Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

Top threats (2026-07-20 sweep):

• Fortinet FortiSandbox OS Command Injection (CVE-2026-39808, CVE-2026-25089): Critical unauthenticated RCE (CVSS 9.1). KEV added 2026-07-16. Atomic Risk 9/10. First-principles: Security appliance compromise undermines malware analysis, enables persistence/defense evasion, and provides high-value initial access for ransomware/APT. Strong Veracode applicability (exposed management interfaces).
• Microsoft SharePoint Server Deserialization/Missing Authentication (CVE-2026-58644, CVE-2026-56164 and related): RCE/privilege escalation. Multiple KEV additions mid-July 2026. Atomic Risk 8/10. Enterprise collaboration platform — prime target for data theft, ransomware deployment, and lateral movement. High blast radius in on-prem/exposed deployments.
• SonicWall SMA1000 Code Injection/SSRF (CVE-2026-15410, CVE-2026-15409): Remote code execution and request forgery. KEV added 2026-07-14. Atomic Risk 8/10. Perimeter appliances frequently targeted for initial access.
• WordPress wp2shell RCE (public PoC, emergency patches 2026-07-17): Critical remote code execution chaining REST API + SQL injection. Affects WP 6.9.0–6.9.4 and 7.0.0–7.0.1. Atomic Risk 8/10. Millions of sites; public exploit available. Strong DAST alignment.
• Ongoing multi-group ransomware campaigns (Qilin, Nova, Unsafe, Chaos, Doommageddon): Daily victim disclosures July 19–20 2026 across manufacturing, healthcare, construction, and other sectors. Atomic Risk 7/10. Steady high volume; groups actively posting. No single new dominant campaign but consistent operational tempo.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Fortinet FortiSandbox (CVE-2026-39808 / CVE-2026-25089):

Root cause is CWE-78 (improper neutralization of special elements in OS command) in web UI (e.g., "start VNC") and API endpoints. Attacker sends crafted unauthenticated HTTP request → arbitrary command execution on the appliance. Blast radius: Full system compromise of a malware analysis/sandbox platform. Attacker gains access to analyzed samples (potential tampering or exfil), can disable or evade detection, establish persistence, and use the appliance as a pivot point. Not a worm (no self-propagation), but extremely high-value target for ransomware operators or APTs seeking to blind security teams. Veracode control point: EASM discovers internet-exposed management consoles; DAST tests analogous command injection in custom web apps; Risk Manager tracks KEV remediation SLAs and correlates risk.

Microsoft SharePoint (CVE-2026-58644 et al.):

Classic deserialization of untrusted data + missing authentication for critical functions. Leads to unauthenticated or low-priv RCE. Blast radius: Enterprise-wide — document repositories, user data, workflow automation, and potential domain-level impact via integration. Frequently used in ransomware and nation-state operations for initial foothold or data staging. Propagation risk moderate via compromised accounts or lateral movement scripts. Veracode: EASM for exposed instances; Risk Manager for unified KEV + AppSec risk scoring; DAST for runtime validation of SharePoint-like custom portals.

Ransomware campaigns:

Root cause typically unpatched edge vulnerabilities (exactly the KEV class above), stolen creds, or phishing. Mechanism: Initial access → discovery/lateral movement → encryption + exfil. Blast radius: Organization-wide operational shutdown, regulatory exposure, and ransom demand. High blast because modern groups combine speed with data leverage. No direct tie to today's new KEVs in public reporting, but the pattern matches perfectly. Veracode reduces success probability by shrinking the vulnerable external surface (EASM) and enforcing rapid KEV remediation (Risk Manager).

