Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Miasma / Mini Shai-Hulud / Phantom Gyp relevance: Relevant and high-priority. The June 24–25 Leo Platform wave (20+ packages in seconds via compromised maintainer + binding.gyp "Phantom Gyp" execution) is the latest in a persistent Shai-Hulud/Miasma/Hades lineage. No brand-new massive wave in the last 24–48h, but the family remains active, evolving, and demonstrates real supply-chain worm behavior (credential theft, GitHub workflow injection, AI-assistant backdoors, CI/CD poisoning). Blast radius is extreme for any org with npm/PyPI/Go deps or developer workflows. It is not fading noise — it is a live example of why SCA + Package Firewall exists. Veracode applicability is direct and strong. Flag: treat affected environments as potentially compromised until rebuilt from clean sources.

Executive Summary — Top Threats as of 2026-07-01

• CVE-2026-48558 (SimpleHelp RMM OIDC auth bypass): Critical (CVSS 10.0) active exploitation delivering Djinn Stealer/TaskWeaver. ~14k exposed instances; CISA KEV with July 2 deadline. Atomic Risk: 9/10. Why now: MSP/IT helpdesk foothold for credential theft and persistence. Strong Risk Manager (KEV) fit.
• Miasma/Phantom Gyp npm worm (Leo Platform + lineage): Ongoing supply-chain campaign stealing CI/CD/cloud/IDE secrets via install-time execution. Atomic Risk: 9/10. Why now: Demonstrates bypass of traditional script monitors; persistent family threat. Direct Package Firewall + SCA control point.
• CVE-2026-46817 (Oracle E-Business Suite Payments): Actively exploited in-wild (unauth file read/takeover) post-May patch. Atomic Risk: 8/10. Enterprise financial systems impact. Risk Manager + DAST.
• Chrome critical use-after-free / sandbox escape vulns in recent builds; broader ransomware "new normal" activity. No single explosive new zero-day dominating last 24h.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

• SimpleHelp CVE-2026-48558: Root cause = flawed OIDC token validation (accepts forged claims without signature check). Mechanism: unauth attacker creates privileged Technician session, bypasses MFA in some configs, gains remote control/script exec on managed endpoints. Blast radius: MSP/IT environments = broad downstream compromise. Veracode control: Risk Manager for KEV prioritization and unified view.
• Miasma/Phantom Gyp: Root cause = trust in node-gyp + binding.gyp file (command expansion executes attacker code at install without package.json scripts). Mechanism: obfuscated payload (ROT/AES), credential harvesting (env, tokens, GitHub, cloud metadata), GitHub dead-drop exfil, workflow/AI backdoor planting. Blast radius: worm-like propagation across OSS ecosystems + developer/CI machines. Why it matters: bypasses most legacy SCA/script monitors. Veracode control: SCA + Package Firewall blocks at source and enforces policy in pipeline. Propagation risk for supply-chain worms remains elevated — assume compromise until proven clean.

Broader Signals

X volume on Miasma/Leo wave has cooled from peak but references persist in threat bulletins. Ransomware steady ("new normal" with AI-assisted ops). No massive new APT zero-day surge in strict last 24h.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities):
• https://docs.veracode.com/r/Software_Composition_Analysis
• https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context):
• https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA):
• https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities):
• https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing):
• https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery):
• https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security:
• https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement):
• https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

• Malicious Packages & Supply Chain Worms (Miasma/Phantom Gyp/Leo wave): Package Firewall + SCA. Why: Directly detects/blocks malicious npm artifacts and enforces policy at ingest/CI. Customer action: Enable strict malicious-package policies + full SCA scans on all npm/PyPI projects today; rebuild affected repos from known-good lockfiles.
• New/KEV CVEs (SimpleHelp CVE-2026-48558, Oracle CVE-2026-46817): Risk Manager (KEV). Why: Unified prioritization with CISA deadlines and active exploitation context. Customer action: Import/prioritize these in Risk Manager; set aggressive SLAs and policy gates.
• Web/Runtime Exploits (Chrome + Oracle): DAST. Why: Validates runtime exposure on web-facing or integrated apps. Customer action: Targeted DAST on exposed Oracle/monitoring surfaces.
• Governance (all items): Policy Management. Why: Enforce consistent controls across tools and pipelines.

Prioritized Action Plan (SMART, executable today)

1. Highest priority: Enable Package Firewall policies for malicious packages + run full SCA scans on all npm/PyPI/Go projects; enforce in CI/CD (Miasma direct hit).
2. Prioritize Risk Manager (KEV) for SimpleHelp CVE-2026-48558 (July 2 deadline) and Oracle; update critical policies.
3. Run targeted DAST on internet-facing Oracle EBS and monitoring assets.
4. Audit/rebuild any Leo Platform or prior Miasma-affected npm usage from clean sources; rotate exposed credentials from clean host.
5. Policy Management sweep for OSS/dependency governance gaps.
6. SMART goal: Complete top SCA + Firewall enforcement + KEV triage in Risk Manager by EOD; zero high-risk malicious deps in production paths.

LEGAL DISCLAIMER

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.