Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• Cisco Unified CM CVE-2026-20230 (CVSS 8.6): Actively exploited SSRF leading to file writes/webshells/RCE on WebDialer-enabled systems. Public PoC driving automated sweeps. Atomic Risk: 9/10 — enterprise comms infrastructure; first-principles: unauth remote control path enables persistence/lateral movement. Strong Veracode applicability.
• Ongoing Miasma/Mini Shai-Hulud npm supply-chain worm variants: Credential theft + self-propagation via binding.gyp/node-gyp and maintainer compromises (e.g., Red Hat @redhat-cloud-services packages). High blast radius in OSS ecosystems. Atomic Risk: 9/10 — worms spread silently through dependencies/CI/CD. Prioritize SCA.
• Ransomware/Infostealer activity (Qilin, Anubis, StealC/Amadey disruptions): Persistent campaigns + credential harvesting feeding access brokers. Atomic Risk: 8/10 — enterprise endpoints/identity vectors.
• Recent WordPress plugin SQLi (e.g., CVE-2026-12077 critical): Unauthenticated database extraction. Atomic Risk: 7/10.
• Broader KEV/ongoing: Cisco SD-WAN zero-days and Ubiquiti items in recent KEV; no ultra-fresh mass additions in last 24h.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

• Cisco CVE-2026-20230: Root cause = improper input validation on HTTP requests enabling SSRF to file:// writes. Mechanism: PoC delivers formatted payloads for webshell drop. Blast radius: Comms backbone compromise → RCE/persistence; worms not yet reported but propagation risk high in exposed instances. Veracode control: EASM for exposure + Risk Manager prioritization.
• Miasma Supply Chain Worm: Root cause = compromised maintainer accounts + novel binding.gyp/node-gyp execution (bypasses some scanners). Mechanism: Steals GitHub/cloud creds, injects into pipelines, self-propagates. Blast radius: Hundreds of packages, dev workstations, downstream dependents; worm-like spread amplifies via OSS trust. Veracode control: SCA + Package Firewall for detection/enforcement in CI/CD.

Broader Signals

X volume moderate on Cisco exploitation; supply chain worms remain high-signal topic with variants (Miasma). No massive new zero-day spikes in last 24h; ransomware steady with infostealer ops disrupted but resilient. APT/credential theft feeds ransomware.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities): https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context): https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA): https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities): https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing): https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery): https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security: https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement): https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

• Malicious Packages & Supply Chain Worms: Miasma/Red Hat npm — SCA + Package Firewall fits for dependency scanning/firewalling malicious versions. Action: Enable Package Firewall policies and scan/rebuild CI/CD pipelines.
• New/KEV CVEs: Cisco/UniFi items — Risk Manager (KEV) for unified prioritization. Action: Import KEV into Risk Manager and triage high-blast assets.
• Web/Runtime Exploits: WP SQLi/Cisco SSRF — DAST + EASM. Action: Run DAST on exposed web apps/APIs; discover attack surface.
• Governance: All — Policy Management for enforcement. Action: Update critical policies with new findings.

Prioritized Action Plan

• Patch CVE-2026-20230 and audit WebDialer exposure today (EASM scan).
• Enable/scan with SCA + Package Firewall for npm/PyPI dependencies and enforce in CI/CD against Miasma variants.
• Run Risk Manager on KEV items (Cisco/UniFi) with SMART deadline: full remediation in 48h for critical assets.
• Credential hygiene + endpoint controls for ransomware vectors.
• Targeted DAST on web apps; update policies via Policy Management.

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.