Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

Active self-propagating supply-chain worms in the npm/PyPI ecosystems (Miasma / Shai-Hulud lineage variants including Phantom Gyp binding.gyp execution and Hades .pth loaders, plus the July 14 AsyncAPI CI-pipeline compromise delivering multi-stage credential-harvesting payloads) remain the highest-blast-radius threat. Impact: rapid lateral propagation via stolen maintainer tokens, CI secrets, and cloud credentials into downstream developer workstations and build systems; Atomic Risk 10. First-principles: install-time or import-time execution bypasses many traditional script controls and turns every compromised package into a new distribution node. Strong Veracode applicability via Package Firewall + SCA + SSCI.

Two critical KEV additions with confirmed in-wild exploitation (Microsoft SharePoint deserialization RCE enabling machine-key theft for post-patch persistence, and Check Point SmartConsole authentication bypass granting unauthenticated full administrative control of management servers) create immediate total-control risk on internet-exposed assets; Atomic Risk 9–10. WordPress Core unauthenticated RCE chain (wp2shell) via REST batch-route confusion + SQL injection is also KEV-listed and actively scanned/exploited. Strong Veracode applicability via Risk Manager (KEV prioritization) + EASM.

Infostealer-driven ransomware activity continues at elevated volume, with credential dumps fueling rapid initial access for multiple active groups; Atomic Risk 8. Veracode applicability via Risk Manager dark-web-informed urgency scoring and EASM exposure reduction.

All findings map directly to Platform controls for detection, blocking, prioritization, and remediation.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Supply-Chain Worms (Miasma / Phantom Gyp / Hades / AsyncAPI)

Supply-chain worms succeed because package registries and CI systems treat published artifacts as trusted by default. Root cause is compromised maintainer credentials or misconfigured GitHub Actions (pull_request_target / OIDC token abuse) that allow an attacker to inject a binding.gyp (Phantom Gyp) or .pth file that executes during legitimate install or Python startup.

Mechanism: node-gyp rebuild or Python site-packages import triggers shell expansion or Bun runtime download, leading to credential scraping (npm/GitHub/cloud/SSH/Kubernetes tokens), encrypted exfiltration to attacker-controlled repos or IPFS, and automated re-publication of poisoned packages under the victim's identity. Blast radius is exponential: each new compromised account becomes a distribution node; lockfiles generated during the short live window remain poisoned indefinitely. Dark-web secondary reporting shows stealer logs containing the harvested secrets appear on underground channels within days, amplifying ransomware initial-access brokers.

Veracode Control Point: Package Firewall blocks the malicious artifact at the registry proxy or policy gate before it ever reaches the build; SCA + SSCI continuous scanning and proprietary threat feed detect the known worm signatures and anomalous lifecycle hooks; Risk Manager elevates the finding with KEV-style urgency even without a formal CVE.

SharePoint CVE-2026-50522 — Deserialization RCE / Machine-Key Theft

SharePoint CVE-2026-50522 is a classic untrusted-data deserialization path in the SessionSecurityTokenHandler / WS-Federation flow. An unauthenticated network request delivers a crafted BinaryFormatter payload that executes in the SharePoint application-pool context and extracts machine keys. Once keys are stolen, the attacker retains the ability to forge valid tokens after the server is patched.

Blast radius: any on-prem SharePoint farm reachable from the internet or internal lateral movement becomes a persistent foothold for ransomware or data theft.

Veracode Control Point: Risk Manager surfaces the KEV entry with unified risk scoring and due-date enforcement; EASM discovers the external exposure of SharePoint endpoints so the asset can be prioritized and access restricted.

Check Point CVE-2026-16232 — SmartConsole Authentication Bypass

Check Point CVE-2026-16232 is an improper authentication flaw in the SmartConsole application-token login path. When the management server is internet-reachable and Trusted Clients are unrestricted, an unauthenticated attacker obtains a full-admin token and can rewrite security policy across all managed gateways.

Veracode Control Point: Risk Manager (KEV) + EASM exposure discovery and policy enforcement.

WordPress wp2shell RCE Chain

WordPress wp2shell combines REST API batch-route confusion (index offset on failed sub-requests) with an SQLi in the author__not_in WP_Query parameter. The chain requires no authentication and no plugins on default installs of the affected major versions, enabling direct RCE.

