• Public

Product & Security Tips

Skip Feed

  1. SamHouston (Veracode) asked a question.

    6h ago
    Veracode Daily Threat Intel Brief | 2026-11-03

    Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

    https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

     

    CISO Advisory Brief | Tuesday, November 3, 2026

    Labels: UNCONFIRMED = not independently confirmed; SIGNAL = early indicator; SINGLE SOURCE = one non-official source; CONFLICTING = sources disagree.

    Bottom line: A quieter day for new exploited CVEs: CISA added nothing to the KEV catalog between 31 Oct and 3 Nov (catalog read today). What changed is mostly follow-through. Ivanti customers who patched in October must patch again. The Cursor-marketplace Claude Code backdoor covers two versions, not one. A Synology ransomware wave is hitting unpatched NAS boxes. New malicious packages appeared in npm, PyPI and RubyGems. We also correct yesterday's GitLab fix version.

    1. Executive Snapshot (next 24-72 hours, in priority order)

    1. Re-patch Ivanti Connect Secure to 25.1.1.3 or 22.8R2.6, then hunt off the appliance. The October fix builds (25.1.1.2, 22.8R2.5) are still exposed to CVE-2026-111357 and CVE-2026-118527, chained with CVE-2026-104935 for unauthenticated root. The federal deadline for CVE-2026-111357 passed on 2 Nov, with forensic triage required. CVE-2026-118527 is due 13 Nov. Changed since 2 Nov: two sources now report that the activity evades Ivanti's Integrity Checker (Volexity via BleepingComputer; Rapid7 via Help Net Security), so a clean result is not an all-clear. Review domain-controller logs for LAPS and BitLocker-key queries and rotate the appliance's LDAP service credentials. (CISA KEV; Ivanti advisory; SecurityWeek; Help Net Security)

    2. Clean developer machines of the tampered Claude Code extension: both 2.1.312 and 2.1.313. Cursor's marketplace served them on 29 Oct (about 2:27 am-1:35 pm PT). Changed: Cursor's revised notice adds 2.1.312, which is also a genuine Anthropic version number, so the version alone does not prove infection. Check authorized_keys for the svc-telemetry key and run Cursor's remediation scripts (uninstalling is not enough). Then rotate credentials from a trusted machine. (Cursor notice; Microsoft Threat Intelligence; SecurityWeek)

    3. Block today's new malicious packages and confirm dependency-confusion controls. The packages are:

    • npm scopes @goparrot-dashboard and @goparrot-dashboard-api: 25 packages published 1 Nov (MAL-2026-18511).
    • PyPI skills-analyzer 0.1.0-0.1.2 and its dependency is-it-ai, a remote-executable loader (MAL-2026-18427).
    • RubyGems dopc-client 1.0.0 and 10.0.0 (MAL-2026-18518).
    • Make sure internal package scopes resolve only from the internal registry. (GitHub Advisory Database / OpenSSF official records)

    4. Update every Synology NAS and take DSM management off the internet. Synology warned on 29 Oct that attackers are exploiting a flaw patched in December 2024 (advisory SA-24:20) to encrypt data on outdated DSM. Victims report C3RB3R ransom notes. Synology has not said which CVE is being exploited. (Synology; BleepingComputer; The Hacker News)

    5. Fix GitLab to the official versions and close this week's KEV deadlines.

    • Correction: NVD lists the GitLab CVE-2026-97229 fixes as 19.2.8, 19.3.5 and 19.4.2. We found no source for yesterday's "19.5.1" and withdraw it. Its federal deadline passed on 1 Nov.
    • Brotli CVE-2026-111497 (rebuild Node.js and .NET images) and Adobe Commerce CVE-2026-48356 are due 10 Nov.
    • VMware ESX CVE-2026-41709 is due 11 Nov.
    • (NVD; CISA KEV)

     

    The full brief continues in the answers below: High-Visibility Breaches, Threat Landscape, Malicious Libraries, Critical Vulnerabilities, Underground and Leak Signals, Foresight, CISO Control Checklist, and Sources.

    Expand Post
    • 6 answers
    • 3 views
    1 of 6

    • SamHouston (Veracode)

      8. CISO Control Checklist

      • Inventory Ivanti ICS; upgrade to 25.1.1.3 / 22.8R2.6; hunt off the appliance; rotate LDAP service credentials — Tied to: Ivanti chain (Action 1). Owner: Network Security + Incident Response.
      • Sweep endpoints for svc-telemetry key and Claude Code 2.1.312/2.1.313 from Cursor; enforce an IDE-extension allowlist — Tied to: Cursor marketplace backdoor (Action 2). Owner: Endpoint/IT + Developer Experience.
      • Map internal package scopes to the internal registry only; block new MAL- packages; audit lockfiles from 23 Oct — Tied to: goparrot, is-it-ai, dopc-client, testmetest (Action 3). Owner: AppSec + Platform Engineering.
      • For worm-infected hosts: remove persistence before revoking tokens — Tied to: testmetest, tensorlake. Owner: Incident Response.
      • Disallow trust_remote_code; scan models before use; restrict AI-agent auto-execution — Tied to: Hugging Face Load/Mine; agent-lure repos. Owner: ML Platform + AppSec.
      • Audit CI for ci-sync-* branches, unexpected workflow runs and over-scoped secrets; prefer OIDC short-lived credentials — Tied to: Gheist, GhostAction, LiteLLM. Owner: DevOps / Platform Security.
      • Review OAuth apps and service-principal secrets; block device-code flow; alert on app-only sign-ins — Tied to: Storm-0940 / ARTEX, ConnectWise. Owner: Identity & Access Management.
      • Separate developer workstations from production signing and payment systems; brief staff on fake-recruiter lures — Tied to: Binance / TraderTraitor; DPRK AI lures. Owner: Security Engineering + Talent/HR comms.
      • Find all Synology NAS; update DSM; remove internet-facing management; keep offline backups — Tied to: C3RB3R (Action 4). Owner: IT Operations.
      • Track KEV deadlines: GitLab (correct versions), Brotli images, Adobe Commerce, VMware ESX — Tied to: KEV (Action 5). Owner: Vulnerability Management.
      • Check ransomware detections against SafePay advisory TTPs — Tied to: AA26-293A. Owner: Security Operations.

       

      Sources

      Publisher, title, date.

