Product & Security Tips — SamHouston (Veracode) asked a question.
Written by Andrea Mazzarini, Senior Principal CSM at Veracode
Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/
Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!
https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips
Executive Summary
Persistent high-blast-radius npm supply-chain worm activity (ChainDrop / Shai-Hulud family variants) continues to dominate, with credential-stealing self-propagating malware that compromised high-download packages and cascaded across hundreds of artifacts totaling billions of monthly installs; Atomic Risk 10. This remains the top immediate threat because of automatic propagation via stolen maintainer tokens and CI secrets, enabling rapid ecosystem-wide compromise of developer tooling and downstream applications. Strong Veracode applicability via Package Firewall + SCA + SSCI.
Actively exploited Windows kernel privilege-escalation zero-day (CVE-2026-68820) added to KEV and leveraged in nation-state campaigns for SYSTEM access and rootkit deployment; Atomic Risk 9. First-principles impact is local escalation that converts any foothold into full host control. Strong Risk Manager (KEV) + Policy Management fit.
Critical unauthenticated SQLi in Metabase (CVE-2026-72898, CVSS 10.0) under active exploitation granting database admin and credential theft from connected data sources; Atomic Risk 9. Self-hosted instances remain exposed at scale. Risk Manager (KEV) + DAST/EASM prioritization.
VMware vCenter critical RCE (CVE-2026-59310, CVSS 9.8) under active exploitation leading to reverse shells, lateral movement, and ransomware deployment across hundreds of instances; Atomic Risk 9. Container Security + Risk Manager + EASM.
Secondary dark-web/underground signals (OSINT reporting only) show continued high volume of stealer-log credential dumps, enterprise Azure/Entra directory harvests, and ransomware leak-site activity tied to ongoing campaigns. These amplify urgency for identity and supply-chain controls.
Comprehensive Threats Table
Detailed First-Principles Analysis (Top Items)
npm ChainDrop / Shai-Hulud Family Worm
Root cause is compromised maintainer GitHub accounts used to push malicious releases carrying preinstall droppers (or binding.gyp / Phantom Gyp variants in related waves) that execute on npm install. Mechanism: harvest hundreds of credential types (npm/GitHub/cloud/CI/AI-tool tokens), exfiltrate (including via blockchain C2 in some variants), then use stolen tokens to republish poisoned versions of any packages the victim controls — creating automatic worm propagation.
Blast radius is extreme: core packages alone exceed hundreds of millions of weekly downloads and appear in a large percentage of cloud environments; secondary infections reach organizational packages. Dark-web amplification risk exists via stolen secrets fueling further campaigns.
Veracode Control Point: Package Firewall blocks known-malicious and high-risk packages at the registry/policy layer before install; SCA + SSCI continuously monitors dependency graphs and proprietary threat feed for worm signatures and newly compromised artifacts; Risk Manager elevates the finding for immediate remediation.
CVE-2026-68820 — Windows Kernel Privilege Escalation (afd.sys UAF)
Root cause is a use-after-free race condition in the Windows Ancillary Function Driver for WinSock (afd.sys). Mechanism: low-privilege local attacker triggers the race to achieve SYSTEM. Already chained in nation-state operations for kernel rootkits. Blast radius is any Windows endpoint or server with a foothold.
Veracode Control Point: Risk Manager surfaces the KEV entry with unified prioritization and due-date context; Policy Management enforces rapid remediation SLAs across the portfolio.
CVE-2026-72898 — Metabase Unauthenticated SQLi (CVSS 10.0)
Root cause is improper input handling in Metabase's password-reset endpoint allowing unauthenticated SQL injection that yields application-database administrator access (including credentials for connected data sources). Mechanism enables full data exfiltration and further lateral movement. Thousands of self-hosted instances were still vulnerable post-disclosure.
Veracode Control Point: Risk Manager (KEV) for prioritization; DAST for runtime confirmation of exposed instances; EASM for discovery of public-facing Metabase.
