Product & Security Tips — SamHouston (Veracode) asked a question.

September 23, 2026 at 6:19 PM
Veracode Threat-to-Control Daily Command Brief | 2026-09-23

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

 

Veracode Threat-to-Control Daily Command Brief | 2026-09-23

 

Executive Summary

  1. MemTensor / sckit dual-ecosystem worm (npm + PyPI, published 2026-09-23) — Malicious versions of @memtensor/memos-cloud-openclaw-plugin (0.1.21, 0.1.23, 0.1.25) and PyPI MemoryOS 2.0.34 ship a Go implant that harvests home-directory credentials and contains self-copy logic into other packages/repos reachable with stolen tokens. Tokens were taken from GitHub Actions release jobs. Atomic Risk 10. Why now: same-day latest tag exposure on an AI-agent memory plugin; worm-class blast radius. Strong Veracode applicability: Package Firewall + SCA + SSCI.
  2. Four KEV additions dated 2026-09-22, federal due 2026-09-25 — Check Point Gateway/Spark VPN RCE CVE-2026-85102 (9.8, exploited against Spark from ~2026-09-12); Check Point Management pre-auth path traversal CVE-2026-93616 (9.8, exploited as far back as 2026-07-23); F5 BIG-IP APM unauth heap-overflow RCE CVE-2026-94127 (9.8, vendor-confirmed in the wild); Arista on-prem VeloCloud Orchestrator CVE-2026-93952 (10.0, vendor-confirmed exploited). Atomic Risk 10. Why now: three-day due window and internet-facing identity/SD-WAN control planes. Strong applicability: EASM + Risk Manager (KEV) + Policy Management.
  3. Underground extortion feud + claimed PeopleSoft zero-day — Public OSINT secondary reporting: one extortion crew seized a rival leak site (2026-09-19–21) and claims a new Oracle PeopleSoft RCE used against a U.S. federal recruiting stack, with 2–3 TB alleged. Prior PeopleSoft Environment Management RCE CVE-2026-35273 (9.8) was already mass-exploited mid-2026. Atomic Risk 9. Why now: leak-site chaos raises dump/reuse risk; PeopleSoft remains a high-value internet-facing HR/ERP surface. Applicability: EASM + DAST + Risk Manager.
  4. D-Link DIR-822A CVE-2026-86296 (CVSS 10.0) + CVE-2026-86510 — Unauth stack overflow in DHCP/udhcpcd with public PoC; vendor investigating, no fix at disclosure; second public-PoC OOB-write on L2TP. Atomic Risk 8 for environments that still run this model. Applicability: EASM + Risk Manager + Policy Management.
  5. BigDiskBuster Defender update-block PoC (2026-09-22) — Public tool fills disk during Defender platform/signature updates so definitions go stale while the product still "runs." No CVE/patch at disclosure. Atomic Risk 7 as a post-foothold enabler, not an initial remote vector. Applicability: Risk Manager + Policy Management.

 

Comprehensive Threats Table

Threats_Table_Sept23 

Full analysis, recommendations, and action plan continue in the comments below.

  • 3 answers
  • 17 views

  • SamHouston (Veracode)

    Detailed First-Principles Analysis

    MemTensor sckit (top control problem today)

    Root cause is not a CVE in application code. It is trusted publishing plus a stolen CI token. Attackers forced GitHub Actions release jobs to hand over npm/PyPI tokens, then published versions that do not match repo tags. Mechanism: lib/sckit.js detaches a multi-arch Go binary that scrapes credentials from the home directory, exfiltrates to attacker infrastructure, and includes copy-forward logic into other packages the stolen identity can publish. Blast radius is worm-shaped: one developer or CI runner becomes the next publisher. Dark-web amplification is secondary; the registry is the distribution channel.

    Veracode Control Point: Package Firewall deny on the named packages/versions and on unknown binaries in install artifacts; SCA + SSCI to flag malicious/trojanized components in lockfiles and SBOMs; Policy Management to fail the pipeline if Firewall or SSCI hits Critical Embedded Malicious Code.