      • CISA - Known Exploited Vulnerabilities Catalog (read 3 Nov 2026); CISA Adds Two Known Exploited Vulnerabilities to Catalog (27 Oct 2026); AA26-293A #StopRansomware: SafePay Ransomware (20 Oct 2026)
      • NIST NVD - CVE-2026-97229 (modified 2 Nov 2026); CVE-2026-111357; CVE-2026-111497; CVE-2026-76418; CVE-2026-109618; CVE-2026-46300
      • FBI - North Korea Responsible for $6 Billion+ Binance Attack (31 Oct 2026); Holiday Scams
      • Ivanti - Security Advisory Ivanti Connect Secure (CVE-2026-104935) (updated 29 Oct 2026)
      • Cursor - Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) (29 Oct 2026, rev. 30 Oct)
      • Synology - Synology urges users to update DSM following ransomware attacks on outdated DSM versions (29 Oct 2026)
      • GitHub Advisory Database / OpenSSF - GHSA-726f-wf9g-5893 (3 Nov 2026); GHSA-r92r-m9r8-78vj; GHSA-8v7q-mrx4-jvfg (3 Nov 2026); GHSA-qq2r-xp7w-5r55
      • Barracuda - Pre-authentication authorization bypass and command injection advisory (2 Nov 2026)
      • Okta - Command execution via admin console input in Okta Access Gateway (CVE-2026-115547) (22 Oct 2026)
      • SEC EDGAR - Revolve Group Form 8-K (29 Oct 2026); Florida Dept. of Education - Data Breach notice (29 Oct 2026); UNM Health Sciences - cybersecurity issue notice (26 Oct 2026); Alpine Linux - GitLab security incident (Oct 2026); Europol - Investment scams... over 100 servers seized (3 Nov 2026); UK NCSC - Annual Review 2026 (3 Nov 2026)
      • Microsoft Security Blog - Inside a malicious Claude Code-branded extension... (30 Oct 2026); Tracking AI adoption in North Korean threat actor tradecraft (29 Oct 2026); Storm-0940 uses ARTEX... (21 Oct 2026); Inside the LiteLLM 1.107.0 supply chain compromise (23 Oct 2026)
      • Sophos - AI used in Aur0ra ransomware testing and execution (29 Oct 2026); CrowdStrike - VAPOR PANDA uses ARTEX to scale global campaign (29 Oct 2026); Volexity - Chained exploitation of Ivanti Connect Secure zero-days (13 Oct 2026); Wiz - Gheist (25 Oct 2026); JFrog - Beyond testmetest (26 Oct 2026); GitGuardian - GhostAction x PolinRider (27 Oct 2026); Pluto Security - Load/Mine (29 Oct 2026); Socket - Searchjacked (29 Oct 2026), Firefox wallet impersonators (27 Oct 2026), tensorlake compromise (8 Oct 2026); TRM Labs - North Korea steals USD 6.36 billion from Binance (29 Oct 2026); LiteLLM - v1.107.0 security incident (21 Oct 2026)
      • SecurityWeek - Ivanti Patches Two More Zero-Days... (2 Nov 2026); Malicious Claude Code Extension Served in Cursor Supply Chain Attack (2 Nov 2026); Revolve Data Breach Impacts at Least 180,000 People (2 Nov 2026); Frontline Education Data Breach Impacts Over 1.3 Million (3 Nov 2026)
      • BleepingComputer - Synology warns of C3RB3R ransomware attacks targeting NAS devices (2 Nov 2026); Ivanti patches two more Connect Secure zero-days (2 Nov 2026); Alpine Linux rebuilds GitLab after attempted RCE attack (1 Nov 2026); Barracuda warns of critical flaws... (3 Nov 2026); Chainalysis discloses data breach... (Oct 2026); UNM Health ransomware attack disrupts patient care (27 Oct 2026)
      • The Hacker News - Synology NAS Devices Targeted... (3 Nov 2026); FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist (1 Nov 2026); Attackers Chain Three Ivanti Connect Secure Flaws (31 Oct 2026); cPGuard update channel hijacked (3 Nov 2026); DarkBlinders (2 Nov 2026)
      • Help Net Security - CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (2 Nov 2026); Aur0ra ransomware AI agents (2 Nov 2026)
      • The Record - Michigan State University BYOD incident (2 Nov 2026); Mercado Bitcoin heist (2 Nov 2026); Sandworm grain-firm wiper (22 Oct 2026). CyberScoop, GovExec, CNBC - DHS staff leak (28-29 Oct 2026). CoinDesk - North Korea denies role (3 Nov 2026). Unchained - FBI wallet list (2 Nov 2026)
      • HackerFeeds, Breachsense, Comparitech - October 2026 ransomware statistics; Bitsight - underground data-breach feed; Dataminr - Okta-themed phishing intel brief (19 Oct 2026)

       

      This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

      Expand Post

  2. SamHouston (Veracode) asked a question.

    Edited November 2, 2026 at 7:53 PM
    Veracode Daily Threat Intel Brief | 2026-11-02

    Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

    https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

     

    CISO Advisory Brief | Monday, November 2, 2026 | Coverage: last 24 hours, 7 and 30 days

     

     

    1. Executive Snapshot

    Five actions for the next 24 to 72 hours, in priority order.

    1. Patch PHP2Shell and the Linux kernel flaw that chains with it. CISA lists CVE-2026-109618 and CVE-2026-109619 as exploited (added October 26, federal due date October 29) and says Linux kernel CVE-2026-46300 can be chained with them to plant PHP webshells and run commands as root (added October 28, due October 31). Move PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, patch kernels, and include PHP embedded in vendor products and appliances.
    2. Patch Ivanti Connect Secure, then hunt for compromise. CISA added CVE-2026-111357 (federal due date today, November 2) and CVE-2026-118527 (due November 13) on October 30. Both were used as zero-days alongside CVE-2026-104935. A clean result from Ivanti's Integrity Checker does not rule out compromise (single source: Volexity via Help Net Security), so preserve logs and memory before resetting.
    3. Upgrade self-managed GitLab. CVE-2026-97229 allows unauthenticated code execution through a crafted regular expression in CI/CD configuration; CISA added it on October 29 and the federal due date passed yesterday. Move to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, which also fix the unexploited CVSS 10 flaw CVE-2026-110264. Then rotate tokens, deploy keys and server secrets.
    4. Find every bundled copy of the Brotli decoder (CVE-2026-111497, Node2Shell). CISA added it October 27 with a November 10 federal due date. Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4 and Brotli libraries to 1.0.10, 1.1.1 or 1.2.1, then rebuild and redeploy container images.
    5. Sweep developer tooling for three confirmed supply-chain campaigns. Search every repository, private ones included, for ci-sync-* branches and a sync-check workflow (Gheist). Look for .github/init.js and unexpected Claude, Gemini, Cursor or VS Code settings files (testmetest). Check developer machines for the SSH key labeled svc-telemetry from the tampered Claude Code extension on Cursor's marketplace. On any machine hit by testmetest, remove persistence before revoking tokens.

     

    2. High-Visibility Breaches

    • Binance — About $6.3B in crypto left Binance wallets on October 29, mostly within about 20 minutes; Binance says it will cover customer losses. Attacker/method: FBI attributes it to North Korea's TraderTraitor. Binance's preliminary finding is a compromised DevOps engineer's laptop; TRM Labs assesses the hot-wallet signing infrastructure was compromised. Confidence: Attribution confirmed (FBI). Root cause UNCONFIRMED. Sources conflict on the loss ($6.3B to $6.43B) and on chains hit (10 or 11).
    • ConnectWise customers — Storm-0940 used compromised ConnectWise Cloud Backup application identities to attempt sign-ins to more than 2,250 Microsoft 365 tenants; some saw persistence and privileged-role changes. Attacker/method: China-state aligned Storm-0940, using the ARTEX agentic AI framework. In some cases initial targeting to privileged cloud access took under 3 hours. Confidence: Confirmed (Microsoft original report, SecurityWeek, CyberScoop). Tenant count is attempts, not confirmed data loss.
    • Polymarket (via DebugBear) — About $2.7M drained on October 29; Polymarket is refunding $3.9M in total, including losses from the trading halt. Attacker/method: DebugBear's DNS was hijacked through its registrar and served a wallet-draining script that reused traders' live sessions. Confidence: Confirmed by both companies. Wallet count differs: 726 (Polymarket) vs 737 (Bitquery).
    • Cursor Marketplace — Tampered Claude Code extension versions 2.1.312 and 2.1.313 were live for about 11 hours on October 29; up to 5,000 users. Attacker/method: Adds an attacker SSH key and reverse tunnel with startup persistence. How the attacker published to Cursor's marketplace is not explained. Confidence: Confirmed (Cursor notice, Microsoft analysis). Anthropic says its own channels were unaffected (single source).
    • Keystone — Device-authentication key and 25,964 buyer records exposed; 18,835 devices in stock will be destroyed. Attacker/method: A flaw in a third-party data monitoring tool on its website was used to escalate privileges; found October 20. Confidence: Confirmed by company (two sources).
    • Chainalysis — Customer user IDs, names, email addresses and role labels accessed. Attacker/method: Company says the attacker used offensive agentic techniques; entry point and actor not disclosed. Confidence: Confirmed by company (two sources); scope still under investigation.

     

    The full brief continues in the answers below: Threat Landscape, Malicious Libraries, Critical Vulnerabilities, OSINT, Foresight, CISO Control Checklist, and Sources.