Broader Signals

Ransomware tracking platforms show consistent daily activity (~14 new incidents in last 24h window per live feeds) with groups actively naming victims. X volume on specific CVEs/KEVs remains low-signal in latest mode (early post-KEV phase). No credible reports of new worm variants, Mini-Shai-Hulud-style OSS propagation, or large-scale credential-harvesting malware in public OSS registries during the sweep window. APT activity historically targets SharePoint and perimeter appliances; continued monitoring warranted but no new nation-state campaign indicators surfaced today.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities):
  • https://docs.veracode.com/r/Software_Composition_Analysis
  • https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context):
  • https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA):
  • https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities):
  • https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing):
  • https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery):
  • https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security:
  • https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement):
  • https://docs.veracode.com/r/c_appsec_policies

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure! https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• Shai-Hulud/Miasma/Mini Shai-Hulud supply chain worm + new fake payment SDK malicious packages (npm/PyPI, published ~July 7–8, 2026): Self-propagating credential-harvesting campaign abusing binding.gyp ("Phantom Gyp") for install-time execution, typosquatting, and maintainer/CI compromise. Hundreds of packages historically affected; new cluster (paysafe-*, skrill-*, neteller-*) steals CI/CD secrets, tokens, and env data. Atomic Risk: 9/10. First-principles: OSS registry trust + automated npm install/pip install creates autonomous blast radius to every downstream dev/CI environment. Strong Veracode applicability: Package Firewall + SCA.
• CISA KEV addition (2026-07-13): CVE-2008-4128 Cisco IOS CSRF: Legacy but now confirmed actively exploited vector for remote command execution on exposed routers. Atomic Risk: 7/10. Why now: BOD 26-04 mandates rapid action on exposed assets granting total control.
• Actively exploited KEVs (added ~July 7, deadlines recent/passed): Adobe ColdFusion CVE-2026-48282 (CVSS 10.0 path traversal $\rightarrow$ RCE), Joomla Page Builder CVEs CVE-2026-48908/CVE-2026-56290 (CVSS 10.0 unauth file upload/RCE), Langflow CVE-2026-55255 (CVSS 8.4 IDOR/authz bypass $\rightarrow$ arbitrary flow execution). Atomic Risk: 9/10. High in-wild exploitation confirmed.
• Ongoing ransomware (Settra, The_Gentlemen/Thegentlemen, Gunra, Medusa Locker, Qilin, Stormous active July 2026): Steady victim volume fueled by infostealer/credential campaigns (e.g., FortiBleed linked to INC/Lynx). No single new mega-campaign in last 24h but high operational tempo.
• Broader signals: Evolving worm tactics (binding.gyp evasion, loader mutations, legitimate project weaponization); NK-linked supply chain (Sapphire Sleet/BlueNoroff); public PoCs for select Linux kernel issues. Supply chain remains highest blast-radius vector.

All items deduplicated and ranked by CVSS $\ge$ 7.0 OR KEV OR public exploit/in-wild OR supply-chain propagation risk.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Shai-Hulud/Miasma supply chain worm (incl. July 2026 payment SDK campaign):

• Root Cause: Compromise of maintainer accounts or CI/CD pipelines (via stolen OIDC/GitHub tokens), followed by injection of a malicious payload into the publish pipeline or a direct malicious version upload.
• Mechanism: The binding.gyp file (normally for native addons) is processed by node-gyp at install time. This executes attacker JavaScript that harvests .env files, npm/PyPI/GitHub/cloud tokens, SSH keys, Vault data, and CI secrets. It then exfiltrates and uses these stolen credentials to republish more malicious versions (worm propagation). The new July variant uses convincing SDK facades (like paysafe-checkout) with sandbox evasion.
• Blast Radius: Any direct or transitive dependency triggers infection upon installation. Stolen secrets enable full GitHub organization takeovers, cloud account compromise, and further downstream poisoning.
• Propagation Risk: High — fully autonomous across registries.
• Veracode Control Point: SCA + Package Firewall gates at dependency resolution and CI/CD to detect and block threats before execution; Policy Management enforces compliance.

CVE-2026-48282 Adobe ColdFusion (and similar Joomla/Langflow KEVs):

Root cause is insufficient path validation (CWE-22) or improper access control allowing unauthenticated file upload/overwrite or IDOR leading to RCE/flow execution. Actively exploited in wild with public indicators. Blast radius: Full compromise of internet-facing instances (code execution in context of app user, potential lateral movement). Why matters now: KEV addition + BOD 26-04 creates hard federal deadlines; unpatched = immediate target. Veracode control point: DAST for runtime confirmation on exposed apps; Risk Manager for KEV-aware prioritization across portfolio.

