radius: any on-prem SharePoint farm reachable from the internet or internal lateral movement becomes a persistent foothold for ransomware or data theft.

Veracode Control Point: Risk Manager surfaces the KEV entry with unified risk scoring and due-date enforcement; EASM discovers the external exposure of SharePoint endpoints so the asset can be prioritized and access restricted.

Check Point CVE-2026-16232 — SmartConsole Authentication Bypass

Check Point CVE-2026-16232 is an improper authentication flaw in the SmartConsole application-token login path. When the management server is internet-reachable and Trusted Clients are unrestricted, an unauthenticated attacker obtains a full-admin token and can rewrite security policy across all managed gateways.

Veracode Control Point: Risk Manager (KEV) + EASM exposure discovery and policy enforcement.

WordPress wp2shell RCE Chain

WordPress wp2shell combines REST API batch-route confusion (index offset on failed sub-requests) with an SQLi in the author__not_in WP_Query parameter. The chain requires no authentication and no plugins on default installs of the affected major versions, enabling direct RCE.

Veracode Control Point: Risk Manager prioritization + EASM external web-app discovery + DAST runtime confirmation of the vulnerable endpoints.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

The last 24–48 hours featured CISA KEV additions on July 21 (multiple actively exploited vulnerabilities with imminent due dates) alongside the persistent high-impact Miasma npm supply-chain compromise (trojanized packages published July 14 via GitHub Actions token theft, with import-time credential-harvesting payloads). Supply-chain/OSS worm-like activity and KEV signals dominate; ransomware ecosystem expansion continues with new actors emerging at a rate exceeding one per week. No brand-new zero-day public PoC disclosures dominated the last 48 hours, but active in-wild exploitation is confirmed via KEV.

Top Threats (Prioritized by Blast Radius and Veracode Alignment)

1. Miasma npm supply-chain trojanization (AsyncAPI and related campaigns) — Import-time payload steals CI/CD tokens (GITHUB_TOKEN, NPM_TOKEN) on package load/require. High propagation risk via stolen credentials enabling further repository or registry abuse. Atomic Risk: 9/10. Strong, direct Veracode applicability (Package Firewall + SCA + SSCI blocks and prioritizes).
2. CISA KEV July 21 additions (Fortinet FortiSandbox OS command injection CVSS 9.8, Microsoft SharePoint deserialization RCE, Langflow RCE, WordPress wp2shell RCE chain) — Actively exploited in the wild; many with July 24 due dates. Broad enterprise and web exposure. Atomic Risk: 8–9/10. Strong Veracode applicability (Risk Manager (KEV) + EASM + DAST).
3. Ongoing ransomware campaigns + new actor proliferation (61+ new groups YTD, 146+ active groups, record victim volumes) — Sustained double-extortion and underground leak activity amplifying exploitation of unpatched systems. Atomic Risk: 7/10. Veracode applicability via Risk Manager for dark-web-informed prioritization.
4. Continuing SharePoint exploitation wave (multiple vulns in recent period, including latest KEV) — Repeated targeting of enterprise collaboration platforms.

These create immediate Platform-actionable signals: accelerate Package Firewall/SSCI for OSS integrity, Risk Manager for KEV/exploit-context prioritization, and EASM for external exposure reduction. Edge cases include cached/local npm installs, transitive/hoisted dependencies, internal mirrors that ingested bad versions, serverless or containerized workloads using affected packages, and air-gapped environments with delayed but real token-reuse risk.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Miasma npm Supply-Chain Trojanized Packages

Root cause: Attacker leveraged misconfigured GitHub Actions workflow (pull_request_target event) on AsyncAPI repositories to exfiltrate a maintainer/bot personal access token (PAT), enabling unauthorized pushes to auto-publish branches and npm releases. Trojanized versions contain payload that executes at import/require time inside the consuming Node.js process.

Mechanism: On module load the payload inspects environment (CI runner context), harvests GITHUB_TOKEN, NPM_TOKEN, SSH keys, AWS credentials, etc., and exfiltrates them. No traditional install hook required in many cases — stealthy execution in the caller's context. Prior Miasma-family activity (Red Hat cloud-services packages June 2026, Mastra 140+ packages, LeoPlatform/RStreams, Go ecosystem spread) shows iterative refinement and cross-registry propagation.