    Expand Post
    • 5 answers
    • 6 views
    1 of 5

    • SamHouston (Veracode)

      Sources

      Main sources: CISA KEV catalog and alerts (Oct 26-30); PHP.net security advisories (Oct 21, 23); Node.js security releases (Oct 21); NIST NVD; FBI alert on Binance (Oct 31); TRM Labs (Oct 29); Microsoft Security Blog on Storm-0940 and ARTEX (Oct 21) and on the Claude Code extension (Oct 30); Cursor security notice (Oct 29); JFrog Security Research on testmetest (Oct 26); Wiz Research on Gheist (Oct 25); GitHub Advisory Database and OSV; Help Net Security, SecurityWeek, BleepingComputer, The Hacker News, The Register, CyberScoop, InfoWorld, Techzine, HackerFeeds and Ransomnews.

      Corroborate high-impact actions with your own telemetry and vendor advisories.

       

      This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

      Expand Post

  3. SamHouston (Veracode) asked a question.

    October 6, 2026 at 8:39 PM
    Veracode Daily Threat Intel Brief | 2026-10-06

    Written by Andrea Mazzarini, Senior Principal CSM at Veracode

    Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

    Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

    https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

    Daily Threat Intel Brief — 6 October 2026

    Executive Summary

    Posture: Severe. The known-exploited catalog remains at 1,734 entries, snapshot 2026.10.04 (released 4 October) — no catalog adds dated 5–6 October this run.

    • Citrix NetScaler CVE-2026-88779 (Atomic Risk 10) — due TOMORROW Wednesday 7 October; forensic triage Yes; vendor CVSS 8.7; SAML SP/IdP memory overflow → denial of service on unmitigated deployments; vendor-confirmed targeted exploitation; September 88771/88772 fixed builds do not close this row — primary co-lead with Wednesday fuse.
    • Fortinet FortiMail CVE-2026-104286 (Atomic Risk 10) — due ELAPSED Sunday 4 October; forensic triage Yes; CVSS 9.8; unauth path traversal + NULL-byte → arbitrary file write; fixed builds 8.0.2 / 7.6.7 / 7.4.9 now SHIPPED (advisory solution update 5 October; release notes confirm CWE-22 closed on 8.0.2 and 7.6.7) — force upgrade now; 7.2 migrate to fixed 7.4+; workaround remains until patched.
    • Zammad CVE-2026-102489 + Zammad CVE-2026-102490 (Atomic Risk 10) — due ELAPSED Monday 5 October; forensic triage Yes; CVSS 9.4/9.4; session fixation → RCE as the zammad user, chainable to local privilege escalation to root — force 7.2.0+; confirmed fix for 102490 still not shipped this run (vendor states solution in progress); 7.2.1 released 6 October addresses other issues and does not claim these two catalogued rows.
    • Apple CoreGraphics CVE-2026-86950 (Atomic Risk 10) — due ELAPSED Friday 2 October; forensic triage Yes; CVSS 8.8; public crash PoC via crafted PDF with embedded font circulating; sophisticated targeted ITW on iOS before iOS 27 — residual, not closed.
    • Cisco Catalyst SD-WAN Manager CVE-2026-76504 (Atomic Risk 10) — due ELAPSED Saturday 3 October; forensic triage Yes; CVSS 9.8; URI/hex auth bypass → unauth admin API; no workaround — residual, not closed.
    • Citrix NetScaler CVE-2026-88771 + Citrix NetScaler CVE-2026-88772 (Atomic Risk 10) — due ELAPSED Wednesday 30 September; forensic triage Yes; vendor CVSS 9.5/9.5; vendor-confirmed zero-day ITW continues — keep 88779 distinct.
    • WordPress Core CVE-2026-87902 (Atomic Risk 10) — due ELAPSED Monday 28 September; forensic triage Yes; CVSS 8.1; mass opportunistic exploitation post-disclosure.
    • Microsoft SharePoint CVE-2026-65660 (Atomic Risk 10) — due ELAPSED Monday 28 September; forensic triage Yes; CVSS 8.8; residual ransomware-Known SharePoint CVE-2026-45659 stays named.
    • MikroTik RouterOS CVE-2026-67279 + MikroTrick → MikroTik RouterOS CVE-2026-86060 (Atomic Risk 10) — 67279 due ELAPSED Monday 28 September; FT No on 67279 / FT Yes on 86060; sibling MikroTik RouterOS CVE-2026-67277 residual.
    • WSO2 CVE-2026-5430 + Adobe Commerce/Magento CVE-2026-71362 (Atomic Risk 10) — both due ELAPSED Sunday 27 September; FT Yes; CVSS 10.0 / 9.1 — keep StyleSmuggler Magento/Adobe Commerce CVE-2026-75650 distinct.
    • Check Point CVE-2026-85102 + Check Point CVE-2026-93616 + F5 BIG-IP APM CVE-2026-94127 + Arista VeloCloud Orchestrator CVE-2026-93952 (Atomic Risk 10) — all due ELAPSED Friday 25 September; FT Yes.
    • Artifactory CVE-2026-42018 + Artifactory CVE-2026-42016 + residual Artifactory CVE-2026-82329 (Atomic Risk 10) — Fri 25 elapsed token-chain + earlier FT Yes residual.
    • Shai-Hulud 7 Sep reactivation + Mini Shai-Hulud / openapi-react-query-codegen / ChainDrop / Coder registry / crates.io arrayref / yane88 / Miasma (Atomic Risk 9) — named worms auto-elevated; stubs re-verified 6 October; no new self-propagating wave 11 September–6 October.

     

    Expand Post
    • 5 answers
    • 23 views
    1 of 5

    • SamHouston (Veracode)

      Coverage Self-Audit

      Reviewed:

      • Catalog adds: live 2026.10.04 / 1,734 — unchanged vs 5 October edition; zero adds dated 5–6 Oct; Citrix NetScaler CVE-2026-88779 dated 4 Oct remains newest; Zammad CVE-2026-102489 + Zammad CVE-2026-102490 dated 2 Oct; Fortinet FortiMail CVE-2026-104286 dated 1 Oct
      • Due clocks: due TOMORROW Wed 7 Oct Citrix 88779; ELAPSED Mon 5 Zammad pair; ELAPSED Sun 4 FortiMail; ELAPSED Sat 3 Cisco 76504; ELAPSED Fri 2 Apple 86950; ELAPSED Wed 30 Citrix 88771/88772; ELAPSED Mon 28 WordPress/SharePoint/MikroTik; ELAPSED Sun 27 WSO2/Adobe; ELAPSED Fri 25 edge cluster
      • In-the-wild CVEs and elapsed residual catalog rows named in body
      • Supply-chain worms: Shai-Hulud, Mini Shai-Hulud, openapi-react-query-codegen, ChainDrop, Coder registry, crates.io arrayref, yane88, Miasma named — not folded into anonymous registry residual
      • Ransomware/RaaS: vCenter knownRansomwareCampaignUse=Known retained; SharePoint CVE-2026-45659 Known retained; Cisco FMC CVE-2026-20316 Known noted
      • APT/nation-state/IAB: Apple row frames sophisticated targeted exploitation — actor unattributed this run; no separate new confirmed high-visibility APT development beyond that vendor language — stated
      • Underground via public trackers: no standalone breach/incident dump elevated into this vuln-focused edition

      Silent only where nothing in window. Every defining in-horizon event is named in the body above. Self-audit mustNames: PASS.