CVE-2008-4128 Cisco IOS CSRF:

Root cause is insufficient CSRF protection in legacy HTTP admin interface. Now confirmed actively exploited. Blast radius: Remote command execution on exposed routers (legacy but still internet-facing in many environments). Veracode control point: EASM to discover exposed assets + Risk Manager (KEV) for unified tracking and policy enforcement.

Broader Signals

High signal volume on supply chain (Sonatype tracking cumulative 1.8M malicious packages; new Miasma waves + payment SDK cluster). Worm tactics evolving rapidly (binding.gyp/Phantom Gyp bypass, loader mutations for evasion, typosquatting + weaponization of legitimate projects). APT notes: North Korea-linked (Sapphire Sleet) supply chain campaigns targeting AI/dev tooling; ongoing credential theft feeding ransomware. X/web chatter elevated on #ShaiHulud, malicious packages, and recent KEVs. No major silent sources.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities):
  • https://docs.veracode.com/r/Software_Composition_Analysis
  • https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context):
  • https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA):
  • https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities):
  • https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing):
  • https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery):
  • https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security:
  • https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement):
  • https://docs.veracode.com/r/c_appsec_policies

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• Miasma / Phantom Gyp npm supply chain worm (Shai-Hulud lineage): Self-propagating credential-harvesting worm abusing binding.gyp / node-gyp for install-time execution. 57+ packages / 286+ malicious versions (high-download targets like @vapi-ai/server-sdk). Ongoing variants into late June. Atomic Risk: 9/10. First-principles: Maintainer compromise + novel bypass of script-hook detection enables CI/CD takeover and ecosystem-wide propagation via stolen cloud/OSS creds. Strong Veracode fit: SCA + Package Firewall.

• CVE-2026-48282 Adobe ColdFusion Path Traversal (KEV added 2026-07-07): Fresh CISA addition confirming active exploitation. Atomic Risk: 8/10. Path traversal as reliable initial access vector for ransomware/APT follow-on.

• CVE-2026-45659 Microsoft SharePoint RCE (recent KEV, deserialization): Actively exploited on enterprise collaboration platform. Atomic Risk: 9/10. Broad internal blast radius.

• CVE-2026-11645 Chromium V8 zero-day (KEV) + ongoing ransomware (SafePay leading recent claims) remain high-signal but secondary to supply chain worm this cycle.
•  

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Miasma / Phantom Gyp npm worm: Root cause = compromised maintainer accounts (social engineering/credential theft) publishing trojanized versions. Mechanism = weaponized binding.gyp (normally benign for native addons) triggers node-gyp execution at npm install time — evades most package.json preinstall/postinstall scanners. Payload exfiltrates env vars, tokens, validates access, then self-publishes malicious versions of victim's other packages and injects CI steps. Blast radius = extreme (supply chain worm): poisons high-download packages → thousands of downstream builds/CI runners compromised → cloud credential theft enables ransomware/APT lateral movement. Propagation risk highest in OSS-dependent orgs with weak package governance. Veracode control point: SCA + Package Firewall detects embedded malicious code and blocks at ingest/CI before install.

CVE-2026-48282 Adobe ColdFusion: Classic path traversal (CWE-22 class) allows arbitrary file read/write on server. Why it matters now: Fresh KEV confirmation means adversaries are actively chaining it for initial access. ColdFusion often runs legacy enterprise apps with high data sensitivity. Immediate patch + exposure reduction is non-negotiable.

CVE-2026-45659 SharePoint: Deserialization of untrusted data → RCE. High-value target for internal network pivoting and data exfil. KEV status demands top-tier prioritization.

Broader Signals

X (Latest mode) shows routine CVE chatter (Palo Alto PAN-OS disclosures today) and general ransomware discussion; no massive new zero-day PoC dump or brand-new ransomware campaign spike in strict last 24h. Miasma volume peaked with June waves but variants (e.g., Leo Platform) keep the campaign live. Credential theft (e.g., FortiBleed) continues feeding ransomware. APT notes limited in window but China-linked activity observed on older vectors.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities): https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context): https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA): https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities): https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing): https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery): https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security: https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement): https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