Blast radius & propagation risk: Extremely high. Direct consumers of affected versions (generator, generator-components, etc.) immediately expose CI/CD and developer workstations. Stolen tokens enable worm-like follow-on actions: pushing additional malicious packages, accessing private repositories, or lateral movement inside organizations. Affects API tooling, code-generation pipelines, and any downstream artifact consumers. Dark-web amplification is secondary (token/access sales) but compounds urgency. Edge case: hoisted dependencies in monorepos, cached installs in CI runners, or internal npm proxies that mirrored bad versions before takedown.

Veracode Control Point: Package Firewall + SSCI threat intelligence feed identifies and blocks known malicious package versions and Miasma-family indicators in real time during intake or policy enforcement. SCA maps the full dependency tree and surfaces the compromised versions. Risk Manager elevates any application touching these packages with active-campaign context. Policy Management enforces mandatory OSS governance and blocks high-risk intake.

Fortinet FortiSandbox OS Command Injection (CVE-2026-25089 / 39808) & Microsoft SharePoint Deserialization RCE (CVE-2026-58644)

Root cause (Fortinet): Insufficient sanitization of HTTP request parameters allows unauthenticated attackers to inject and execute OS commands. Root cause (SharePoint): Unsafe deserialization of untrusted data over the network permits remote code execution without authentication.

Mechanism: Both are remote, unauthenticated vectors — crafted HTTP requests for Fortinet; deserialization gadget chains for SharePoint. KEV designation confirms in-wild exploitation (often initial access or ransomware deployment).

Blast radius: Fortinet appliances are security gateways — compromise yields broad network visibility/control. SharePoint is ubiquitous enterprise collaboration — RCE enables data exfiltration, persistence, or ransomware staging. Propagation risk elevated when these sit internet-exposed or in hybrid environments.

Veracode Control Point: Risk Manager (KEV) overlays active-exploitation and due-date context on inventory for prioritized triage. EASM continuously discovers exposed Fortinet and SharePoint instances. DAST validates runtime exploitability of web-exposed surfaces. Container Security covers any containerized deployments. Policy Management enforces SLAs aligned to CISA BOD timelines.

WordPress wp2shell RCE Chain (CVE-2026-63030 + 60137) & Langflow RCE (CVE-2026-0770)

Root cause (WP): Interpretation conflict in core batch REST endpoint combined with SQL injection in WP_Query when untrusted input reaches parameters; chains to unauthenticated admin account creation or direct code execution on default installs. No plugins/themes required. Root cause (Langflow): Unsafe inclusion/handling of exec_globals parameter in validate endpoint allows remote attackers to execute arbitrary code (potentially root context) via untrusted control sphere.

Mechanism: Pure unauthenticated remote vectors — single REST request for WP chain; crafted validate call for Langflow. Both patched recently (WP July 17) but KEV confirms active exploitation against unpatched instances.

Blast radius: WP affects millions of sites (core only); easy initial access or defacement vector frequently chained into ransomware. Langflow impacts AI/LLM workflow builders — growing attack surface as organizations adopt low-code LLM tooling.

Veracode Control Point: DAST discovers runtime RCE in web applications and APIs. Risk Manager (KEV) prioritizes these findings with exploitation context and dark-web-informed urgency. EASM identifies publicly reachable WordPress and Langflow instances. Policy Management mandates web-app scanning and rapid remediation SLAs.

Broader Signals

Supply-chain attack tempo in npm/PyPI ecosystems remains elevated throughout 2026 with iterative worm-like credential stealers (Miasma variants spanning multiple organizations and registries). KEV catalog additions are frequent, confirming sustained offensive focus on enterprise platforms (security appliances, collaboration software, web CMS, AI tooling). Ransomware actor count continues surging (>1 new group per week; 61+ YTD) with persistent double-extortion and leak-site activity — underground signals indicate healthy marketplace for initial-access exploits and stolen credentials. X chatter in the last 24 hours shows limited brand-new zero-day noise but reinforces ongoing SharePoint targeting. No critical new public PoC zero-days dominated the window, but active exploitation is the dominant signal.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

Top threats (2026-07-20 sweep):