CVE-2026-59310 — VMware vCenter Syslog Directory Traversal RCE (CVSS 9.8)
Root cause is directory traversal in the vCenter Syslog server enabling unauthenticated remote code execution. Mechanism leads to reverse shells, new admin accounts, credential theft from vmdir, ESXi lateral movement, and ransomware. Hundreds of instances compromised within days of disclosure.
Veracode Control Point: Container Security for vSphere/K8s-adjacent posture; EASM for exposed management interfaces; Risk Manager for urgency scoring.
Daily Threat Intel Brief | LinkedIn
Daily curated threats with CVSS context and actionable AppSec recommendations for security leaders.
https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/
.png){kind=logo}
Broader Signals
Supply-chain worm volume remains elevated across npm (and prior PyPI waves); multiple distinct Shai-Hulud/Miasma variants observed in the last 14 days with evolving install-time techniques. Zero-day signals include the GeoServer SQLi and residual public PoCs for Windows Defender bypasses. APT notes center on Lazarus (Windows kernel) and suspected China-nexus activity (vCenter). Dark-web / underground OSINT secondary reporting shows sustained high activity in stealer-log Telegram channels, enterprise credential dumps (Azure/Entra), and ransomware leak-site postings (Cl0p claims among others). No single catastrophic new zero-day sale dominated the last 48 h, but the baseline of credential and exploit trading remains elevated — reinforcing the need for continuous Package Firewall and Risk Manager prioritization.
Veracode Tool Reference with Links
Veracode Recommendations
Malicious Packages & Supply Chain Worms
Threats: ChainDrop / Shai-Hulud family.
Why: Direct detection and blocking of malicious/self-propagating packages.
Action: Enable/enforce Package Firewall policies that quarantine known-malicious and high-risk npm packages; run SCA + SSCI scans on all Node.js applications and CI pipelines; review SSCI threat feed for new worm variants.
Tool: Package Firewall + SCA + SSCI
New/KEV CVEs
Threats: CVE-2026-68820, CVE-2026-72898, CVE-2026-59310.
Why: Unified risk view with KEV context and due dates.
Action: In Risk Manager, filter and prioritize all KEV-listed items; assign owners and enforce Policy Management SLAs for patching.
Tool: Risk Manager (KEV) + Policy Management
Web/Runtime Exploits
Threats: Metabase SQLi, GeoServer SQLi.
Why: Runtime confirmation and external exposure discovery.
Action: Schedule DAST scans against Metabase and GeoServer instances; use EASM to discover and inventory public-facing instances.
Tool: DAST + EASM
Custom Code
Threats: Potential injection or privilege issues in application code that could be chained.
Why: Source-level detection and AI remediation.
Action: Run SAST on applications that consume affected OSS or expose similar endpoints; apply Veracode Fix for rapid remediation.
Tool: SAST + Veracode Fix
External Attack Surface
Threats: Exposed vCenter, Metabase, GeoServer, PLM systems.
Why: Discovery of internet-facing assets under active attack.
Action: Run full EASM discovery; feed high-risk assets into Risk Manager for prioritization.
Tool: EASM + Risk Manager
Containers
Threats: vCenter / ESXi / K8s-adjacent workloads.
Why: Container and IaC posture against RCE and ransomware paths.
Action: Scan container images and Kubernetes manifests with Container Security; enforce Policy Management gates.
Tool: Container Security + Policy Management
Governance
Threats: Portfolio-wide KEV and supply-chain exposure.
Why: Consistent enforcement.
Action: Update Policy Management rules to require Package Firewall blocking and KEV remediation within defined windows.
Tool: Policy Management
Dark-Web-Informed Prioritization
Threats: Credential dumps and ransomware claims.
Why: Elevates urgency of identity and supply-chain findings.
Action: In Risk Manager, apply elevated scoring to findings linked to credential-harvesting or actively claimed campaigns.
Tool: Risk Manager
Prioritized Action Plan (SMART, Executable Today)
This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.