       

      This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

      Expand Post

  4. SamHouston (Veracode) asked a question.

    September 30, 2026 at 7:35 PM
    Veracode Threat-to-Control Daily Command Brief | 2026-09-30

    Written by Andrea Mazzarini, Senior Principal CSM at Veracode

     

    Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

     

    Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

    https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

     

    Executive Summary

    1. MemOS / sckit dual-registry worm (23 Sep) — npm @memtensor/memos-cloud-openclaw-plugin 0.1.21/0.1.23/0.1.25 and PyPI MemoryOS 2.0.34 carry a runtime Go stealer that harvests registry, SCM, cloud, SSH, and AI-platform tokens and is built to re-publish. Impact: developer and CI identity takeover, then package fan-out. Atomic Risk 9. Why now: inside last_7_days, install-hook scanners miss it. Veracode: Package Firewall + SCA + SSCI; rotate secrets on any host that imported it.
    2. Shai-Hulud family persistence (ChainDrop + Mini Shai-Hulud GitHub reinfection) — ChainDrop poisoned high-download caching packages (keyv, cacheable, siblings; ~2B monthly downloads) with valid provenance; Mini Shai-Hulud payload still landing in GitHub repos this month. Atomic Risk 9. Why now: worms outlive takedowns; lockfiles and Actions remain dirty. Veracode: Package Firewall + SCA + SSCI + Policy.
    3. Citrix NetScaler dual KEV RCE (CVE-2026-88771 CVSS 9.8; CVE-2026-88772 CVSS 8.1) — unauthenticated command execution / memory-corruption RCE, exploited before patch, federal due 2026-09-30. Atomic Risk 9. Why now: due today. Veracode: EASM + Risk Manager (KEV) + DAST on apps behind the ADC.
    4. TeamCity CVE-2026-63077 now flagged for ransomware use — unauth agent-protocol bypass → OS command as the build-server process; ~160 internet-facing hosts still unpatched. Atomic Risk 9. Why now: last_7_days ransomware flag on a CI/CD crown jewel. Veracode: EASM + Risk Manager + Policy + Container Security / IaC on pipeline artifacts.
    5. Internet-facing app RCEs still hot + dark-web volume high — WordPress Core CVE-2026-87902 (KEV, unauth LFI→RCE), Adobe Commerce/Magento StyleSmuggler CVE-2026-75650 (CVSS 10, in-wild RCE + Rust implants) and CVE-2026-71362 (KEV authz bypass); Apple CoreGraphics CVE-2026-86950 added to KEV yesterday (targeted). Qilin / The Gentlemen lead leak-site volume; rival takeover of a major leak site shows Grav/CMS web flaws in criminal infrastructure. Atomic Risk 8. Veracode: EASM + DAST + Risk Manager; SAST + DryRun + Fix for custom/AI storefront and agent code.

     

    Comprehensive Threats Table

     

    MemOS sckit worm (npm + PyPI, 23 Sep)

    CVSS: N/A (malware). Exploit status: In-wild worm; runtime trigger. Affected: AI-agent memory packages; CI/dev hosts. Atomic Risk: 9. Immediate mitigation: Pin npm 0.1.20 / PyPI 2.0.33 or remove; treat importers as compromised; rotate tokens; block C2. Veracode Tool Mapping: Package Firewall + SCA + SSCI.

     

    ChainDrop / Shai-Hulud on keyv/cacheable family

    CVSS: N/A (malware). Exploit status: Worm; valid provenance. Affected: npm caching stack, 1,300+ versions. Atomic Risk: 9. Immediate mitigation: Purge bad versions from lockfiles/caches; rotate GitHub/npm/cloud tokens; enforce firewall policies. Veracode Tool Mapping: Package Firewall + SCA + SSCI + Policy Management.

     

    Mini Shai-Hulud GitHub reinfection

    CVSS: N/A (malware). Exploit status: Ongoing repo infection. Affected: GitHub Actions / cloned repos. Atomic Risk: 8. Immediate mitigation: Hunt hook files and poisoned Actions; revoke PATs; block at install. Veracode Tool Mapping: Package Firewall + SCA + SSCI + Integrations.

     

    CVE-2026-88771 NetScaler input validation RCE

    CVSS: 9.8. Exploit status: KEV; exploited pre-patch. Affected: NetScaler ADC/Gateway. Atomic Risk: 9. Immediate mitigation: Patch today; isolate internet-facing appliances; forensic triage. Veracode Tool Mapping: EASM + Risk Manager.

     

    CVE-2026-88772 NetScaler memory RCE/DoS

    CVSS: 8.1. Exploit status: KEV; exploited pre-patch. Affected: NetScaler ADC/Gateway. Atomic Risk: 9. Immediate mitigation: Same as above. Veracode Tool Mapping: EASM + Risk Manager.

     

    CVE-2026-63077 TeamCity auth bypass RCE

    CVSS: ~9.8. Exploit status: KEV; ransomware use flagged. Affected: TeamCity On-Prem. Atomic Risk: 9. Immediate mitigation: Upgrade 2025.11.7 / 2026.1.3; take off internet; hunt implants. Veracode Tool Mapping: EASM + Risk Manager + Policy Management + Container Security.

     

    CVE-2026-87902 WordPress page-template LFI→RCE

    CVSS: 8.1 (9.2 alt). Exploit status: KEV; mass probing after patch. Affected: WordPress Core to 4.7 branches. Atomic Risk: 8. Immediate mitigation: Upgrade 7.1.2 or backports; hunt webshells. Veracode Tool Mapping: EASM + DAST + Risk Manager.

     

    CVE-2026-75650 StyleSmuggler Magento/Commerce RCE

    CVSS: 10.0. Exploit status: In-wild zero-day; implants. Affected: Adobe Commerce / Magento 2.4.4–2.4.9. Atomic Risk: 9. Immediate mitigation: Apply emergency hotfix; rotate store secrets; hunt Rust implants. Veracode Tool Mapping: EASM + DAST + Risk Manager.

     

    CVE-2026-71362 Commerce/Magento incorrect authz

    CVSS: 9.1. Exploit status: KEV. Affected: Adobe Commerce / Magento / B2B. Atomic Risk: 8. Immediate mitigation: Apply APSB26-92 train; verify authz on admin/API. Veracode Tool Mapping: EASM + DAST + Risk Manager.

     

    CVE-2026-65660 SharePoint code injection

    CVSS: High. Exploit status: KEV. Affected: Microsoft SharePoint. Atomic Risk: 8. Immediate mitigation: Patch; restrict external SharePoint; hunt webshells. Veracode Tool Mapping: EASM + DAST + Risk Manager.

     

    CVE-2026-86950 Apple CoreGraphics OOB write

    CVSS: 8.8. Exploit status: KEV yesterday; targeted. Affected: iOS/iPadOS/macOS. Atomic Risk: 7. Immediate mitigation: Update iOS/iPadOS 26.7.1, macOS 15.8.1 / 26.7.1. Veracode Tool Mapping: Risk Manager.

     

    CVE-2026-81963 / CVE-2026-85880 Windows EoP

    CVSS: 7.8. Exploit status: Exploited; Patch Tuesday. Affected: Windows Update Stack / ALPC. Atomic Risk: 7. Immediate mitigation: Confirm Sept 2026 patches landed. Veracode Tool Mapping: Risk Manager.

     

    OpenCode upgrade-API RCE (GHSA-632h-h47v-g4x4)

    CVSS: Critical (local agent). Exploit status: Public advisory; content-type confuse. Affected: OpenCode 1.14.30–1.18.21. Atomic Risk: 7. Immediate mitigation: Upgrade agent; bind UI off LAN; disable unauth local serve. Veracode Tool Mapping: SAST + DryRun + Policy Management.

     

    Vibe-coded IDOR / broken auth / missing authz

    CVSS: App-dependent. Exploit status: Research + live apps; residual. Affected: AI-generated web/API. Atomic Risk: 7. Immediate mitigation: Block merge on authz gaps; DeepScan high-churn services. Veracode Tool Mapping: SAST + DryRun + Fix.

     

    Qilin / The Gentlemen / Panzer / INC leak-site surge

    CVSS: N/A. Exploit status: Active extortion; OSINT leak sites. Affected: Mid-market + healthcare/tech. Atomic Risk: 8. Immediate mitigation: Assume initial access via creds/KEV/CI; harden identity. Veracode Tool Mapping: Risk Manager + EASM + Package Firewall.

