Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure! https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• Shai-Hulud/Miasma/Mini Shai-Hulud supply chain worm + new fake payment SDK malicious packages (npm/PyPI, published ~July 7–8, 2026): Self-propagating credential-harvesting campaign abusing binding.gyp ("Phantom Gyp") for install-time execution, typosquatting, and maintainer/CI compromise. Hundreds of packages historically affected; new cluster (paysafe-*, skrill-*, neteller-*) steals CI/CD secrets, tokens, and env data. Atomic Risk: 9/10. First-principles: OSS registry trust + automated npm install/pip install creates autonomous blast radius to every downstream dev/CI environment. Strong Veracode applicability: Package Firewall + SCA.
• CISA KEV addition (2026-07-13): CVE-2008-4128 Cisco IOS CSRF: Legacy but now confirmed actively exploited vector for remote command execution on exposed routers. Atomic Risk: 7/10. Why now: BOD 26-04 mandates rapid action on exposed assets granting total control.
• Actively exploited KEVs (added ~July 7, deadlines recent/passed): Adobe ColdFusion CVE-2026-48282 (CVSS 10.0 path traversal $\rightarrow$ RCE), Joomla Page Builder CVEs CVE-2026-48908/CVE-2026-56290 (CVSS 10.0 unauth file upload/RCE), Langflow CVE-2026-55255 (CVSS 8.4 IDOR/authz bypass $\rightarrow$ arbitrary flow execution). Atomic Risk: 9/10. High in-wild exploitation confirmed.
• Ongoing ransomware (Settra, The_Gentlemen/Thegentlemen, Gunra, Medusa Locker, Qilin, Stormous active July 2026): Steady victim volume fueled by infostealer/credential campaigns (e.g., FortiBleed linked to INC/Lynx). No single new mega-campaign in last 24h but high operational tempo.
• Broader signals: Evolving worm tactics (binding.gyp evasion, loader mutations, legitimate project weaponization); NK-linked supply chain (Sapphire Sleet/BlueNoroff); public PoCs for select Linux kernel issues. Supply chain remains highest blast-radius vector.

All items deduplicated and ranked by CVSS $\ge$ 7.0 OR KEV OR public exploit/in-wild OR supply-chain propagation risk.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Shai-Hulud/Miasma supply chain worm (incl. July 2026 payment SDK campaign):

• Root Cause: Compromise of maintainer accounts or CI/CD pipelines (via stolen OIDC/GitHub tokens), followed by injection of a malicious payload into the publish pipeline or a direct malicious version upload.
• Mechanism: The binding.gyp file (normally for native addons) is processed by node-gyp at install time. This executes attacker JavaScript that harvests .env files, npm/PyPI/GitHub/cloud tokens, SSH keys, Vault data, and CI secrets. It then exfiltrates and uses these stolen credentials to republish more malicious versions (worm propagation). The new July variant uses convincing SDK facades (like paysafe-checkout) with sandbox evasion.
• Blast Radius: Any direct or transitive dependency triggers infection upon installation. Stolen secrets enable full GitHub organization takeovers, cloud account compromise, and further downstream poisoning.
• Propagation Risk: High — fully autonomous across registries.
• Veracode Control Point: SCA + Package Firewall gates at dependency resolution and CI/CD to detect and block threats before execution; Policy Management enforces compliance.

CVE-2026-48282 Adobe ColdFusion (and similar Joomla/Langflow KEVs):

Root cause is insufficient path validation (CWE-22) or improper access control allowing unauthenticated file upload/overwrite or IDOR leading to RCE/flow execution. Actively exploited in wild with public indicators. Blast radius: Full compromise of internet-facing instances (code execution in context of app user, potential lateral movement). Why matters now: KEV addition + BOD 26-04 creates hard federal deadlines; unpatched = immediate target. Veracode control point: DAST for runtime confirmation on exposed apps; Risk Manager for KEV-aware prioritization across portfolio.

CVE-2008-4128 Cisco IOS CSRF:

Root cause is insufficient CSRF protection in legacy HTTP admin interface. Now confirmed actively exploited. Blast radius: Remote command execution on exposed routers (legacy but still internet-facing in many environments). Veracode control point: EASM to discover exposed assets + Risk Manager (KEV) for unified tracking and policy enforcement.

Broader Signals

High signal volume on supply chain (Sonatype tracking cumulative 1.8M malicious packages; new Miasma waves + payment SDK cluster). Worm tactics evolving rapidly (binding.gyp/Phantom Gyp bypass, loader mutations for evasion, typosquatting + weaponization of legitimate projects). APT notes: North Korea-linked (Sapphire Sleet) supply chain campaigns targeting AI/dev tooling; ongoing credential theft feeding ransomware. X/web chatter elevated on #ShaiHulud, malicious packages, and recent KEVs. No major silent sources.

Veracode Tool Reference with Links

• SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities):
  • https://docs.veracode.com/r/Software_Composition_Analysis
  • https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager (unified risk prioritization with CISA KEV context):
  • https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix (AI remediation for SAST/SCA):
  • https://docs.veracode.com/r/About_Veracode_Fix
• SAST (custom code vulnerabilities):
  • https://docs.veracode.com/r/c_static_overview
• DAST (runtime web app and API testing):
  • https://docs.veracode.com/r/DAST
• EASM (external attack surface discovery):
  • https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security:
  • https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management (governance and enforcement):
  • https://docs.veracode.com/r/c_appsec_policies