Veracode Control Point: Risk Manager prioritization + EASM external web-app discovery + DAST runtime confirmation of the vulnerable endpoints.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

The last 24–48 hours featured CISA KEV additions on July 21 (multiple actively exploited vulnerabilities with imminent due dates) alongside the persistent high-impact Miasma npm supply-chain compromise (trojanized packages published July 14 via GitHub Actions token theft, with import-time credential-harvesting payloads). Supply-chain/OSS worm-like activity and KEV signals dominate; ransomware ecosystem expansion continues with new actors emerging at a rate exceeding one per week. No brand-new zero-day public PoC disclosures dominated the last 48 hours, but active in-wild exploitation is confirmed via KEV.

Top Threats (Prioritized by Blast Radius and Veracode Alignment)

1. Miasma npm supply-chain trojanization (AsyncAPI and related campaigns) — Import-time payload steals CI/CD tokens (GITHUB_TOKEN, NPM_TOKEN) on package load/require. High propagation risk via stolen credentials enabling further repository or registry abuse. Atomic Risk: 9/10. Strong, direct Veracode applicability (Package Firewall + SCA + SSCI blocks and prioritizes).
2. CISA KEV July 21 additions (Fortinet FortiSandbox OS command injection CVSS 9.8, Microsoft SharePoint deserialization RCE, Langflow RCE, WordPress wp2shell RCE chain) — Actively exploited in the wild; many with July 24 due dates. Broad enterprise and web exposure. Atomic Risk: 8–9/10. Strong Veracode applicability (Risk Manager (KEV) + EASM + DAST).
3. Ongoing ransomware campaigns + new actor proliferation (61+ new groups YTD, 146+ active groups, record victim volumes) — Sustained double-extortion and underground leak activity amplifying exploitation of unpatched systems. Atomic Risk: 7/10. Veracode applicability via Risk Manager for dark-web-informed prioritization.
4. Continuing SharePoint exploitation wave (multiple vulns in recent period, including latest KEV) — Repeated targeting of enterprise collaboration platforms.

These create immediate Platform-actionable signals: accelerate Package Firewall/SSCI for OSS integrity, Risk Manager for KEV/exploit-context prioritization, and EASM for external exposure reduction. Edge cases include cached/local npm installs, transitive/hoisted dependencies, internal mirrors that ingested bad versions, serverless or containerized workloads using affected packages, and air-gapped environments with delayed but real token-reuse risk.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Miasma npm Supply-Chain Trojanized Packages

Root cause: Attacker leveraged misconfigured GitHub Actions workflow (pull_request_target event) on AsyncAPI repositories to exfiltrate a maintainer/bot personal access token (PAT), enabling unauthorized pushes to auto-publish branches and npm releases. Trojanized versions contain payload that executes at import/require time inside the consuming Node.js process.

Mechanism: On module load the payload inspects environment (CI runner context), harvests GITHUB_TOKEN, NPM_TOKEN, SSH keys, AWS credentials, etc., and exfiltrates them. No traditional install hook required in many cases — stealthy execution in the caller's context. Prior Miasma-family activity (Red Hat cloud-services packages June 2026, Mastra 140+ packages, LeoPlatform/RStreams, Go ecosystem spread) shows iterative refinement and cross-registry propagation.

Blast radius & propagation risk: Extremely high. Direct consumers of affected versions (generator, generator-components, etc.) immediately expose CI/CD and developer workstations. Stolen tokens enable worm-like follow-on actions: pushing additional malicious packages, accessing private repositories, or lateral movement inside organizations. Affects API tooling, code-generation pipelines, and any downstream artifact consumers. Dark-web amplification is secondary (token/access sales) but compounds urgency. Edge case: hoisted dependencies in monorepos, cached installs in CI runners, or internal npm proxies that mirrored bad versions before takedown.

Veracode Control Point: Package Firewall + SSCI threat intelligence feed identifies and blocks known malicious package versions and Miasma-family indicators in real time during intake or policy enforcement. SCA maps the full dependency tree and surfaces the compromised versions. Risk Manager elevates any application touching these packages with active-campaign context. Policy Management enforces mandatory OSS governance and blocks high-risk intake.

Fortinet FortiSandbox OS Command Injection (CVE-2026-25089 / 39808) & Microsoft SharePoint Deserialization RCE (CVE-2026-58644)

Root cause (Fortinet): Insufficient sanitization of HTTP request parameters allows unauthenticated attackers to inject and execute OS commands. Root cause (SharePoint): Unsafe deserialization of untrusted data over the network permits remote code execution without authentication.

Mechanism: Both are remote, unauthenticated vectors — crafted HTTP requests for Fortinet; deserialization gadget chains for SharePoint. KEV designation confirms in-wild exploitation (often initial access or ransomware deployment).