• Fortinet FortiSandbox OS Command Injection (CVE-2026-39808, CVE-2026-25089): Critical unauthenticated RCE (CVSS 9.1). KEV added 2026-07-16. Atomic Risk 9/10. First-principles: Security appliance compromise undermines malware analysis, enables persistence/defense evasion, and provides high-value initial access for ransomware/APT. Strong Veracode applicability (exposed management interfaces).
• Microsoft SharePoint Server Deserialization/Missing Authentication (CVE-2026-58644, CVE-2026-56164 and related): RCE/privilege escalation. Multiple KEV additions mid-July 2026. Atomic Risk 8/10. Enterprise collaboration platform — prime target for data theft, ransomware deployment, and lateral movement. High blast radius in on-prem/exposed deployments.
• SonicWall SMA1000 Code Injection/SSRF (CVE-2026-15410, CVE-2026-15409): Remote code execution and request forgery. KEV added 2026-07-14. Atomic Risk 8/10. Perimeter appliances frequently targeted for initial access.
• WordPress wp2shell RCE (public PoC, emergency patches 2026-07-17): Critical remote code execution chaining REST API + SQL injection. Affects WP 6.9.0–6.9.4 and 7.0.0–7.0.1. Atomic Risk 8/10. Millions of sites; public exploit available. Strong DAST alignment.
• Ongoing multi-group ransomware campaigns (Qilin, Nova, Unsafe, Chaos, Doommageddon): Daily victim disclosures July 19–20 2026 across manufacturing, healthcare, construction, and other sectors. Atomic Risk 7/10. Steady high volume; groups actively posting. No single new dominant campaign but consistent operational tempo.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Fortinet FortiSandbox (CVE-2026-39808 / CVE-2026-25089):

Root cause is CWE-78 (improper neutralization of special elements in OS command) in web UI (e.g., "start VNC") and API endpoints. Attacker sends crafted unauthenticated HTTP request → arbitrary command execution on the appliance. Blast radius: Full system compromise of a malware analysis/sandbox platform. Attacker gains access to analyzed samples (potential tampering or exfil), can disable or evade detection, establish persistence, and use the appliance as a pivot point. Not a worm (no self-propagation), but extremely high-value target for ransomware operators or APTs seeking to blind security teams. Veracode control point: EASM discovers internet-exposed management consoles; DAST tests analogous command injection in custom web apps; Risk Manager tracks KEV remediation SLAs and correlates risk.

Microsoft SharePoint (CVE-2026-58644 et al.):

Classic deserialization of untrusted data + missing authentication for critical functions. Leads to unauthenticated or low-priv RCE. Blast radius: Enterprise-wide — document repositories, user data, workflow automation, and potential domain-level impact via integration. Frequently used in ransomware and nation-state operations for initial foothold or data staging. Propagation risk moderate via compromised accounts or lateral movement scripts. Veracode: EASM for exposed instances; Risk Manager for unified KEV + AppSec risk scoring; DAST for runtime validation of SharePoint-like custom portals.

Ransomware campaigns:

Root cause typically unpatched edge vulnerabilities (exactly the KEV class above), stolen creds, or phishing. Mechanism: Initial access → discovery/lateral movement → encryption + exfil. Blast radius: Organization-wide operational shutdown, regulatory exposure, and ransom demand. High blast because modern groups combine speed with data leverage. No direct tie to today's new KEVs in public reporting, but the pattern matches perfectly. Veracode reduces success probability by shrinking the vulnerable external surface (EASM) and enforcing rapid KEV remediation (Risk Manager).

Broader Signals

Ransomware tracking platforms show consistent daily activity (~14 new incidents in last 24h window per live feeds) with groups actively naming victims. X volume on specific CVEs/KEVs remains low-signal in latest mode (early post-KEV phase). No credible reports of new worm variants, Mini-Shai-Hulud-style OSS propagation, or large-scale credential-harvesting malware in public OSS registries during the sweep window. APT activity historically targets SharePoint and perimeter appliances; continued monitoring warranted but no new nation-state campaign indicators surfaced today.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities):
  • https://docs.veracode.com/r/Software_Composition_Analysis
  • https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context):
  • https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA):
  • https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities):
  • https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing):
  • https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery):
  • https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security:
  • https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement):
  • https://docs.veracode.com/r/c_appsec_policies

