Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

Active self-propagating supply-chain worms in the npm/PyPI ecosystems (Miasma / Shai-Hulud lineage variants including Phantom Gyp binding.gyp execution and Hades .pth loaders, plus the July 14 AsyncAPI CI-pipeline compromise delivering multi-stage credential-harvesting payloads) remain the highest-blast-radius threat. Impact: rapid lateral propagation via stolen maintainer tokens, CI secrets, and cloud credentials into downstream developer workstations and build systems; Atomic Risk 10. First-principles: install-time or import-time execution bypasses many traditional script controls and turns every compromised package into a new distribution node. Strong Veracode applicability via Package Firewall + SCA + SSCI.

Two critical KEV additions with confirmed in-wild exploitation (Microsoft SharePoint deserialization RCE enabling machine-key theft for post-patch persistence, and Check Point SmartConsole authentication bypass granting unauthenticated full administrative control of management servers) create immediate total-control risk on internet-exposed assets; Atomic Risk 9–10. WordPress Core unauthenticated RCE chain (wp2shell) via REST batch-route confusion + SQL injection is also KEV-listed and actively scanned/exploited. Strong Veracode applicability via Risk Manager (KEV prioritization) + EASM.

Infostealer-driven ransomware activity continues at elevated volume, with credential dumps fueling rapid initial access for multiple active groups; Atomic Risk 8. Veracode applicability via Risk Manager dark-web-informed urgency scoring and EASM exposure reduction.

All findings map directly to Platform controls for detection, blocking, prioritization, and remediation.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

Supply-Chain Worms (Miasma / Phantom Gyp / Hades / AsyncAPI)

Supply-chain worms succeed because package registries and CI systems treat published artifacts as trusted by default. Root cause is compromised maintainer credentials or misconfigured GitHub Actions (pull_request_target / OIDC token abuse) that allow an attacker to inject a binding.gyp (Phantom Gyp) or .pth file that executes during legitimate install or Python startup.

Mechanism: node-gyp rebuild or Python site-packages import triggers shell expansion or Bun runtime download, leading to credential scraping (npm/GitHub/cloud/SSH/Kubernetes tokens), encrypted exfiltration to attacker-controlled repos or IPFS, and automated re-publication of poisoned packages under the victim's identity. Blast radius is exponential: each new compromised account becomes a distribution node; lockfiles generated during the short live window remain poisoned indefinitely. Dark-web secondary reporting shows stealer logs containing the harvested secrets appear on underground channels within days, amplifying ransomware initial-access brokers.

Veracode Control Point: Package Firewall blocks the malicious artifact at the registry proxy or policy gate before it ever reaches the build; SCA + SSCI continuous scanning and proprietary threat feed detect the known worm signatures and anomalous lifecycle hooks; Risk Manager elevates the finding with KEV-style urgency even without a formal CVE.

SharePoint CVE-2026-50522 — Deserialization RCE / Machine-Key Theft

SharePoint CVE-2026-50522 is a classic untrusted-data deserialization path in the SessionSecurityTokenHandler / WS-Federation flow. An unauthenticated network request delivers a crafted BinaryFormatter payload that executes in the SharePoint application-pool context and extracts machine keys. Once keys are stolen, the attacker retains the ability to forge valid tokens after the server is patched.

Blast radius: any on-prem SharePoint farm reachable from the internet or internal lateral movement becomes a persistent foothold for ransomware or data theft.

Veracode Control Point: Risk Manager surfaces the KEV entry with unified risk scoring and due-date enforcement; EASM discovers the external exposure of SharePoint endpoints so the asset can be prioritized and access restricted.

Check Point CVE-2026-16232 — SmartConsole Authentication Bypass

Check Point CVE-2026-16232 is an improper authentication flaw in the SmartConsole application-token login path. When the management server is internet-reachable and Trusted Clients are unrestricted, an unauthenticated attacker obtains a full-admin token and can rewrite security policy across all managed gateways.

Veracode Control Point: Risk Manager (KEV) + EASM exposure discovery and policy enforcement.

WordPress wp2shell RCE Chain

WordPress wp2shell combines REST API batch-route confusion (index offset on failed sub-requests) with an SQLi in the author__not_in WP_Query parameter. The chain requires no authentication and no plugins on default installs of the affected major versions, enabling direct RCE.

Veracode Control Point: Risk Manager prioritization + EASM external web-app discovery + DAST runtime confirmation of the vulnerable endpoints.