Blast radius: Fortinet appliances are security gateways — compromise yields broad network visibility/control. SharePoint is ubiquitous enterprise collaboration — RCE enables data exfiltration, persistence, or ransomware staging. Propagation risk elevated when these sit internet-exposed or in hybrid environments.

Veracode Control Point: Risk Manager (KEV) overlays active-exploitation and due-date context on inventory for prioritized triage. EASM continuously discovers exposed Fortinet and SharePoint instances. DAST validates runtime exploitability of web-exposed surfaces. Container Security covers any containerized deployments. Policy Management enforces SLAs aligned to CISA BOD timelines.

WordPress wp2shell RCE Chain (CVE-2026-63030 + 60137) & Langflow RCE (CVE-2026-0770)

Root cause (WP): Interpretation conflict in core batch REST endpoint combined with SQL injection in WP_Query when untrusted input reaches parameters; chains to unauthenticated admin account creation or direct code execution on default installs. No plugins/themes required. Root cause (Langflow): Unsafe inclusion/handling of exec_globals parameter in validate endpoint allows remote attackers to execute arbitrary code (potentially root context) via untrusted control sphere.

Mechanism: Pure unauthenticated remote vectors — single REST request for WP chain; crafted validate call for Langflow. Both patched recently (WP July 17) but KEV confirms active exploitation against unpatched instances.

Blast radius: WP affects millions of sites (core only); easy initial access or defacement vector frequently chained into ransomware. Langflow impacts AI/LLM workflow builders — growing attack surface as organizations adopt low-code LLM tooling.

Veracode Control Point: DAST discovers runtime RCE in web applications and APIs. Risk Manager (KEV) prioritizes these findings with exploitation context and dark-web-informed urgency. EASM identifies publicly reachable WordPress and Langflow instances. Policy Management mandates web-app scanning and rapid remediation SLAs.

Broader Signals

Supply-chain attack tempo in npm/PyPI ecosystems remains elevated throughout 2026 with iterative worm-like credential stealers (Miasma variants spanning multiple organizations and registries). KEV catalog additions are frequent, confirming sustained offensive focus on enterprise platforms (security appliances, collaboration software, web CMS, AI tooling). Ransomware actor count continues surging (>1 new group per week; 61+ YTD) with persistent double-extortion and leak-site activity — underground signals indicate healthy marketplace for initial-access exploits and stolen credentials. X chatter in the last 24 hours shows limited brand-new zero-day noise but reinforces ongoing SharePoint targeting. No critical new public PoC zero-days dominated the window, but active exploitation is the dominant signal.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

Top threats (2026-07-20 sweep):

• Fortinet FortiSandbox OS Command Injection (CVE-2026-39808, CVE-2026-25089): Critical unauthenticated RCE (CVSS 9.1). KEV added 2026-07-16. Atomic Risk 9/10. First-principles: Security appliance compromise undermines malware analysis, enables persistence/defense evasion, and provides high-value initial access for ransomware/APT. Strong Veracode applicability (exposed management interfaces).
• Microsoft SharePoint Server Deserialization/Missing Authentication (CVE-2026-58644, CVE-2026-56164 and related): RCE/privilege escalation. Multiple KEV additions mid-July 2026. Atomic Risk 8/10. Enterprise collaboration platform — prime target for data theft, ransomware deployment, and lateral movement. High blast radius in on-prem/exposed deployments.
• SonicWall SMA1000 Code Injection/SSRF (CVE-2026-15410, CVE-2026-15409): Remote code execution and request forgery. KEV added 2026-07-14. Atomic Risk 8/10. Perimeter appliances frequently targeted for initial access.
• WordPress wp2shell RCE (public PoC, emergency patches 2026-07-17): Critical remote code execution chaining REST API + SQL injection. Affects WP 6.9.0–6.9.4 and 7.0.0–7.0.1. Atomic Risk 8/10. Millions of sites; public exploit available. Strong DAST alignment.
• Ongoing multi-group ransomware campaigns (Qilin, Nova, Unsafe, Chaos, Doommageddon): Daily victim disclosures July 19–20 2026 across manufacturing, healthcare, construction, and other sectors. Atomic Risk 7/10. Steady high volume; groups actively posting. No single new dominant campaign but consistent operational tempo.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Fortinet FortiSandbox (CVE-2026-39808 / CVE-2026-25089):

Root cause is CWE-78 (improper neutralization of special elements in OS command) in web UI (e.g., "start VNC") and API endpoints. Attacker sends crafted unauthenticated HTTP request → arbitrary command execution on the appliance. Blast radius: Full system compromise of a malware analysis/sandbox platform. Attacker gains access to analyzed samples (potential tampering or exfil), can disable or evade detection, establish persistence, and use the appliance as a pivot point. Not a worm (no self-propagation), but extremely high-value target for ransomware operators or APTs seeking to blind security teams. Veracode control point: EASM discovers internet-exposed management consoles; DAST tests analogous command injection in custom web apps; Risk Manager tracks KEV remediation SLAs and correlates risk.