Malicious Packages & Supply Chain Worms

Threat: Miasma Phantom Gyp / Shai-Hulud variants (binding.gyp worm, credential harvesting, self-propagation). Why fits: Only tool that directly detects embedded malicious code in OSS packages and enforces real-time blocking of known-bad versions in pipelines. Customer action: Enable Package Firewall malicious package policies + strict SCA gates in every npm/CI/CD pipeline today; full historical scan for affected packages. Tool: SCA + Package Firewall

New/KEV CVEs

Threat: CVE-2026-48282 (Adobe ColdFusion), CVE-2026-45659 (SharePoint). Why fits: Unified exploitation-context view + automated prioritization across all findings. Customer action: Ingest these KEVs into Risk Manager; apply 24–72h SLAs for internet-facing assets; trigger Fix on any custom integrations. Tool: Risk Manager (KEV)

Web/Runtime Exploits

Threat: SharePoint RCE, Adobe ColdFusion path traversal, Chromium V8. Why fits: Identifies runtime-exploitable issues (deserialization, traversal) in live web/apps that static analysis misses. Customer action: Targeted DAST scans on all exposed SharePoint/ColdFusion instances; prioritize high findings for immediate fix. Tool: DAST

External Attack Surface

Threat: Exposed ColdFusion/SharePoint servers under active exploitation. Why fits: Discovers unknown exposed assets and correlates with KEV risk. Customer action: Run EASM discovery; map exposed assets to new KEVs; remediate or shield. Tool: EASM + Risk Manager

Governance

Threat: All above require consistent enforcement. Customer action: Update Policy Management to mandate Package Firewall + SCA pass for OSS, KEV prioritization, and DAST for web apps before any production deploy. Tool: Policy Management

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary (2026-07-07)

Top threats:

• Ongoing npm/PyPI/OSS supply chain worms (Miasma/Shai-Hulud lineage, PolinRider, Lazarus-linked): Persistent malicious package campaigns targeting developers/CI/CD. High propagation via dependencies. Atomic Risk: 9/10. First-principles: Trust in OSS registries broken at source; one compromised maintainer/CI poisons thousands of downstream apps. Strong Veracode SCA/Package Firewall applicability.
• CVE-2026-46242 "Bad Epoll" (Linux kernel epoll UAF/race, PoC public): Local root on affected kernels (6.4+), desktops/servers/Android. Atomic Risk: 8/10. Unprivileged escalation vector in core I/O subsystem.
• CVE-2026-48558 SimpleHelp RMM auth bypass (KEV, actively exploited): Unauth privileged access, malware delivery (Djinn Stealer). ~1k–14k exposed. Atomic Risk: 9/10. RMM as high-value initial access.
• CVE-2026-55200 libssh2 client RCE (public PoC): Malicious SSH server triggers heap corruption on connect. Atomic Risk: 8/10. Client-side risk in tooling/automation.
• CVE-2026-42897 Exchange OWA (prior zero-day activity): Crafted email spoofing/XSS. Ongoing relevance for on-prem. Atomic Risk: 7/10.

No major new 24h ransomware zero-days, but agentic ransomware (JadePuffer) signals automation evolution; persistent group activity (Qilin, Gentlemen, etc.).

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

• Supply chain worms: Root cause = maintainer/CI compromise + weak review (e.g., node-gyp, GitHub Actions poisoning). Mechanism: Malicious deps steal creds, self-propagate. Blast radius: Exponential via transitive deps; hits AI/dev tooling hard. Veracode control: Package Firewall blocks at ingest; SCA for visibility.
• Bad Epoll: Race in epoll close paths (use-after-free). Local unpriv → root. Propagation risk high in containers/shared kernels. Patch kernel; audit exposure.

Broader Signals

Elevated X/Threat intel on supply chain + kernel exploits. Ransomware groups leveraging initial access brokers/stealers.