     

    Grav CMS unauth upload used on criminal leak site

    CVSS: N/A. Exploit status: OSINT secondary. Affected: Exposed CMS. Atomic Risk: 6. Immediate mitigation: Inventory Grav/CMS on EASM; DAST those apps. Veracode Tool Mapping: EASM + DAST.

     

    Expand Post
    • 3 answers
    • 30 views
    1 of 3

    • SamHouston (Veracode)

      Prioritized Action Plan

      1. By 12:00 ET today — NetScaler + TeamCity internet-facing. Inventory via EASM. Patch or isolate. Forensic triage before declaring clean. Done when: no unpatched public ADC or TeamCity, or a written isolate ticket. First step: EASM query for those product banners. R/I: reversible isolate, irreversible if you skip triage.
      2. Today — worm lockfile hunt. Search SBOMs/lockfiles for MemOS/@memtensor/*, keyv@6.0.0, cacheable@2.5.1, flat-cache@6.1.24, file-entry-cache@11.1.6, and Mini/Miasma IOCs. Done when: Package Firewall is blocking those classes and dirty versions are purged. First step: enable pre-built malware + typosquat policies.
      3. Today — rotate secrets on any host or runner that installed/imported the named malicious versions (npm, PyPI, GitHub, cloud, SSH, Hugging Face). R/I: irreversible if delayed.
      4. This afternoon — WordPress 7.1.2 / Commerce hotfixes / SharePoint KEV. EASM → DAST → hunt implants (webshells, unexpected binaries).
      5. This week — AI pipeline. SAST policy on all AI-touched repos; DryRun on PRs for IDOR/broken auth; IDE Scan in VS Code; Fix for first-party and (LA) SCA upgrades.
      6. Standing — Risk Manager KEV view as the single queue; Security Labs only for developer education on LLM/OWASP lessons, not as a control.

       

      This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

      Expand Post

  5. SamHouston (Veracode) asked a question.

    September 28, 2026 at 7:13 PM
    Veracode Threat-to-Control Daily Command Brief | 2026-09-28

    Written by Andrea Mazzarini, Senior Principal CSM at Veracode

     

    Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

     

    Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

     

    https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

     

    Executive Summary

     

    1. Citrix NetScaler ADC/Gateway unauth RCE pair (CVE-2026-88771, CVE-2026-88772) — CVSS 9.5, KEV added 2026-09-27, federal due 2026-09-30, forensic triage required. Impact: total control of the access path (VPN/AAA/gateway). Atomic Risk 10. Why now: confirmed global in-wild use before/with patch; implants can survive a version bump. Veracode: EASM + Risk Manager (KEV).
    2. WordPress Core template-include LFI→conditional RCE (CVE-2026-87902) — CVSS 8.1 (v3.1) / 9.2 (v4.0), KEV 2026-09-25, due today 2026-09-28, public exploit path published. Impact: unauthenticated include of local PHP; mass internet blast radius. Atomic Risk 9. Veracode: EASM + DAST + Risk Manager (KEV).
    3. SharePoint code injection (CVE-2026-65660) — CVSS 8.8, KEV 2026-09-25, due today. Impact: authorized network attacker → code execution on collaboration estates. Atomic Risk 8. Veracode: EASM + Risk Manager (KEV).
    4. Adobe Commerce / Magento storefront RCE + auth-bypass cluster (CVE-2026-75650 CVSS 10.0; CVE-2026-71362 CVSS 9.1, KEV) — in-wild implants (Rust backdoor / PHP web shell) and session-switch. Atomic Risk 9. Veracode: EASM + DAST + Risk Manager (KEV).
    5. Supply-chain worms / OSS malware (Shai-Hulud family, Phantom Gyp / binding.gyp, Miasma, Mini Shai-Hulud) — no confirmed new registry worm wave in last_7_days or last_14_days. Residual risk remains first-priority: install-time execution that bypasses lifecycle-script controls, credential worming across npm/PyPI/RubyGems/Go, AI-assistant hook persistence. Atomic Risk 8 (persistent). Veracode: Package Firewall + SCA + SSCI. Dark-web OSINT (secondary): leak-site volume remains high (thousands of claimed victims in 90 days; multiple groups last-seen 2026-09-27/28); stealer-log and initial-access markets remain the ransomware feeder.

     

    Comprehensive Threats Table

     

    NetScaler unauth command injection + buffer RCE (CVE-2026-88771, CVE-2026-88772)

     

    CVSS: 9.5. Exploit status: KEV; in-wild; zero-day. Affected: NetScaler ADC/Gateway (unpatched trains before vendor fixed builds). Atomic Risk: 10. Immediate mitigation: Forensic image first; apply vendor builds; hunt logs/tmp; rotate tokens. Veracode Tool Mapping: EASM + Risk Manager (KEV).

     

    WordPress Core page-template LFI (CVE-2026-87902)

     

    CVSS: 8.1 / 9.2. Exploit status: KEV; public PoC; mass probing. Affected: WordPress Core through 7.1.1; backports to 4.7. Atomic Risk: 9. Immediate mitigation: Patch to 7.1.2 or branch backport today; hunt included PHP / new files. Veracode Tool Mapping: EASM + DAST + Risk Manager (KEV).

     

    SharePoint code injection (CVE-2026-65660)

     

    CVSS: 8.8. Exploit status: KEV. Affected: SharePoint Server 2016/2019/Subscription. Atomic Risk: 8. Immediate mitigation: Patch today; restrict authorized remote admin paths. Veracode Tool Mapping: EASM + Risk Manager (KEV).

     

    MikroTik RouterOS workflow bypass (CVE-2026-67279)

     

    CVSS: ~6.5–6.9. Exploit status: KEV; unauth session/exec chain. Affected: RouterOS. Atomic Risk: 7. Immediate mitigation: Patch; pull management planes off internet. Veracode Tool Mapping: EASM + Risk Manager (KEV).

     

    Adobe Commerce template RCE StyleSmuggler (CVE-2026-75650)

     

    CVSS: 10.0. Exploit status: In-wild; implants. Affected: Commerce / Magento 2.4.4–2.4.9 trains incl. Aug builds until hotfix. Atomic Risk: 9. Immediate mitigation: Emergency hotfix; rotate encryption keys and secrets; hunt implants. Veracode Tool Mapping: EASM + DAST + Risk Manager (KEV).

     

    Adobe Commerce incorrect authorization (CVE-2026-71362)

     

    CVSS: 9.1. Exploit status: KEV; post-disclosure abuse. Affected: Commerce / Magento / B2B. Atomic Risk: 8. Immediate mitigation: Move to Aug security train; session/account review. Veracode Tool Mapping: EASM + DAST + Risk Manager (KEV).

     

    Identity/edge cluster (Check Point, F5 BIG-IP APM, Arista on-prem orchestrator, Cisco ISE)

     

    CVSS: 9.8–10.0. Exploit status: KEV last_7–14d. Affected: VPN, APM/OAuth, SD-WAN orchestrator, ISE. Atomic Risk: 9. Immediate mitigation: Patch exposed control planes; forensic triage where directed. Veracode Tool Mapping: EASM + Risk Manager (KEV).

     

    Shai-Hulud / Mini Shai-Hulud / Miasma / Phantom Gyp residual

     

    CVSS: N/A (malware). Exploit status: Persistent campaign watch; no new 7–14d wave confirmed. Affected: npm, PyPI, RubyGems, Go modules, GitHub Actions. Atomic Risk: 8. Immediate mitigation: Point package managers at firewall; deny malware/typosquat/High-Critical; rotate tokens. Veracode Tool Mapping: Package Firewall + SCA + SSCI.