Microsoft SharePoint (CVE-2026-58644 et al.):

Classic deserialization of untrusted data + missing authentication for critical functions. Leads to unauthenticated or low-priv RCE. Blast radius: Enterprise-wide — document repositories, user data, workflow automation, and potential domain-level impact via integration. Frequently used in ransomware and nation-state operations for initial foothold or data staging. Propagation risk moderate via compromised accounts or lateral movement scripts. Veracode: EASM for exposed instances; Risk Manager for unified KEV + AppSec risk scoring; DAST for runtime validation of SharePoint-like custom portals.

Ransomware campaigns:

Root cause typically unpatched edge vulnerabilities (exactly the KEV class above), stolen creds, or phishing. Mechanism: Initial access → discovery/lateral movement → encryption + exfil. Blast radius: Organization-wide operational shutdown, regulatory exposure, and ransom demand. High blast because modern groups combine speed with data leverage. No direct tie to today's new KEVs in public reporting, but the pattern matches perfectly. Veracode reduces success probability by shrinking the vulnerable external surface (EASM) and enforcing rapid KEV remediation (Risk Manager).

Broader Signals

Ransomware tracking platforms show consistent daily activity (~14 new incidents in last 24h window per live feeds) with groups actively naming victims. X volume on specific CVEs/KEVs remains low-signal in latest mode (early post-KEV phase). No credible reports of new worm variants, Mini-Shai-Hulud-style OSS propagation, or large-scale credential-harvesting malware in public OSS registries during the sweep window. APT activity historically targets SharePoint and perimeter appliances; continued monitoring warranted but no new nation-state campaign indicators surfaced today.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities):
  • https://docs.veracode.com/r/Software_Composition_Analysis
  • https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context):
  • https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA):
  • https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities):
  • https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing):
  • https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery):
  • https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security:
  • https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement):
  • https://docs.veracode.com/r/c_appsec_policies

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure! https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• Shai-Hulud/Miasma/Mini Shai-Hulud supply chain worm + new fake payment SDK malicious packages (npm/PyPI, published ~July 7–8, 2026): Self-propagating credential-harvesting campaign abusing binding.gyp ("Phantom Gyp") for install-time execution, typosquatting, and maintainer/CI compromise. Hundreds of packages historically affected; new cluster (paysafe-*, skrill-*, neteller-*) steals CI/CD secrets, tokens, and env data. Atomic Risk: 9/10. First-principles: OSS registry trust + automated npm install/pip install creates autonomous blast radius to every downstream dev/CI environment. Strong Veracode applicability: Package Firewall + SCA.
• CISA KEV addition (2026-07-13): CVE-2008-4128 Cisco IOS CSRF: Legacy but now confirmed actively exploited vector for remote command execution on exposed routers. Atomic Risk: 7/10. Why now: BOD 26-04 mandates rapid action on exposed assets granting total control.
• Actively exploited KEVs (added ~July 7, deadlines recent/passed): Adobe ColdFusion CVE-2026-48282 (CVSS 10.0 path traversal $\rightarrow$ RCE), Joomla Page Builder CVEs CVE-2026-48908/CVE-2026-56290 (CVSS 10.0 unauth file upload/RCE), Langflow CVE-2026-55255 (CVSS 8.4 IDOR/authz bypass $\rightarrow$ arbitrary flow execution). Atomic Risk: 9/10. High in-wild exploitation confirmed.
• Ongoing ransomware (Settra, The_Gentlemen/Thegentlemen, Gunra, Medusa Locker, Qilin, Stormous active July 2026): Steady victim volume fueled by infostealer/credential campaigns (e.g., FortiBleed linked to INC/Lynx). No single new mega-campaign in last 24h but high operational tempo.
• Broader signals: Evolving worm tactics (binding.gyp evasion, loader mutations, legitimate project weaponization); NK-linked supply chain (Sapphire Sleet/BlueNoroff); public PoCs for select Linux kernel issues. Supply chain remains highest blast-radius vector.