Veracode Tool Reference with Links

• SCA + Package Firewall: https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager: https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix: https://docs.veracode.com/r/About_Veracode_Fix
• SAST: https://docs.veracode.com/r/c_static_overview
• DAST: https://docs.veracode.com/r/DAST
• EASM: https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security: https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management: https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

• Malicious Packages & Supply Chain Worms: npm worms/PolinRider. SCA + Package Firewall fits for dependency scanning/blocking. Action: Enable Package Firewall policies for high-risk registries; scan all CI/CD pipelines.
• New/KEV CVEs: Bad Epoll, SimpleHelp, libssh2. Risk Manager for prioritization/KEV context. Action: Ingest into Risk Manager, triage by blast radius.
• Web/Runtime/External: Exchange/SimpleHelp. EASM + DAST. Action: Run EASM for exposed RMM/web apps.
• Containers: Kernel/container risks. Container Security. Action: Scan images/k8s.
• Governance: Policy Management for enforcement across findings.

Prioritized Action Plan (SMART, Today)

• Enable/audit SCA + Package Firewall for all OSS/CI/CD pipelines; block unvetted npm/PyPI (due EOD).
• Patch/update kernels/libssh2/SimpleHelp/Exchange mitigations; verify via Risk Manager (complete in 24h).
• Run targeted EASM on exposed assets + DAST on web/RMM endpoints.
• Update policies in Policy Management for KEV/supply chain rules.
• Scan containers with Container Security; remediate via Veracode Fix where applicable.

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• Ongoing npm supply chain worms (Miasma/Shai-Hulud variants, binding.gyp/Phantom Gyp technique): Self-propagating malicious packages steal CI/CD credentials, SSH keys, cloud tokens; high propagation risk via npm install. Atomic Risk: 9/10 — first-principles: trust in OSS registries broken at install time; worms self-replicate, evading script-based detection. Strong Veracode applicability.
• CVE-2026-45659 (Microsoft SharePoint RCE, CISA KEV added ~2026-07-01): Deserialization flaw enabling remote code execution. Atomic Risk: 8/10 — network-reachable enterprise software; ransomware potential.
• CVE-2026-0257 (Palo Alto GlobalProtect auth bypass, actively exploited): VPN authentication bypass. Atomic Risk: 8/10 — edge access compromise enables lateral movement.
• CVE-2026-33825 (Microsoft Defender BlueHammer LPE, ransomware use): Privilege escalation. Atomic Risk: 7/10 — post-compromise escalation vector.
• PolinRider (North Korean): 108+ malicious packages/extensions across npm/Packagist/Go. Atomic Risk: 8/10 — targeted supply chain for credential theft.

No major new 24–48h zero-days with public PoCs beyond ongoing campaigns; focus remains supply chain persistence and recent KEV.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

• Miasma/Shai-Hulud: Root cause = weak npm registry trust + install-time execution (node-gyp via binding.gyp bypasses package.json checks). Mechanism: credential harvest → self-publish malicious variants → worm propagation. Blast radius: thousands of workflows/repos; steals AWS/GCP/K8s/SSH. Veracode control: SCA + Package Firewall blocks at source.
• SharePoint CVE-2026-45659: Deserialization of untrusted data → RCE. High blast radius in enterprise collab tools. Prioritize via Risk Manager for KEV context.
• Supply chain worms prioritize over isolated CVEs due to transitive trust failure across ecosystems.

Broader Signals

• X volume low on brand-new exploits in last 24h; sustained chatter on supply chain (Miasma variants).
• Ransomware activity ongoing (INC, others); no massive new campaigns in last 48h.
• North Korean PolinRider expansion signals persistent developer tooling targeting.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities): https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context): https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA): https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities): https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing): https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery): https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security: https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement): https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

• Malicious Packages & Supply Chain Worms: Miasma/Shai-Hulud/PolinRider. SCA + Package Firewall fits — blocks malicious OSS at ingest/CI. Action: Enable policies for high-risk registries and enforce in pipelines.
• New/KEV CVEs: SharePoint CVE-2026-45659, SimpleHelp, Defender. Risk Manager fits — KEV prioritization/unified view. Action: Ingest KEV items, triage by blast radius.
• External Attack Surface: Palo Alto GlobalProtect. EASM + Risk Manager fits — discover exposed VPNs. Action: Scan external assets, enforce patching.
• Governance: All findings. Policy Management fits — enforce controls. Action: Update policies for SCA/KEV.