     

    AI coding-agent Git-config execution (GitSpawn class; CVE-2026-72718 and siblings)

     

    CVSS: 7.0 class. Exploit status: Public research; mixed patch state early Sept. Affected: Claude Code, Codex, Cursor, and peer agents. Atomic Risk: 7. Immediate mitigation: Upgrade agents; do not open untrusted repos; treat agent-written authz as untrusted. Veracode Tool Mapping: SAST + DryRun + Policy Management.

     

    AI-generated / vibe-coded logic flaws (IDOR, broken auth)

     

    CVSS: N/A (class). Exploit status: Repeated research + incident pattern. Affected: Apps built in Cursor, Claude Code, Codex. Atomic Risk: 7. Immediate mitigation: PR-gate SAST; add intent/logic review on authz paths. Veracode Tool Mapping: SAST + DryRun + Fix.

     

    Ransomware leak-site + stealer-log markets

     

    CVSS: N/A. Exploit status: Active OSINT listings. Affected: Enterprise identity, schools, mid-market. Atomic Risk: 7. Immediate mitigation: Assume credential reuse; KEV-prioritize exposed apps. Veracode Tool Mapping: Risk Manager + EASM + Policy Management.

    Expand Post
    • 3 answers
    • 17 views
    1 of 3

    • SamHouston (Veracode)

      Prioritized Action Plan

       

      1. By 12:00 ET today: Inventory internet-facing NetScaler, WordPress, SharePoint, Commerce/Magento. Patch WordPress and SharePoint (due today). Queue NetScaler to vendor fixed builds after forensic capture. Done when: asset list + ticket per exposed instance.
      2. Today: In Risk Manager, filter KEV added 2026-09-21–2026-09-27; assign owners; set due dates to vendor/BOD windows. Done when: every KEV row has an owner.
      3. Today: Confirm Package Firewall is the only path to npm/PyPI/Maven; deny malware + typosquat + High/Critical. Run SCA on default branches; pull SSCI threat feed for non-CVE malware. Done when: one blocked-package test and one SBOM artifact exist.
      4. This week: EASM sweep for the KEV product names above; DAST (ISM if internal) on WordPress/Commerce properties.
      5. This week: On AI-assisted repos, keep SAST as finding source; add DryRun PR review for authz/IDOR/intent; use Fix / Fix for SCA (LA) where entitled.

       

      This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

      Expand Post

  6. SamHouston (Veracode) asked a question.

    September 23, 2026 at 6:19 PM
    Veracode Threat-to-Control Daily Command Brief | 2026-09-23

    Written by Andrea Mazzarini, Senior Principal CSM at Veracode

    Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

    Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

    https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

     

    Veracode Threat-to-Control Daily Command Brief | 2026-09-23

     

    Executive Summary

    1. MemTensor / sckit dual-ecosystem worm (npm + PyPI, published 2026-09-23) — Malicious versions of @memtensor/memos-cloud-openclaw-plugin (0.1.21, 0.1.23, 0.1.25) and PyPI MemoryOS 2.0.34 ship a Go implant that harvests home-directory credentials and contains self-copy logic into other packages/repos reachable with stolen tokens. Tokens were taken from GitHub Actions release jobs. Atomic Risk 10. Why now: same-day latest tag exposure on an AI-agent memory plugin; worm-class blast radius. Strong Veracode applicability: Package Firewall + SCA + SSCI.
    2. Four KEV additions dated 2026-09-22, federal due 2026-09-25 — Check Point Gateway/Spark VPN RCE CVE-2026-85102 (9.8, exploited against Spark from ~2026-09-12); Check Point Management pre-auth path traversal CVE-2026-93616 (9.8, exploited as far back as 2026-07-23); F5 BIG-IP APM unauth heap-overflow RCE CVE-2026-94127 (9.8, vendor-confirmed in the wild); Arista on-prem VeloCloud Orchestrator CVE-2026-93952 (10.0, vendor-confirmed exploited). Atomic Risk 10. Why now: three-day due window and internet-facing identity/SD-WAN control planes. Strong applicability: EASM + Risk Manager (KEV) + Policy Management.
    3. Underground extortion feud + claimed PeopleSoft zero-day — Public OSINT secondary reporting: one extortion crew seized a rival leak site (2026-09-19–21) and claims a new Oracle PeopleSoft RCE used against a U.S. federal recruiting stack, with 2–3 TB alleged. Prior PeopleSoft Environment Management RCE CVE-2026-35273 (9.8) was already mass-exploited mid-2026. Atomic Risk 9. Why now: leak-site chaos raises dump/reuse risk; PeopleSoft remains a high-value internet-facing HR/ERP surface. Applicability: EASM + DAST + Risk Manager.
    4. D-Link DIR-822A CVE-2026-86296 (CVSS 10.0) + CVE-2026-86510 — Unauth stack overflow in DHCP/udhcpcd with public PoC; vendor investigating, no fix at disclosure; second public-PoC OOB-write on L2TP. Atomic Risk 8 for environments that still run this model. Applicability: EASM + Risk Manager + Policy Management.
    5. BigDiskBuster Defender update-block PoC (2026-09-22) — Public tool fills disk during Defender platform/signature updates so definitions go stale while the product still "runs." No CVE/patch at disclosure. Atomic Risk 7 as a post-foothold enabler, not an initial remote vector. Applicability: Risk Manager + Policy Management.

     

    Comprehensive Threats Table

    Threats_Table_Sept23 

    Full analysis, recommendations, and action plan continue in the comments below.

    Expand Post
    • 3 answers
    • 21 views
    1 of 3

    • SamHouston (Veracode)

      Prioritized Action Plan

      1. Block MemTensor malicious versions in Package Firewall today and force SCA/SSCI rescan of every lockfile and container built in the last 14 days. Done when deny hits are live and no pipeline can resolve 0.1.21/0.1.23/0.1.25 or MemoryOS==2.0.34.
      2. Rotate npm, PyPI, GitHub, and cloud tokens used by any job that installed those packages or shares an org with MemTensor-style AI plugins. Done when old tokens are revoked.
      3. EASM + Risk Manager sweep for F5 APM+OAuth, Check Point Management/Spark VPN, on-prem VCO, PeopleSoft/PSEMHUB, Zyxel GS1900. Done when each asset has an owner and a patch-or-isolate decision before 2026-09-25 (GS1900: 2026-09-24).
      4. Apply vendor hotfixes for CVE-2026-94127, CVE-2026-93616, CVE-2026-85102, CVE-2026-93952; restrict Management/VCO/PeopleSoft admin planes to trusted networks; hunt vendor IoCs.
      5. Policy Management: add "malicious package = break the build" and "internet-facing KEV = P1."
      6. DAST the PeopleSoft and Management URLs EASM returns.
      7. Developer-workstation note: hunt BigDiskBuster-style failed Defender updates; not a Veracode scanner finding, still a build-agent integrity issue.

       

      Acceleration

      • Today's worm has no CVE. Package Firewall + SSCI is the only control that stops the install before SCA "known vulnerability" logic even applies — natural expansion from SCA-only seats.
      • Four KEV RCEs landed on the same day with a Friday due date. Risk Manager is the conversation for "show the board what is exploited, not what is merely critical."
      • F5 APM, Check Point Management, VCO, and PeopleSoft are discoverability problems. EASM turns "we think we patched" into a list of hostnames still on the internet.
      • AI-agent plugins (OpenClaw / memory OS) are the new npm blast radius. SSCI plus Firewall is the enablement story for teams adopting agent toolchains without waiting for a catalog CVE.

       

      This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

      Expand Post

  7. SamHouston (Veracode) asked a question.

    September 8, 2026 at 7:21 PM
    New Case Study: How SEF/MG Reached 99.6% Application Scan Coverage

    The Secretaria de Estado de Fazenda de Minas Gerais (SEF/MG), Brazil's Minas Gerais state revenue department, has published its application security journey with Veracode — and there's a lot here for anyone scaling AppSec across a large development organization.