All items deduplicated and ranked by CVSS $\ge$ 7.0 OR KEV OR public exploit/in-wild OR supply-chain propagation risk.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Shai-Hulud/Miasma supply chain worm (incl. July 2026 payment SDK campaign):

• Root Cause: Compromise of maintainer accounts or CI/CD pipelines (via stolen OIDC/GitHub tokens), followed by injection of a malicious payload into the publish pipeline or a direct malicious version upload.
• Mechanism: The binding.gyp file (normally for native addons) is processed by node-gyp at install time. This executes attacker JavaScript that harvests .env files, npm/PyPI/GitHub/cloud tokens, SSH keys, Vault data, and CI secrets. It then exfiltrates and uses these stolen credentials to republish more malicious versions (worm propagation). The new July variant uses convincing SDK facades (like paysafe-checkout) with sandbox evasion.
• Blast Radius: Any direct or transitive dependency triggers infection upon installation. Stolen secrets enable full GitHub organization takeovers, cloud account compromise, and further downstream poisoning.
• Propagation Risk: High — fully autonomous across registries.
• Veracode Control Point: SCA + Package Firewall gates at dependency resolution and CI/CD to detect and block threats before execution; Policy Management enforces compliance.

CVE-2026-48282 Adobe ColdFusion (and similar Joomla/Langflow KEVs):

Root cause is insufficient path validation (CWE-22) or improper access control allowing unauthenticated file upload/overwrite or IDOR leading to RCE/flow execution. Actively exploited in wild with public indicators. Blast radius: Full compromise of internet-facing instances (code execution in context of app user, potential lateral movement). Why matters now: KEV addition + BOD 26-04 creates hard federal deadlines; unpatched = immediate target. Veracode control point: DAST for runtime confirmation on exposed apps; Risk Manager for KEV-aware prioritization across portfolio.

CVE-2008-4128 Cisco IOS CSRF:

Root cause is insufficient CSRF protection in legacy HTTP admin interface. Now confirmed actively exploited. Blast radius: Remote command execution on exposed routers (legacy but still internet-facing in many environments). Veracode control point: EASM to discover exposed assets + Risk Manager (KEV) for unified tracking and policy enforcement.

Broader Signals

High signal volume on supply chain (Sonatype tracking cumulative 1.8M malicious packages; new Miasma waves + payment SDK cluster). Worm tactics evolving rapidly (binding.gyp/Phantom Gyp bypass, loader mutations for evasion, typosquatting + weaponization of legitimate projects). APT notes: North Korea-linked (Sapphire Sleet) supply chain campaigns targeting AI/dev tooling; ongoing credential theft feeding ransomware. X/web chatter elevated on #ShaiHulud, malicious packages, and recent KEVs. No major silent sources.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities):
  • https://docs.veracode.com/r/Software_Composition_Analysis
  • https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context):
  • https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA):
  • https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities):
  • https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing):
  • https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery):
  • https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security:
  • https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement):
  • https://docs.veracode.com/r/c_appsec_policies

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• Miasma / Phantom Gyp npm supply chain worm (Shai-Hulud lineage): Self-propagating credential-harvesting worm abusing binding.gyp / node-gyp for install-time execution. 57+ packages / 286+ malicious versions (high-download targets like @vapi-ai/server-sdk). Ongoing variants into late June. Atomic Risk: 9/10. First-principles: Maintainer compromise + novel bypass of script-hook detection enables CI/CD takeover and ecosystem-wide propagation via stolen cloud/OSS creds. Strong Veracode fit: SCA + Package Firewall.

• CVE-2026-48282 Adobe ColdFusion Path Traversal (KEV added 2026-07-07): Fresh CISA addition confirming active exploitation. Atomic Risk: 8/10. Path traversal as reliable initial access vector for ransomware/APT follow-on.

• CVE-2026-45659 Microsoft SharePoint RCE (recent KEV, deserialization): Actively exploited on enterprise collaboration platform. Atomic Risk: 9/10. Broad internal blast radius.

• CVE-2026-11645 Chromium V8 zero-day (KEV) + ongoing ransomware (SafePay leading recent claims) remain high-signal but secondary to supply chain worm this cycle.
•  

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Miasma / Phantom Gyp npm worm: Root cause = compromised maintainer accounts (social engineering/credential theft) publishing trojanized versions. Mechanism = weaponized binding.gyp (normally benign for native addons) triggers node-gyp execution at npm install time — evades most package.json preinstall/postinstall scanners. Payload exfiltrates env vars, tokens, validates access, then self-publishes malicious versions of victim's other packages and injects CI steps. Blast radius = extreme (supply chain worm): poisons high-download packages → thousands of downstream builds/CI runners compromised → cloud credential theft enables ransomware/APT lateral movement. Propagation risk highest in OSS-dependent orgs with weak package governance. Veracode control point: SCA + Package Firewall detects embedded malicious code and blocks at ingest/CI before install.