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure! https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• Shai-Hulud/Miasma/Mini Shai-Hulud supply chain worm + new fake payment SDK malicious packages (npm/PyPI, published ~July 7–8, 2026): Self-propagating credential-harvesting campaign abusing binding.gyp ("Phantom Gyp") for install-time execution, typosquatting, and maintainer/CI compromise. Hundreds of packages historically affected; new cluster (paysafe-*, skrill-*, neteller-*) steals CI/CD secrets, tokens, and env data. Atomic Risk: 9/10. First-principles: OSS registry trust + automated npm install/pip install creates autonomous blast radius to every downstream dev/CI environment. Strong Veracode applicability: Package Firewall + SCA.
• CISA KEV addition (2026-07-13): CVE-2008-4128 Cisco IOS CSRF: Legacy but now confirmed actively exploited vector for remote command execution on exposed routers. Atomic Risk: 7/10. Why now: BOD 26-04 mandates rapid action on exposed assets granting total control.
• Actively exploited KEVs (added ~July 7, deadlines recent/passed): Adobe ColdFusion CVE-2026-48282 (CVSS 10.0 path traversal $\rightarrow$ RCE), Joomla Page Builder CVEs CVE-2026-48908/CVE-2026-56290 (CVSS 10.0 unauth file upload/RCE), Langflow CVE-2026-55255 (CVSS 8.4 IDOR/authz bypass $\rightarrow$ arbitrary flow execution). Atomic Risk: 9/10. High in-wild exploitation confirmed.
• Ongoing ransomware (Settra, The_Gentlemen/Thegentlemen, Gunra, Medusa Locker, Qilin, Stormous active July 2026): Steady victim volume fueled by infostealer/credential campaigns (e.g., FortiBleed linked to INC/Lynx). No single new mega-campaign in last 24h but high operational tempo.
• Broader signals: Evolving worm tactics (binding.gyp evasion, loader mutations, legitimate project weaponization); NK-linked supply chain (Sapphire Sleet/BlueNoroff); public PoCs for select Linux kernel issues. Supply chain remains highest blast-radius vector.

All items deduplicated and ranked by CVSS $\ge$ 7.0 OR KEV OR public exploit/in-wild OR supply-chain propagation risk.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Shai-Hulud/Miasma supply chain worm (incl. July 2026 payment SDK campaign):

• Root Cause: Compromise of maintainer accounts or CI/CD pipelines (via stolen OIDC/GitHub tokens), followed by injection of a malicious payload into the publish pipeline or a direct malicious version upload.
• Mechanism: The binding.gyp file (normally for native addons) is processed by node-gyp at install time. This executes attacker JavaScript that harvests .env files, npm/PyPI/GitHub/cloud tokens, SSH keys, Vault data, and CI secrets. It then exfiltrates and uses these stolen credentials to republish more malicious versions (worm propagation). The new July variant uses convincing SDK facades (like paysafe-checkout) with sandbox evasion.
• Blast Radius: Any direct or transitive dependency triggers infection upon installation. Stolen secrets enable full GitHub organization takeovers, cloud account compromise, and further downstream poisoning.
• Propagation Risk: High — fully autonomous across registries.
• Veracode Control Point: SCA + Package Firewall gates at dependency resolution and CI/CD to detect and block threats before execution; Policy Management enforces compliance.

CVE-2026-48282 Adobe ColdFusion (and similar Joomla/Langflow KEVs):

Root cause is insufficient path validation (CWE-22) or improper access control allowing unauthenticated file upload/overwrite or IDOR leading to RCE/flow execution. Actively exploited in wild with public indicators. Blast radius: Full compromise of internet-facing instances (code execution in context of app user, potential lateral movement). Why matters now: KEV addition + BOD 26-04 creates hard federal deadlines; unpatched = immediate target. Veracode control point: DAST for runtime confirmation on exposed apps; Risk Manager for KEV-aware prioritization across portfolio.

CVE-2008-4128 Cisco IOS CSRF:

Root cause is insufficient CSRF protection in legacy HTTP admin interface. Now confirmed actively exploited. Blast radius: Remote command execution on exposed routers (legacy but still internet-facing in many environments). Veracode control point: EASM to discover exposed assets + Risk Manager (KEV) for unified tracking and policy enforcement.

Broader Signals

High signal volume on supply chain (Sonatype tracking cumulative 1.8M malicious packages; new Miasma waves + payment SDK cluster). Worm tactics evolving rapidly (binding.gyp/Phantom Gyp bypass, loader mutations for evasion, typosquatting + weaponization of legitimate projects). APT notes: North Korea-linked (Sapphire Sleet) supply chain campaigns targeting AI/dev tooling; ongoing credential theft feeding ransomware. X/web chatter elevated on #ShaiHulud, malicious packages, and recent KEVs. No major silent sources.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities):
  • https://docs.veracode.com/r/Software_Composition_Analysis
  • https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context):
  • https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA):
  • https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities):
  • https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing):
  • https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery):
  • https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security:
  • https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement):
  • https://docs.veracode.com/r/c_appsec_policies

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• Miasma / Phantom Gyp npm supply chain worm (Shai-Hulud lineage): Self-propagating credential-harvesting worm abusing binding.gyp / node-gyp for install-time execution. 57+ packages / 286+ malicious versions (high-download targets like @vapi-ai/server-sdk). Ongoing variants into late June. Atomic Risk: 9/10. First-principles: Maintainer compromise + novel bypass of script-hook detection enables CI/CD takeover and ecosystem-wide propagation via stolen cloud/OSS creds. Strong Veracode fit: SCA + Package Firewall.