     

    With 300 developers and a significant legacy footprint, SEF/MG needed to move from catching vulnerabilities right before production to finding them during development. They integrated Veracode Static Analysis and Software Composition Analysis directly into their GitLab and Azure DevOps pipelines via API, and paired it with Veracode eLearning to build security skills across the team.

     

    Highlights from the case study:

    • 99.6% scan coverage (283 of 284 repositories)
    • Policy compliance up from 10.5% to 49.6%, peaking at 73.5%
    • Mean time to remediate of roughly 40 days
    • 100% developer adoption of automated scanning
    • Strengthened support for ISO 27001, LGPD, and CIS

     

    Read the full case study here:

    https://www.veracode.com/case-studies/sef-mg-devsecops-veracode/

    Expand Post
    • 33 views

  8. SamHouston (Veracode) asked a question.

    August 31, 2026 at 6:25 PM
    Veracode Daily Threat Intel Brief - Aug 31, 2026

    Written by Andrea Mazzarini, Senior Principal CSM at Veracode

    Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

    Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

    https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

     

    Executive Summary

    1. ChainDrop / Shai-Hulud fourth-wave npm worm (keyv / cacheable family) — Self-propagating install-time credential worm still in the 7–14 day operational window. Hundreds of packages, combined reach on the order of 2 billion monthly installs. Atomic Risk 10. First principles: one stolen maintainer token plus CI publish rights equals autonomous republish across the graph; provenance/SLSA did not stop it. Strong Veracode applicability: Package Firewall + SCA + SSCI + Risk Manager.
    2. PaperCut NG/MF pre-auth RCE chain (CVE-2026-81578 + CVE-2026-82078) — Zero-day exploitation confirmed from 2026-08-26; emergency patches on 2026-08-27/28. Auth bypass (8.8) chained to unsafe dynamic class loading (9.8) → unauthenticated RCE on the print-management server. Atomic Risk 9. Print servers are high-privilege, often internet-adjacent, historically used as ransomware beachheads. EASM + Risk Manager + DAST + Policy Management.
    3. CISA KEV surge 2026-08-26/27 — New catalog entries include JFrog Artifactory path write (CVE-2026-66384), ownCloud pre-auth file access (CVE-2023-49105, CVSS 9.8), Linux kernel IPv6 privilege escalation (CVE-2026-53362), plus the prior-week Citrix NetScaler (CVE-2026-8452) and SQL Server RCE (CVE-2019-1068) batch. Atomic Risk 8. Artifact registries and file-sync platforms sit on the same trust path as SCA. Risk Manager (KEV) + SCA + Container Security + EASM.
    4. On-prem SharePoint unauth RCE chain (CVE-2026-55040 + CVE-2026-63520) and Metabase pre-auth SQLi-to-RCE (CVE-2026-72898, CVSS 10) — Public exploit code in circulation; SharePoint already KEV. Atomic Risk 9 / 8. These are internet-facing application control planes. DAST + EASM + Risk Manager + SAST + Fix.
    5. Ransomware + dark-web OSINT (secondary reporting only) — Qilin publicly claimed a U.S. federal firearms/explosives agency system; Medusa advisory update documents 500+ critical-infrastructure victims; leak-site volume remains high (The Gentlemen, Akira, DragonForce, new brands Emperador / iah6477). Atomic Risk 8. Initial access remains unpatched edge + stolen creds + OSS worms. Risk Manager + EASM + Package Firewall + Policy Management.

     

     

    Comprehensive Threats

     

    ChainDrop / Shai-Hulud 4th wave (keyv, flat-cache, file-entry-cache, cacheable, cache-manager, ecto + 400–1,280+ downstream packages)

    CVSS: N/A (malware). Exploit status: in-wild worm; install-time preinstall + Bun second stage; stolen npm tokens republish. Affected: npm graph, CI runners, developer workstations, org-scoped packages. Atomic Risk: 10. Immediate mitigation: pin known-good versions; block malicious versions at ingest; rotate npm/GitHub/cloud/K8s/Vault tokens; rebuild from clean lockfiles; hunt .claude/, .vscode/tasks.json, setup.mjs, binding.gyp. Veracode Tool Mapping: Package Firewall + SCA + SSCI.

     

    PaperCut NG/MF chain CVE-2026-81578 + CVE-2026-82078

    CVSS: 8.8 / 9.8. Exploit status: actively exploited from 2026-08-26; emergency patch release 2. Affected: all NG/MF prior to v24/v25/v26 Emergency Patch Release 2. Atomic Risk: 9. Immediate mitigation: pull Application Server off the internet; apply Emergency Patch Release 2; hunt IoCs and dropped Java classes; assume compromise if previously exposed. Veracode Tool Mapping: EASM + Risk Manager + DAST + Policy Management.

     

    SharePoint JWT bypass + RCE CVE-2026-55040 + CVE-2026-63520

    CVSS: High / Critical. Exploit status: KEV; public exploit for unauth RCE chain on-prem 2016/2019/Subscription. Affected: on-prem SharePoint. Atomic Risk: 9. Immediate mitigation: apply both patches; remove internet exposure; rotate farm secrets; hunt webshells. Veracode Tool Mapping: EASM + DAST + Risk Manager (KEV).

     

    FortiClient EMS CVE-2026-35616

    CVSS: 9.1–9.8. Exploit status: KEV; ongoing use to drop infostealer via EMS control plane. Affected: FortiClient EMS 7.4.5–7.4.6 (and related 7.x). Atomic Risk: 8. Immediate mitigation: hotfix immediately; no public EMS; rotate endpoint/VPN creds; treat managed fleet as potentially scripted. Veracode Tool Mapping: EASM + Risk Manager (KEV).

     

    Metabase password-reset SQLi CVE-2026-72898

    CVSS: 10.0. Exploit status: public exploit to RCE (H2 default and Postgres); KEV-class activity. Affected: exposed Metabase. Atomic Risk: 8. Immediate mitigation: patch; take password-reset off the internet; rotate DB and app secrets. Veracode Tool Mapping: EASM + DAST + Risk Manager.

     

    ownCloud WebDAV pre-signed URL auth bypass CVE-2023-49105

    CVSS: 9.8. Exploit status: KEV added 2026-08-27 (due 2026-08-30). Affected: ownCloud ≥10.6.0 without signing key. Atomic Risk: 8. Immediate mitigation: patch or disable unsigned pre-signed URLs; assume file read/write/delete if username known. Veracode Tool Mapping: EASM + Risk Manager (KEV) + DAST.

     

    JFrog Artifactory path restriction CVE-2026-66384

    CVSS: 5.3 (KEV). Exploit status: KEV added 2026-08-27 (due 2026-09-10). Affected: Artifactory Docker cache / remote-repo write. Atomic Risk: 7. Immediate mitigation: vendor mitigation; treat as artifact-integrity event; rescan consumed images/packages. Veracode Tool Mapping: SCA + Package Firewall + Container Security + Risk Manager (KEV).

     

    Linux kernel IPv6 CVE-2026-53362

    CVSS: 7.8. Exploit status: KEV added 2026-08-27 (due 2026-08-30); forensic triage flagged. Affected: Linux distributions using vulnerable IPv6 path. Atomic Risk: 7. Immediate mitigation: kernel update across fleet and container base images. Veracode Tool Mapping: Container Security + Risk Manager (KEV).

     

    Citrix NetScaler ADC/Gateway CVE-2026-8452

    CVSS: High. Exploit status: KEV added 2026-08-26. Affected: NetScaler ADC / Gateway. Atomic Risk: 8. Immediate mitigation: vendor fix; pull management/data plane off public internet if unpatched. Veracode Tool Mapping: EASM + Risk Manager (KEV).

     

    Microsoft SQL Server CVE-2019-1068

    CVSS: High. Exploit status: KEV added 2026-08-26. Affected: SQL Server Database Engine. Atomic Risk: 7. Immediate mitigation: patch engine; restrict network path to SQL; credential hygiene. Veracode Tool Mapping: Risk Manager (KEV) + Policy Management.