CVE-2026-48282 Adobe ColdFusion: Classic path traversal (CWE-22 class) allows arbitrary file read/write on server. Why it matters now: Fresh KEV confirmation means adversaries are actively chaining it for initial access. ColdFusion often runs legacy enterprise apps with high data sensitivity. Immediate patch + exposure reduction is non-negotiable.

CVE-2026-45659 SharePoint: Deserialization of untrusted data → RCE. High-value target for internal network pivoting and data exfil. KEV status demands top-tier prioritization.

Broader Signals

X (Latest mode) shows routine CVE chatter (Palo Alto PAN-OS disclosures today) and general ransomware discussion; no massive new zero-day PoC dump or brand-new ransomware campaign spike in strict last 24h. Miasma volume peaked with June waves but variants (e.g., Leo Platform) keep the campaign live. Credential theft (e.g., FortiBleed) continues feeding ransomware. APT notes limited in window but China-linked activity observed on older vectors.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities): https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context): https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA): https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities): https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing): https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery): https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security: https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement): https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

Malicious Packages & Supply Chain Worms

Threat: Miasma Phantom Gyp / Shai-Hulud variants (binding.gyp worm, credential harvesting, self-propagation). Why fits: Only tool that directly detects embedded malicious code in OSS packages and enforces real-time blocking of known-bad versions in pipelines. Customer action: Enable Package Firewall malicious package policies + strict SCA gates in every npm/CI/CD pipeline today; full historical scan for affected packages. Tool: SCA + Package Firewall

New/KEV CVEs

Threat: CVE-2026-48282 (Adobe ColdFusion), CVE-2026-45659 (SharePoint). Why fits: Unified exploitation-context view + automated prioritization across all findings. Customer action: Ingest these KEVs into Risk Manager; apply 24–72h SLAs for internet-facing assets; trigger Fix on any custom integrations. Tool: Risk Manager (KEV)

Web/Runtime Exploits

Threat: SharePoint RCE, Adobe ColdFusion path traversal, Chromium V8. Why fits: Identifies runtime-exploitable issues (deserialization, traversal) in live web/apps that static analysis misses. Customer action: Targeted DAST scans on all exposed SharePoint/ColdFusion instances; prioritize high findings for immediate fix. Tool: DAST

External Attack Surface

Threat: Exposed ColdFusion/SharePoint servers under active exploitation. Why fits: Discovers unknown exposed assets and correlates with KEV risk. Customer action: Run EASM discovery; map exposed assets to new KEVs; remediate or shield. Tool: EASM + Risk Manager

Governance

Threat: All above require consistent enforcement. Customer action: Update Policy Management to mandate Package Firewall + SCA pass for OSS, KEV prioritization, and DAST for web apps before any production deploy. Tool: Policy Management

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary (2026-07-07)

Top threats:

• Ongoing npm/PyPI/OSS supply chain worms (Miasma/Shai-Hulud lineage, PolinRider, Lazarus-linked): Persistent malicious package campaigns targeting developers/CI/CD. High propagation via dependencies. Atomic Risk: 9/10. First-principles: Trust in OSS registries broken at source; one compromised maintainer/CI poisons thousands of downstream apps. Strong Veracode SCA/Package Firewall applicability.
• CVE-2026-46242 "Bad Epoll" (Linux kernel epoll UAF/race, PoC public): Local root on affected kernels (6.4+), desktops/servers/Android. Atomic Risk: 8/10. Unprivileged escalation vector in core I/O subsystem.
• CVE-2026-48558 SimpleHelp RMM auth bypass (KEV, actively exploited): Unauth privileged access, malware delivery (Djinn Stealer). ~1k–14k exposed. Atomic Risk: 9/10. RMM as high-value initial access.
• CVE-2026-55200 libssh2 client RCE (public PoC): Malicious SSH server triggers heap corruption on connect. Atomic Risk: 8/10. Client-side risk in tooling/automation.
• CVE-2026-42897 Exchange OWA (prior zero-day activity): Crafted email spoofing/XSS. Ongoing relevance for on-prem. Atomic Risk: 7/10.

No major new 24h ransomware zero-days, but agentic ransomware (JadePuffer) signals automation evolution; persistent group activity (Qilin, Gentlemen, etc.).