Prioritized Action Plan

• Enable SCA + Package Firewall policies for malicious packages/OSS worms; enforce in all CI/CD today. Rotate exposed credentials.
• Run Risk Manager on new KEV (SharePoint, Defender, SimpleHelp); prioritize patching with BOD 22-01 alignment.
• EASM scan for exposed GlobalProtect instances; patch PAN-OS immediately.
• Audit npm/PyPI/Packagist deps with SCA; block binding.gyp anomalies.
• Update Policy Management for automated enforcement and reporting.
• Monitor X/KEV feeds daily; re-scan post-remediation.

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• CVE-2026-45659 (Microsoft SharePoint RCE): Actively exploited; CISA KEV addition July 1. Deserialization flaw allows authenticated (low-priv) network RCE. Atomic Risk: 9/10. Immediate patching critical for enterprise collaboration platforms; strong Risk Manager + SAST/SCA applicability.
• CVE-2026-8037 (Progress Kemp LoadMaster): Pre-auth OS command injection RCE (CVSS ~9.6–9.8); active exploitation + public PoC. Targets load balancers. Atomic Risk: 9.5/10. High blast radius in network infrastructure.
• Ongoing Mini Shai-Hulud/Miasma npm supply chain worms: Credential harvesting via malicious packages (binding.gyp, postinstall hooks); affects Red Hat Cloud Services, LeoPlatform, and related ecosystems. Persistent propagation risk in CI/CD. Atomic Risk: 9/10. Prioritize SCA + Package Firewall.
• Broader signals: Routine ransomware activity (Qilin, etc.); Chrome renderer/sandbox issues; no silent major zero-days dominating last 48h beyond above. Supply chain remains highest velocity vector.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

• SharePoint CVE-2026-45659: Root cause = deserialization of untrusted data (CWE-502). Mechanism: Authenticated attacker crafts payload triggering RCE. Blast radius: Enterprise file/collaboration compromise, lateral movement. Veracode control: Risk Manager for KEV prioritization + SAST for custom code paths.
• Kemp LoadMaster CVE-2026-8037: Pre-auth command injection via API (heap/uninitialized issues). Why now: Public PoC accelerates exploitation. Propagation: Network appliances as entry points. Veracode: EASM for exposed assets.
• npm Supply Chain (Miasma/Shai-Hulud variants): Root = maintainer compromise + install-time execution (binding.gyp bypasses). Blast radius: Secrets theft → CI/CD takeover → downstream supply chain. Veracode: SCA + Package Firewall blocks at ingestion.

Broader Signals

Limited X volume on brand-new exploits in last 24h; focus remains on patching KEV items and npm campaigns. Persistent APT/ransomware activity noted but no fresh high-blast campaigns.

Veracode Tool Reference with Links

• SCA + Package Firewall: https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager: https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix: https://docs.veracode.com/r/About_Veracode_Fix
• SAST: https://docs.veracode.com/r/c_static_overview
• DAST: https://docs.veracode.com/r/DAST
• EASM: https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security: https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management: https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

• Malicious Packages & Supply Chain Worms: Mini Shai-Hulud/Miasma. SCA + Package Firewall fits for dependency scanning/blocking. Action: Enable policies for npm/PyPI; scan all repos.
• New/KEV CVEs: SharePoint CVE-2026-45659, Kemp CVE-2026-8037. Risk Manager (KEV) + EASM. Action: Prioritize in unified view; discover exposed assets.
• Web/Runtime Exploits: Exchange OWA. DAST. Action: Test exposed web apps/APIs.
• Governance: All. Policy Management. Action: Enforce across tools/CI-CD.

Prioritized Action Plan

• Patch CVE-2026-45659 and CVE-2026-8037 today; verify via Risk Manager.
• Enable SCA + Package Firewall policies for malicious npm packages; enforce in CI/CD.
• Run EASM scan for exposed LoadMaster/Exchange assets; apply mitigations.
• Audit dependencies with SCA; use Veracode Fix for remediations.
• Update Policy Management for KEV prioritization and governance.
• Monitor X/vendor feeds; re-scan tomorrow.