    KEV edge cluster (F5 / Check Point / Arista / Zyxel)

    Root cause is unauthenticated or pre-auth memory/input bugs on devices that terminate identity or SD-WAN. Mechanism: crafted traffic to APM+OAuth virtual servers, VPN certificate negotiation, Management web path traversal + script upload, VCO web input validation, GS1900 CGI overflow. Blast radius is network-wide admin — not a single app finding. Forensic-triage flags on several of these mean "patch then assume compromise."

    Veracode Control Point: EASM to find the public APM/Management/VCO/PeopleSoft/Zyxel surfaces; Risk Manager to pin KEV due 2026-09-24/25 and group related issues; Policy Management to treat unpatched KEV-exposed assets as policy-fail.

    PeopleSoft + leak-site feud

    Root cause: internet-reachable ERP/HR control planes plus extortion economics. Mechanism (confirmed for CVE-2026-35273): unauth RCE on Environment Management, then remote-admin tooling and bulk exfil. The 2026-09-22 "new 0-day" remains a threat-actor claim with public reporting of a spokesperson acknowledgment of PeopleSoft exploitation — treat payload size and named internal services as unverified. Underground OSINT: rival leak-site takeover and threatened release of who paid whom.

    Veracode Control Point: EASM discovery of PeopleSoft/PSEMHUB; DAST against the exposed web tier; Risk Manager to raise PeopleSoft internet exposure to KEV-like urgency even before a new CVE ID lands.

    D-Link / BigDiskBuster

    DIR-822A is an unpatched, public-PoC, max-severity LAN/WAN appliance bug — replace, do not "virtually patch" in SCA. BigDiskBuster is a local disk-fill race against Defender updates; it does not remote-exploit by itself but ages every subsequent detection on that host.

    Veracode Control Point: EASM for the router; Policy Management + Risk Manager for "no-fix appliance" and "stale AV on build agents."

     

    Broader Signals

    • KEV velocity: four critical infrastructure CVEs added 2026-09-22 with a 2026-09-25 due date; Zyxel GS1900 added 2026-09-21 due 2026-09-24.
    • Supply-chain: 2026 pattern remains zero CVEs during active worm waves. Shai-Hulud source has been public since May; Phantom Gyp (binding.gyp / node-gyp) and Ruby extconf.rb remain the preferred install-time hide. MemTensor is a Go-binary mutation of the same token-to-registry loop.
    • Ransomware/extortion: public leak-site volume stays elevated (Qilin / TheGentlemen / Akira / INC-class operators in 2026 rankings). Secondary OSINT: leak-site civil war this week increases the chance of recycled victim lists and stealer logs — not a new encryptor family in the last 24h.
    • Browser/OS: seventh actively exploited Chrome V8 0-day of 2026 earlier this month; BlueMoon kit chains two Chromium bugs with Windows LPE. Defender 0-day drip continues.
    • APT note: BlueMoon adoption by multiple espionage-aligned crews in mid-September; treat as concurrent with crimeware, not instead of it.

     

    Expand Post

  • SamHouston (Veracode)

    Veracode Tool Reference with Links

     

    Veracode Recommendations

    Malicious Packages & Supply Chain Worms

    Threats: MemTensor sckit; Shai-Hulud/Miasma/Phantom Gyp family.

    Why it fits: Firewall + SSCI see malicious versions that never receive a CVE.

    Action: Add deny rules for @memtensor/memos-cloud-openclaw-plugin 0.1.21/0.1.23/0.1.25 and PyPI MemoryOS 2.0.34; enable Firewall on npm and PyPI in CI; turn on SSCI malicious-package intelligence.

    Tool: Package Firewall + SCA + SSCI

     

    New/KEV CVEs

    Threats: CVE-2026-94127, CVE-2026-93616, CVE-2026-85102, CVE-2026-93952, CVE-2026-7273.

    Why it fits: Risk Manager is the KEV context layer.

    Action: Filter Risk Manager to KEV added 2026-09-21–22; set SLA to the catalog due dates; require owner + evidence of hotfix.