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

• Supply chain worms: Root cause = maintainer/CI compromise + weak review (e.g., node-gyp, GitHub Actions poisoning). Mechanism: Malicious deps steal creds, self-propagate. Blast radius: Exponential via transitive deps; hits AI/dev tooling hard. Veracode control: Package Firewall blocks at ingest; SCA for visibility.
• Bad Epoll: Race in epoll close paths (use-after-free). Local unpriv → root. Propagation risk high in containers/shared kernels. Patch kernel; audit exposure.

Broader Signals

Elevated X/Threat intel on supply chain + kernel exploits. Ransomware groups leveraging initial access brokers/stealers.

Veracode Tool Reference with Links

• SCA + Package Firewall: https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager: https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix: https://docs.veracode.com/r/About_Veracode_Fix
• SAST: https://docs.veracode.com/r/c_static_overview
• DAST: https://docs.veracode.com/r/DAST
• EASM: https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security: https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management: https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

• Malicious Packages & Supply Chain Worms: npm worms/PolinRider. SCA + Package Firewall fits for dependency scanning/blocking. Action: Enable Package Firewall policies for high-risk registries; scan all CI/CD pipelines.
• New/KEV CVEs: Bad Epoll, SimpleHelp, libssh2. Risk Manager for prioritization/KEV context. Action: Ingest into Risk Manager, triage by blast radius.
• Web/Runtime/External: Exchange/SimpleHelp. EASM + DAST. Action: Run EASM for exposed RMM/web apps.
• Containers: Kernel/container risks. Container Security. Action: Scan images/k8s.
• Governance: Policy Management for enforcement across findings.

Prioritized Action Plan (SMART, Today)

• Enable/audit SCA + Package Firewall for all OSS/CI/CD pipelines; block unvetted npm/PyPI (due EOD).
• Patch/update kernels/libssh2/SimpleHelp/Exchange mitigations; verify via Risk Manager (complete in 24h).
• Run targeted EASM on exposed assets + DAST on web/RMM endpoints.
• Update policies in Policy Management for KEV/supply chain rules.
• Scan containers with Container Security; remediate via Veracode Fix where applicable.

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• Ongoing npm supply chain worms (Miasma/Shai-Hulud variants, binding.gyp/Phantom Gyp technique): Self-propagating malicious packages steal CI/CD credentials, SSH keys, cloud tokens; high propagation risk via npm install. Atomic Risk: 9/10 — first-principles: trust in OSS registries broken at install time; worms self-replicate, evading script-based detection. Strong Veracode applicability.
• CVE-2026-45659 (Microsoft SharePoint RCE, CISA KEV added ~2026-07-01): Deserialization flaw enabling remote code execution. Atomic Risk: 8/10 — network-reachable enterprise software; ransomware potential.
• CVE-2026-0257 (Palo Alto GlobalProtect auth bypass, actively exploited): VPN authentication bypass. Atomic Risk: 8/10 — edge access compromise enables lateral movement.
• CVE-2026-33825 (Microsoft Defender BlueHammer LPE, ransomware use): Privilege escalation. Atomic Risk: 7/10 — post-compromise escalation vector.
• PolinRider (North Korean): 108+ malicious packages/extensions across npm/Packagist/Go. Atomic Risk: 8/10 — targeted supply chain for credential theft.

No major new 24–48h zero-days with public PoCs beyond ongoing campaigns; focus remains supply chain persistence and recent KEV.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

• Miasma/Shai-Hulud: Root cause = weak npm registry trust + install-time execution (node-gyp via binding.gyp bypasses package.json checks). Mechanism: credential harvest → self-publish malicious variants → worm propagation. Blast radius: thousands of workflows/repos; steals AWS/GCP/K8s/SSH. Veracode control: SCA + Package Firewall blocks at source.
• SharePoint CVE-2026-45659: Deserialization of untrusted data → RCE. High blast radius in enterprise collab tools. Prioritize via Risk Manager for KEV context.
• Supply chain worms prioritize over isolated CVEs due to transitive trust failure across ecosystems.

Broader Signals

• X volume low on brand-new exploits in last 24h; sustained chatter on supply chain (Miasma variants).
• Ransomware activity ongoing (INC, others); no massive new campaigns in last 48h.
• North Korean PolinRider expansion signals persistent developer tooling targeting.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities): https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context): https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA): https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities): https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing): https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery): https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security: https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement): https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

• Malicious Packages & Supply Chain Worms: Miasma/Shai-Hulud/PolinRider. SCA + Package Firewall fits — blocks malicious OSS at ingest/CI. Action: Enable policies for high-risk registries and enforce in pipelines.
• New/KEV CVEs: SharePoint CVE-2026-45659, SimpleHelp, Defender. Risk Manager fits — KEV prioritization/unified view. Action: Ingest KEV items, triage by blast radius.
• External Attack Surface: Palo Alto GlobalProtect. EASM + Risk Manager fits — discover exposed VPNs. Action: Scan external assets, enforce patching.
• Governance: All findings. Policy Management fits — enforce controls. Action: Update policies for SCA/KEV.