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Miasma / Mini Shai-Hulud / Phantom Gyp relevance: Relevant and high-priority. The June 24–25 Leo Platform wave (20+ packages in seconds via compromised maintainer + binding.gyp "Phantom Gyp" execution) is the latest in a persistent Shai-Hulud/Miasma/Hades lineage. No brand-new massive wave in the last 24–48h, but the family remains active, evolving, and demonstrates real supply-chain worm behavior (credential theft, GitHub workflow injection, AI-assistant backdoors, CI/CD poisoning). Blast radius is extreme for any org with npm/PyPI/Go deps or developer workflows. It is not fading noise — it is a live example of why SCA + Package Firewall exists. Veracode applicability is direct and strong. Flag: treat affected environments as potentially compromised until rebuilt from clean sources.

Executive Summary — Top Threats as of 2026-07-01

• CVE-2026-48558 (SimpleHelp RMM OIDC auth bypass): Critical (CVSS 10.0) active exploitation delivering Djinn Stealer/TaskWeaver. ~14k exposed instances; CISA KEV with July 2 deadline. Atomic Risk: 9/10. Why now: MSP/IT helpdesk foothold for credential theft and persistence. Strong Risk Manager (KEV) fit.
• Miasma/Phantom Gyp npm worm (Leo Platform + lineage): Ongoing supply-chain campaign stealing CI/CD/cloud/IDE secrets via install-time execution. Atomic Risk: 9/10. Why now: Demonstrates bypass of traditional script monitors; persistent family threat. Direct Package Firewall + SCA control point.
• CVE-2026-46817 (Oracle E-Business Suite Payments): Actively exploited in-wild (unauth file read/takeover) post-May patch. Atomic Risk: 8/10. Enterprise financial systems impact. Risk Manager + DAST.
• Chrome critical use-after-free / sandbox escape vulns in recent builds; broader ransomware "new normal" activity. No single explosive new zero-day dominating last 24h.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

• SimpleHelp CVE-2026-48558: Root cause = flawed OIDC token validation (accepts forged claims without signature check). Mechanism: unauth attacker creates privileged Technician session, bypasses MFA in some configs, gains remote control/script exec on managed endpoints. Blast radius: MSP/IT environments = broad downstream compromise. Veracode control: Risk Manager for KEV prioritization and unified view.
• Miasma/Phantom Gyp: Root cause = trust in node-gyp + binding.gyp file (command expansion executes attacker code at install without package.json scripts). Mechanism: obfuscated payload (ROT/AES), credential harvesting (env, tokens, GitHub, cloud metadata), GitHub dead-drop exfil, workflow/AI backdoor planting. Blast radius: worm-like propagation across OSS ecosystems + developer/CI machines. Why it matters: bypasses most legacy SCA/script monitors. Veracode control: SCA + Package Firewall blocks at source and enforces policy in pipeline. Propagation risk for supply-chain worms remains elevated — assume compromise until proven clean.

Broader Signals

X volume on Miasma/Leo wave has cooled from peak but references persist in threat bulletins. Ransomware steady ("new normal" with AI-assisted ops). No massive new APT zero-day surge in strict last 24h.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities):
• https://docs.veracode.com/r/Software_Composition_Analysis
• https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context):
• https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA):
• https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities):
• https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing):
• https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery):
• https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security:
• https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement):
• https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

• Malicious Packages & Supply Chain Worms (Miasma/Phantom Gyp/Leo wave): Package Firewall + SCA. Why: Directly detects/blocks malicious npm artifacts and enforces policy at ingest/CI. Customer action: Enable strict malicious-package policies + full SCA scans on all npm/PyPI projects today; rebuild affected repos from known-good lockfiles.
• New/KEV CVEs (SimpleHelp CVE-2026-48558, Oracle CVE-2026-46817): Risk Manager (KEV). Why: Unified prioritization with CISA deadlines and active exploitation context. Customer action: Import/prioritize these in Risk Manager; set aggressive SLAs and policy gates.
• Web/Runtime Exploits (Chrome + Oracle): DAST. Why: Validates runtime exposure on web-facing or integrated apps. Customer action: Targeted DAST on exposed Oracle/monitoring surfaces.
• Governance (all items): Policy Management. Why: Enforce consistent controls across tools and pipelines.