• CVE-2026-48282 Adobe ColdFusion Path Traversal (KEV added 2026-07-07): Fresh CISA addition confirming active exploitation. Atomic Risk: 8/10. Path traversal as reliable initial access vector for ransomware/APT follow-on.

• CVE-2026-45659 Microsoft SharePoint RCE (recent KEV, deserialization): Actively exploited on enterprise collaboration platform. Atomic Risk: 9/10. Broad internal blast radius.

• CVE-2026-11645 Chromium V8 zero-day (KEV) + ongoing ransomware (SafePay leading recent claims) remain high-signal but secondary to supply chain worm this cycle.
•  

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Miasma / Phantom Gyp npm worm: Root cause = compromised maintainer accounts (social engineering/credential theft) publishing trojanized versions. Mechanism = weaponized binding.gyp (normally benign for native addons) triggers node-gyp execution at npm install time — evades most package.json preinstall/postinstall scanners. Payload exfiltrates env vars, tokens, validates access, then self-publishes malicious versions of victim's other packages and injects CI steps. Blast radius = extreme (supply chain worm): poisons high-download packages → thousands of downstream builds/CI runners compromised → cloud credential theft enables ransomware/APT lateral movement. Propagation risk highest in OSS-dependent orgs with weak package governance. Veracode control point: SCA + Package Firewall detects embedded malicious code and blocks at ingest/CI before install.

CVE-2026-48282 Adobe ColdFusion: Classic path traversal (CWE-22 class) allows arbitrary file read/write on server. Why it matters now: Fresh KEV confirmation means adversaries are actively chaining it for initial access. ColdFusion often runs legacy enterprise apps with high data sensitivity. Immediate patch + exposure reduction is non-negotiable.

CVE-2026-45659 SharePoint: Deserialization of untrusted data → RCE. High-value target for internal network pivoting and data exfil. KEV status demands top-tier prioritization.

Broader Signals

X (Latest mode) shows routine CVE chatter (Palo Alto PAN-OS disclosures today) and general ransomware discussion; no massive new zero-day PoC dump or brand-new ransomware campaign spike in strict last 24h. Miasma volume peaked with June waves but variants (e.g., Leo Platform) keep the campaign live. Credential theft (e.g., FortiBleed) continues feeding ransomware. APT notes limited in window but China-linked activity observed on older vectors.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities): https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context): https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA): https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities): https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing): https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery): https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security: https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement): https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

Malicious Packages & Supply Chain Worms

Threat: Miasma Phantom Gyp / Shai-Hulud variants (binding.gyp worm, credential harvesting, self-propagation). Why fits: Only tool that directly detects embedded malicious code in OSS packages and enforces real-time blocking of known-bad versions in pipelines. Customer action: Enable Package Firewall malicious package policies + strict SCA gates in every npm/CI/CD pipeline today; full historical scan for affected packages. Tool: SCA + Package Firewall

New/KEV CVEs

Threat: CVE-2026-48282 (Adobe ColdFusion), CVE-2026-45659 (SharePoint). Why fits: Unified exploitation-context view + automated prioritization across all findings. Customer action: Ingest these KEVs into Risk Manager; apply 24–72h SLAs for internet-facing assets; trigger Fix on any custom integrations. Tool: Risk Manager (KEV)

Web/Runtime Exploits

Threat: SharePoint RCE, Adobe ColdFusion path traversal, Chromium V8. Why fits: Identifies runtime-exploitable issues (deserialization, traversal) in live web/apps that static analysis misses. Customer action: Targeted DAST scans on all exposed SharePoint/ColdFusion instances; prioritize high findings for immediate fix. Tool: DAST

External Attack Surface

Threat: Exposed ColdFusion/SharePoint servers under active exploitation. Why fits: Discovers unknown exposed assets and correlates with KEV risk. Customer action: Run EASM discovery; map exposed assets to new KEVs; remediate or shield. Tool: EASM + Risk Manager

Governance

Threat: All above require consistent enforcement. Customer action: Update Policy Management to mandate Package Firewall + SCA pass for OSS, KEV prioritization, and DAST for web apps before any production deploy. Tool: Policy Management

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.