     

    Windows afd.sys Lazarus zero-day CVE-2026-68820

    CVSS: 7.0. Exploit status: exploited in-wild (nation-state); patched Aug 2026 Patch Tuesday; KEV. Affected: Windows (local EoP to SYSTEM after code execution). Atomic Risk: 7. Immediate mitigation: confirm August 2026 OS patches; hunt kernel rootkit/FudModule-class persistence. Veracode Tool Mapping: Risk Manager (KEV).

     

    SPIP unauth RCE CVE-2026-77647

    CVSS: Critical. Exploit status: exploited as zero-day; public exploit. Affected: SPIP CMS. Atomic Risk: 8. Immediate mitigation: patch or isolate CMS; hunt webshells. Veracode Tool Mapping: EASM + DAST + Risk Manager.

     

    Ajax.NET Professional deserialization CVE-2021-23758

    CVSS: 8.1–9.8. Exploit status: KEV 2026-08-26. Affected: apps embedding AjaxPro. Atomic Risk: 7. Immediate mitigation: remove/replace library; SAST/SCA find usages. Veracode Tool Mapping: SCA + SAST + Veracode Fix + Risk Manager (KEV).

     

    Qilin / Medusa / Gentlemen / Akira ransomware + new leak-site brands

    CVSS: N/A. Exploit status: active leak-site claims; Medusa 500+ CI victims; Qilin federal-agency claim. Affected: edge, identity, backups, healthcare, gov, manufacturing. Atomic Risk: 8. Immediate mitigation: patch KEV/edge; MFA; segment; immutable backups; hunt broker access. Veracode Tool Mapping: Risk Manager + EASM + Policy Management.

     

    Dark-web OSINT: new extortion brands (Emperador, iah6477), XSS forum infra shift, French SDIS multi-org claims, stealer-log credential markets

    CVSS: N/A. Exploit status: secondary OSINT only — leak-site and forum reporting, not independently validated datasets. Affected: identity, emergency services, enterprise creds. Atomic Risk: 7. Immediate mitigation: assume credential reuse; force rotation on exposed identities; raise Risk Manager urgency on KEV + identity findings. Veracode Tool Mapping: Risk Manager + EASM.

     

     

    Expand Post
    • 2 answers
    • 53 views
    1 of 2

    • SamHouston (Veracode)

      Veracode Recommendations

      Malicious Packages & Supply Chain Worms

      Threats: ChainDrop / Shai-Hulud fourth wave; residual Miasma / Phantom Gyp / Hades artifacts in lockfiles.

      Why it fits: Only an ingest control plus a malicious-package intelligence feed stops a worm that already has valid provenance.

      Customer action: Enable Package Firewall on npm (and PyPI) with fail-closed on known-malicious; run SCA across all lockfiles for keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6, cacheable 2.5.1, cache-manager 7.2.10 and campaign siblings; open an SSCI campaign view.

      Tools: Package Firewall + SCA + SSCI

      New/KEV CVEs

      Threats: Aug 26–27 KEV batch (Artifactory, ownCloud, Linux kernel, NetScaler, SQL Server, AjaxPro); SharePoint 55040; FortiClient EMS 35616; PaperCut 81578/82078 (expect KEV).

      Why it fits: Risk Manager is the single queue that encodes "exploited in the wild" ahead of CVSS.

      Customer action: Filter Risk Manager to KEV + last-14-day critical; assign owners with 72-hour SLA for internet-facing items.

      Tools: Risk Manager (KEV)

      Web/Runtime Exploits

      Threats: PaperCut admin plane, SharePoint chain, Metabase reset SQLi, ownCloud WebDAV, SPIP, NetScaler.

      Why it fits: These are running services, not repo findings.

      Customer action: Point DAST at every in-scope web admin and collaboration URL EASM returns; treat auth-bypass as P1.

      Tools: DAST + EASM

      Custom Code

      Threats: AjaxPro deserialization in first-party apps; custom SharePoint/Metabase extensions; apps that shell out or load classes from DB-influenced input (PaperCut-class pattern).

      Why it fits: SAST finds the same CWE families (deserialization, access control, unsafe reflection) before they become the next KEV.

      Customer action: Launch SAST + Veracode Fix on apps with Ajax.NET / dynamic class loading / JWT alg handling.

      Tools: SAST + Veracode Fix

      External Attack Surface

      Threats: Exposed PaperCut, FortiClient EMS (~thousands historically fingerprinted), Metabase, ownCloud, SharePoint, NetScaler.

      Why it fits: Brokers buy what is reachable.

      Customer action: EASM sweep today for product banners above; ticket every public admin plane for takedown or VPN.

      Tools: EASM + Risk Manager

      Containers

      Threats: Kernel CVE-2026-53362 in node/base images; Artifactory-cached Docker layers that may have been written outside intended path.

      Why it fits: Image rebuild is the only durable kernel/artifact fix.

      Customer action: Container Security rescan of production bases; rebuild anything pulled through a suspect Artifactory remote.

      Tools: Container Security + SCA

      Governance

      Threats: Lifecycle-script and binding.gyp execution; internet-exposed admin; KEV SLA drift.

      Why it fits: Policy is what makes Firewall/SCA/DAST findings non-optional.

      Customer action: Policy Management rule: fail pipeline on Package Firewall block; fail release if KEV remains open on internet-facing assets past due date.

      Tools: Policy Management

      Dark-Web-Informed Prioritization

      Threats: Qilin/Medusa/Gentlemen leak-site pressure; new extortion brands; stealer-log identity reuse; OSINT claims against emergency-services orgs.

      Why it fits: Risk Manager is where OSINT urgency is converted into ticket priority without pretending the Platform is a dark-web collector.

      Customer action: Raise severity one notch on identity-adjacent SCA findings and on any EASM-exposed SSO/VPN/print/EMS asset.

      Tools: Risk Manager

      Prioritized Action Plan

      1. Today 10:00 — Package Firewall + SCA emergency pass. Block ChainDrop/Shai-Hulud malicious versions at ingest. Inventory lockfiles for keyv@6.0.0, flat-cache@6.1.24, file-entry-cache@11.1.6, cacheable@2.5.1, cache-manager@7.2.10 and org-scoped secondary packages. If any hit: isolate the runner/workstation, rotate npm + GitHub + cloud + K8s + Vault tokens after persistence hunt, then rebuild. Tools: Package Firewall + SCA + SSCI.
      2. Today 11:00 — EASM blast for PaperCut, FortiClient EMS, SharePoint, Metabase, ownCloud, NetScaler. Anything public goes behind VPN or comes down before lunch. Confirm PaperCut Emergency Patch Release 2. Tools: EASM + Risk Manager.
      3. Today 14:00 — Risk Manager KEV war-room. Load Aug 26–27 additions plus SharePoint 55040, EMS 35616, PaperCut pair. Assign named owners. OwnCloud and Linux kernel federal due date was 2026-08-30 — treat as overdue if still open. Tool: Risk Manager (KEV).
      4. Today 16:00 — Credential assumption of breach for any developer/CI that installed a malicious npm version since 2026-08-04. Rotate, invalidate sessions, review preinstall, binding.gyp, .vscode/tasks.json, .claude/ hooks. Tools: SCA + SSCI + Policy Management.
      5. This week — DAST + SAST close-out. DAST on remaining collaboration/admin apps. SAST + Fix on AjaxPro and JWT/class-loading patterns. Container Security rebuild for kernel KEV. Tools: DAST + SAST + Veracode Fix + Container Security.
      6. This week — Policy lock. Pipeline fails closed on Firewall drops and on KEV-open internet-facing assets. Tool: Policy Management.

      This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

      Expand Post

End of Feed
End of Feed
8 Chatter Feed Items

Group Details

Details