Prioritized Action Plan (SMART, executable today)

1. Highest priority: Enable Package Firewall policies for malicious packages + run full SCA scans on all npm/PyPI/Go projects; enforce in CI/CD (Miasma direct hit).
2. Prioritize Risk Manager (KEV) for SimpleHelp CVE-2026-48558 (July 2 deadline) and Oracle; update critical policies.
3. Run targeted DAST on internet-facing Oracle EBS and monitoring assets.
4. Audit/rebuild any Leo Platform or prior Miasma-affected npm usage from clean sources; rotate exposed credentials from clean host.
5. Policy Management sweep for OSS/dependency governance gaps.
6. SMART goal: Complete top SCA + Firewall enforcement + KEV triage in Risk Manager by EOD; zero high-risk malicious deps in production paths.

LEGAL DISCLAIMER

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• Cisco Unified CM CVE-2026-20230 (CVSS 8.6): Actively exploited SSRF leading to file writes/webshells/RCE on WebDialer-enabled systems. Public PoC driving automated sweeps. Atomic Risk: 9/10 — enterprise comms infrastructure; first-principles: unauth remote control path enables persistence/lateral movement. Strong Veracode applicability.
• Ongoing Miasma/Mini Shai-Hulud npm supply-chain worm variants: Credential theft + self-propagation via binding.gyp/node-gyp and maintainer compromises (e.g., Red Hat @redhat-cloud-services packages). High blast radius in OSS ecosystems. Atomic Risk: 9/10 — worms spread silently through dependencies/CI/CD. Prioritize SCA.
• Ransomware/Infostealer activity (Qilin, Anubis, StealC/Amadey disruptions): Persistent campaigns + credential harvesting feeding access brokers. Atomic Risk: 8/10 — enterprise endpoints/identity vectors.
• Recent WordPress plugin SQLi (e.g., CVE-2026-12077 critical): Unauthenticated database extraction. Atomic Risk: 7/10.
• Broader KEV/ongoing: Cisco SD-WAN zero-days and Ubiquiti items in recent KEV; no ultra-fresh mass additions in last 24h.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

• Cisco CVE-2026-20230: Root cause = improper input validation on HTTP requests enabling SSRF to file:// writes. Mechanism: PoC delivers formatted payloads for webshell drop. Blast radius: Comms backbone compromise → RCE/persistence; worms not yet reported but propagation risk high in exposed instances. Veracode control: EASM for exposure + Risk Manager prioritization.
• Miasma Supply Chain Worm: Root cause = compromised maintainer accounts + novel binding.gyp/node-gyp execution (bypasses some scanners). Mechanism: Steals GitHub/cloud creds, injects into pipelines, self-propagates. Blast radius: Hundreds of packages, dev workstations, downstream dependents; worm-like spread amplifies via OSS trust. Veracode control: SCA + Package Firewall for detection/enforcement in CI/CD.

Broader Signals

X volume moderate on Cisco exploitation; supply chain worms remain high-signal topic with variants (Miasma). No massive new zero-day spikes in last 24h; ransomware steady with infostealer ops disrupted but resilient. APT/credential theft feeds ransomware.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities): https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context): https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA): https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities): https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing): https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery): https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security: https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement): https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

• Malicious Packages & Supply Chain Worms: Miasma/Red Hat npm — SCA + Package Firewall fits for dependency scanning/firewalling malicious versions. Action: Enable Package Firewall policies and scan/rebuild CI/CD pipelines.
• New/KEV CVEs: Cisco/UniFi items — Risk Manager (KEV) for unified prioritization. Action: Import KEV into Risk Manager and triage high-blast assets.
• Web/Runtime Exploits: WP SQLi/Cisco SSRF — DAST + EASM. Action: Run DAST on exposed web apps/APIs; discover attack surface.
• Governance: All — Policy Management for enforcement. Action: Update critical policies with new findings.

Prioritized Action Plan

• Patch CVE-2026-20230 and audit WebDialer exposure today (EASM scan).
• Enable/scan with SCA + Package Firewall for npm/PyPI dependencies and enforce in CI/CD against Miasma variants.
• Run Risk Manager on KEV items (Cisco/UniFi) with SMART deadline: full remediation in 48h for critical assets.
• Credential hygiene + endpoint controls for ransomware vectors.
• Targeted DAST on web apps; update policies via Policy Management.

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.