Prioritized Action Plan

• Enable SCA + Package Firewall policies for malicious packages/OSS worms; enforce in all CI/CD today. Rotate exposed credentials.
• Run Risk Manager on new KEV (SharePoint, Defender, SimpleHelp); prioritize patching with BOD 22-01 alignment.
• EASM scan for exposed GlobalProtect instances; patch PAN-OS immediately.
• Audit npm/PyPI/Packagist deps with SCA; block binding.gyp anomalies.
• Update Policy Management for automated enforcement and reporting.
• Monitor X/KEV feeds daily; re-scan post-remediation.

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• CVE-2026-45659 (Microsoft SharePoint RCE): Actively exploited; CISA KEV addition July 1. Deserialization flaw allows authenticated (low-priv) network RCE. Atomic Risk: 9/10. Immediate patching critical for enterprise collaboration platforms; strong Risk Manager + SAST/SCA applicability.
• CVE-2026-8037 (Progress Kemp LoadMaster): Pre-auth OS command injection RCE (CVSS ~9.6–9.8); active exploitation + public PoC. Targets load balancers. Atomic Risk: 9.5/10. High blast radius in network infrastructure.
• Ongoing Mini Shai-Hulud/Miasma npm supply chain worms: Credential harvesting via malicious packages (binding.gyp, postinstall hooks); affects Red Hat Cloud Services, LeoPlatform, and related ecosystems. Persistent propagation risk in CI/CD. Atomic Risk: 9/10. Prioritize SCA + Package Firewall.
• Broader signals: Routine ransomware activity (Qilin, etc.); Chrome renderer/sandbox issues; no silent major zero-days dominating last 48h beyond above. Supply chain remains highest velocity vector.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

• SharePoint CVE-2026-45659: Root cause = deserialization of untrusted data (CWE-502). Mechanism: Authenticated attacker crafts payload triggering RCE. Blast radius: Enterprise file/collaboration compromise, lateral movement. Veracode control: Risk Manager for KEV prioritization + SAST for custom code paths.
• Kemp LoadMaster CVE-2026-8037: Pre-auth command injection via API (heap/uninitialized issues). Why now: Public PoC accelerates exploitation. Propagation: Network appliances as entry points. Veracode: EASM for exposed assets.
• npm Supply Chain (Miasma/Shai-Hulud variants): Root = maintainer compromise + install-time execution (binding.gyp bypasses). Blast radius: Secrets theft → CI/CD takeover → downstream supply chain. Veracode: SCA + Package Firewall blocks at ingestion.

Broader Signals

Limited X volume on brand-new exploits in last 24h; focus remains on patching KEV items and npm campaigns. Persistent APT/ransomware activity noted but no fresh high-blast campaigns.

Veracode Tool Reference with Links

• SCA + Package Firewall: https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager: https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix: https://docs.veracode.com/r/About_Veracode_Fix
• SAST: https://docs.veracode.com/r/c_static_overview
• DAST: https://docs.veracode.com/r/DAST
• EASM: https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security: https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management: https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

• Malicious Packages & Supply Chain Worms: Mini Shai-Hulud/Miasma. SCA + Package Firewall fits for dependency scanning/blocking. Action: Enable policies for npm/PyPI; scan all repos.
• New/KEV CVEs: SharePoint CVE-2026-45659, Kemp CVE-2026-8037. Risk Manager (KEV) + EASM. Action: Prioritize in unified view; discover exposed assets.
• Web/Runtime Exploits: Exchange OWA. DAST. Action: Test exposed web apps/APIs.
• Governance: All. Policy Management. Action: Enforce across tools/CI-CD.

Prioritized Action Plan

• Patch CVE-2026-45659 and CVE-2026-8037 today; verify via Risk Manager.
• Enable SCA + Package Firewall policies for malicious npm packages; enforce in CI/CD.
• Run EASM scan for exposed LoadMaster/Exchange assets; apply mitigations.
• Audit dependencies with SCA; use Veracode Fix for remediations.
• Update Policy Management for KEV prioritization and governance.
• Monitor X/vendor feeds; re-scan tomorrow.

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.