    Tool: Risk Manager (KEV)

     

    Web/Runtime Exploits

    Threats: PeopleSoft claimed/prior RCE; Check Point Management web; VCO UI.

    Why it fits: DAST hits the live HTTP surface EASM just found.

    Action: Queue DAST on any discovered PeopleSoft, Management, and VCO hostnames.

    Tool: DAST + EASM

     

    Custom Code

    Threats: Apps that embed AI-agent plugins or custom OAuth/VPN integrations.

    Why it fits: SAST + Fix close first-party injection/path issues that worms and scanners will reuse.

    Action: Run SAST on services that call MemOS/OpenClaw plugins; apply Fix on High+ path traversal and command-exec findings.

    Tool: SAST + Fix

     

    External Attack Surface

    Threats: F5 APM, Check Point Management/Gateway, VCO, PeopleSoft, Zyxel, DIR-822A.

    Why it fits: EASM finds the asset before the ticket exists.

    Action: Seed EASM with APM, VCO, PeopleSoft, Checkpoint, GS1900, DIR-822A; export internet-facing hits to Risk Manager.

    Tool: EASM + Risk Manager

     

    Containers

    Threats: Compromised CI images that npm install/pip install today's wormed packages; SD-WAN/orchestrator adjacent workloads.

    Action: Rescan container/IaC images built since 2026-09-16; fail policy on malicious SCA components.

    Tool: Container Security + SCA + Policy Management

     

    Governance

    Threats: Teams that treat "no CVE" as "no risk."

    Action: Policy rule: Critical malicious package or KEV-exposed asset = pipeline/release fail, no exception without CISO note.

    Tool: Policy Management

     

    Dark-Web-Informed Prioritization

    Threats: Leak-site feud, threatened payment-record dumps, stealer-log reuse.

    Action: In Risk Manager, raise urgency on identity-adjacent apps and any asset already in an extortion narrative; do not wait for a new CVE.

    Tool: Risk Manager

    Expand Post

  • SamHouston (Veracode)

    Prioritized Action Plan

    1. Block MemTensor malicious versions in Package Firewall today and force SCA/SSCI rescan of every lockfile and container built in the last 14 days. Done when deny hits are live and no pipeline can resolve 0.1.21/0.1.23/0.1.25 or MemoryOS==2.0.34.
    2. Rotate npm, PyPI, GitHub, and cloud tokens used by any job that installed those packages or shares an org with MemTensor-style AI plugins. Done when old tokens are revoked.
    3. EASM + Risk Manager sweep for F5 APM+OAuth, Check Point Management/Spark VPN, on-prem VCO, PeopleSoft/PSEMHUB, Zyxel GS1900. Done when each asset has an owner and a patch-or-isolate decision before 2026-09-25 (GS1900: 2026-09-24).
    4. Apply vendor hotfixes for CVE-2026-94127, CVE-2026-93616, CVE-2026-85102, CVE-2026-93952; restrict Management/VCO/PeopleSoft admin planes to trusted networks; hunt vendor IoCs.
    5. Policy Management: add "malicious package = break the build" and "internet-facing KEV = P1."
    6. DAST the PeopleSoft and Management URLs EASM returns.
    7. Developer-workstation note: hunt BigDiskBuster-style failed Defender updates; not a Veracode scanner finding, still a build-agent integrity issue.

     

    Acceleration

    • Today's worm has no CVE. Package Firewall + SSCI is the only control that stops the install before SCA "known vulnerability" logic even applies — natural expansion from SCA-only seats.
    • Four KEV RCEs landed on the same day with a Friday due date. Risk Manager is the conversation for "show the board what is exploited, not what is merely critical."
    • F5 APM, Check Point Management, VCO, and PeopleSoft are discoverability problems. EASM turns "we think we patched" into a list of hostnames still on the internet.
    • AI-agent plugins (OpenClaw / memory OS) are the new npm blast radius. SSCI plus Firewall is the enablement story for teams adopting agent toolchains without waiting for a catalog CVE.

     

    This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.

    Expand Post

Topics (2)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.