Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

The last 24–48 hours featured CISA KEV additions on July 21 (multiple actively exploited vulnerabilities with imminent due dates) alongside the persistent high-impact Miasma npm supply-chain compromise (trojanized packages published July 14 via GitHub Actions token theft, with import-time credential-harvesting payloads). Supply-chain/OSS worm-like activity and KEV signals dominate; ransomware ecosystem expansion continues with new actors emerging at a rate exceeding one per week. No brand-new zero-day public PoC disclosures dominated the last 48 hours, but active in-wild exploitation is confirmed via KEV.

Top Threats (Prioritized by Blast Radius and Veracode Alignment)

1. Miasma npm supply-chain trojanization (AsyncAPI and related campaigns) — Import-time payload steals CI/CD tokens (GITHUB_TOKEN, NPM_TOKEN) on package load/require. High propagation risk via stolen credentials enabling further repository or registry abuse. Atomic Risk: 9/10. Strong, direct Veracode applicability (Package Firewall + SCA + SSCI blocks and prioritizes).
2. CISA KEV July 21 additions (Fortinet FortiSandbox OS command injection CVSS 9.8, Microsoft SharePoint deserialization RCE, Langflow RCE, WordPress wp2shell RCE chain) — Actively exploited in the wild; many with July 24 due dates. Broad enterprise and web exposure. Atomic Risk: 8–9/10. Strong Veracode applicability (Risk Manager (KEV) + EASM + DAST).
3. Ongoing ransomware campaigns + new actor proliferation (61+ new groups YTD, 146+ active groups, record victim volumes) — Sustained double-extortion and underground leak activity amplifying exploitation of unpatched systems. Atomic Risk: 7/10. Veracode applicability via Risk Manager for dark-web-informed prioritization.
4. Continuing SharePoint exploitation wave (multiple vulns in recent period, including latest KEV) — Repeated targeting of enterprise collaboration platforms.

These create immediate Platform-actionable signals: accelerate Package Firewall/SSCI for OSS integrity, Risk Manager for KEV/exploit-context prioritization, and EASM for external exposure reduction. Edge cases include cached/local npm installs, transitive/hoisted dependencies, internal mirrors that ingested bad versions, serverless or containerized workloads using affected packages, and air-gapped environments with delayed but real token-reuse risk.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Miasma npm Supply-Chain Trojanized Packages

Root cause: Attacker leveraged misconfigured GitHub Actions workflow (pull_request_target event) on AsyncAPI repositories to exfiltrate a maintainer/bot personal access token (PAT), enabling unauthorized pushes to auto-publish branches and npm releases. Trojanized versions contain payload that executes at import/require time inside the consuming Node.js process.

Mechanism: On module load the payload inspects environment (CI runner context), harvests GITHUB_TOKEN, NPM_TOKEN, SSH keys, AWS credentials, etc., and exfiltrates them. No traditional install hook required in many cases — stealthy execution in the caller's context. Prior Miasma-family activity (Red Hat cloud-services packages June 2026, Mastra 140+ packages, LeoPlatform/RStreams, Go ecosystem spread) shows iterative refinement and cross-registry propagation.

Blast radius & propagation risk: Extremely high. Direct consumers of affected versions (generator, generator-components, etc.) immediately expose CI/CD and developer workstations. Stolen tokens enable worm-like follow-on actions: pushing additional malicious packages, accessing private repositories, or lateral movement inside organizations. Affects API tooling, code-generation pipelines, and any downstream artifact consumers. Dark-web amplification is secondary (token/access sales) but compounds urgency. Edge case: hoisted dependencies in monorepos, cached installs in CI runners, or internal npm proxies that mirrored bad versions before takedown.

Veracode Control Point: Package Firewall + SSCI threat intelligence feed identifies and blocks known malicious package versions and Miasma-family indicators in real time during intake or policy enforcement. SCA maps the full dependency tree and surfaces the compromised versions. Risk Manager elevates any application touching these packages with active-campaign context. Policy Management enforces mandatory OSS governance and blocks high-risk intake.

Fortinet FortiSandbox OS Command Injection (CVE-2026-25089 / 39808) & Microsoft SharePoint Deserialization RCE (CVE-2026-58644)

Root cause (Fortinet): Insufficient sanitization of HTTP request parameters allows unauthenticated attackers to inject and execute OS commands. Root cause (SharePoint): Unsafe deserialization of untrusted data over the network permits remote code execution without authentication.

Mechanism: Both are remote, unauthenticated vectors — crafted HTTP requests for Fortinet; deserialization gadget chains for SharePoint. KEV designation confirms in-wild exploitation (often initial access or ransomware deployment).

Blast radius: Fortinet appliances are security gateways — compromise yields broad network visibility/control. SharePoint is ubiquitous enterprise collaboration — RCE enables data exfiltration, persistence, or ransomware staging. Propagation risk elevated when these sit internet-exposed or in hybrid environments.

Veracode Control Point: Risk Manager (KEV) overlays active-exploitation and due-date context on inventory for prioritized triage. EASM continuously discovers exposed Fortinet and SharePoint instances. DAST validates runtime exploitability of web-exposed surfaces. Container Security covers any containerized deployments. Policy Management enforces SLAs aligned to CISA BOD timelines.

WordPress wp2shell RCE Chain (CVE-2026-63030 + 60137) & Langflow RCE (CVE-2026-0770)

Root cause (WP): Interpretation conflict in core batch REST endpoint combined with SQL injection in WP_Query when untrusted input reaches parameters; chains to unauthenticated admin account creation or direct code execution on default installs. No plugins/themes required. Root cause (Langflow): Unsafe inclusion/handling of exec_globals parameter in validate endpoint allows remote attackers to execute arbitrary code (potentially root context) via untrusted control sphere.

Mechanism: Pure unauthenticated remote vectors — single REST request for WP chain; crafted validate call for Langflow. Both patched recently (WP July 17) but KEV confirms active exploitation against unpatched instances.

Blast radius: WP affects millions of sites (core only); easy initial access or defacement vector frequently chained into ransomware. Langflow impacts AI/LLM workflow builders — growing attack surface as organizations adopt low-code LLM tooling.

Veracode Control Point: DAST discovers runtime RCE in web applications and APIs. Risk Manager (KEV) prioritizes these findings with exploitation context and dark-web-informed urgency. EASM identifies publicly reachable WordPress and Langflow instances. Policy Management mandates web-app scanning and rapid remediation SLAs.

Broader Signals

Supply-chain attack tempo in npm/PyPI ecosystems remains elevated throughout 2026 with iterative worm-like credential stealers (Miasma variants spanning multiple organizations and registries). KEV catalog additions are frequent, confirming sustained offensive focus on enterprise platforms (security appliances, collaboration software, web CMS, AI tooling). Ransomware actor count continues surging (>1 new group per week; 61+ YTD) with persistent double-extortion and leak-site activity — underground signals indicate healthy marketplace for initial-access exploits and stolen credentials. X chatter in the last 24 hours shows limited brand-new zero-day noise but reinforces ongoing SharePoint targeting. No critical new public PoC zero-days dominated the window, but active exploitation is the dominant signal.