Product & Security Tips — SamHouston (Veracode) asked a question.
Written by Andrea Mazzarini, Senior Principal CSM at Veracode
Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/
Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!
https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips
Executive Summary
- Citrix NetScaler ADC/Gateway unauth RCE pair (CVE-2026-88771, CVE-2026-88772) — CVSS 9.5, KEV added 2026-09-27, federal due 2026-09-30, forensic triage required. Impact: total control of the access path (VPN/AAA/gateway). Atomic Risk 10. Why now: confirmed global in-wild use before/with patch; implants can survive a version bump. Veracode: EASM + Risk Manager (KEV).
- WordPress Core template-include LFI→conditional RCE (CVE-2026-87902) — CVSS 8.1 (v3.1) / 9.2 (v4.0), KEV 2026-09-25, due today 2026-09-28, public exploit path published. Impact: unauthenticated include of local PHP; mass internet blast radius. Atomic Risk 9. Veracode: EASM + DAST + Risk Manager (KEV).
- SharePoint code injection (CVE-2026-65660) — CVSS 8.8, KEV 2026-09-25, due today. Impact: authorized network attacker → code execution on collaboration estates. Atomic Risk 8. Veracode: EASM + Risk Manager (KEV).
- Adobe Commerce / Magento storefront RCE + auth-bypass cluster (CVE-2026-75650 CVSS 10.0; CVE-2026-71362 CVSS 9.1, KEV) — in-wild implants (Rust backdoor / PHP web shell) and session-switch. Atomic Risk 9. Veracode: EASM + DAST + Risk Manager (KEV).
- Supply-chain worms / OSS malware (Shai-Hulud family, Phantom Gyp / binding.gyp, Miasma, Mini Shai-Hulud) — no confirmed new registry worm wave in last_7_days or last_14_days. Residual risk remains first-priority: install-time execution that bypasses lifecycle-script controls, credential worming across npm/PyPI/RubyGems/Go, AI-assistant hook persistence. Atomic Risk 8 (persistent). Veracode: Package Firewall + SCA + SSCI. Dark-web OSINT (secondary): leak-site volume remains high (thousands of claimed victims in 90 days; multiple groups last-seen 2026-09-27/28); stealer-log and initial-access markets remain the ransomware feeder.
Comprehensive Threats Table
NetScaler unauth command injection + buffer RCE (CVE-2026-88771, CVE-2026-88772)
CVSS: 9.5. Exploit status: KEV; in-wild; zero-day. Affected: NetScaler ADC/Gateway (unpatched trains before vendor fixed builds). Atomic Risk: 10. Immediate mitigation: Forensic image first; apply vendor builds; hunt logs/tmp; rotate tokens. Veracode Tool Mapping: EASM + Risk Manager (KEV).
WordPress Core page-template LFI (CVE-2026-87902)
CVSS: 8.1 / 9.2. Exploit status: KEV; public PoC; mass probing. Affected: WordPress Core through 7.1.1; backports to 4.7. Atomic Risk: 9. Immediate mitigation: Patch to 7.1.2 or branch backport today; hunt included PHP / new files. Veracode Tool Mapping: EASM + DAST + Risk Manager (KEV).
SharePoint code injection (CVE-2026-65660)
CVSS: 8.8. Exploit status: KEV. Affected: SharePoint Server 2016/2019/Subscription. Atomic Risk: 8. Immediate mitigation: Patch today; restrict authorized remote admin paths. Veracode Tool Mapping: EASM + Risk Manager (KEV).
MikroTik RouterOS workflow bypass (CVE-2026-67279)
CVSS: ~6.5–6.9. Exploit status: KEV; unauth session/exec chain. Affected: RouterOS. Atomic Risk: 7. Immediate mitigation: Patch; pull management planes off internet. Veracode Tool Mapping: EASM + Risk Manager (KEV).
Adobe Commerce template RCE StyleSmuggler (CVE-2026-75650)
CVSS: 10.0. Exploit status: In-wild; implants. Affected: Commerce / Magento 2.4.4–2.4.9 trains incl. Aug builds until hotfix. Atomic Risk: 9. Immediate mitigation: Emergency hotfix; rotate encryption keys and secrets; hunt implants. Veracode Tool Mapping: EASM + DAST + Risk Manager (KEV).
Adobe Commerce incorrect authorization (CVE-2026-71362)
CVSS: 9.1. Exploit status: KEV; post-disclosure abuse. Affected: Commerce / Magento / B2B. Atomic Risk: 8. Immediate mitigation: Move to Aug security train; session/account review. Veracode Tool Mapping: EASM + DAST + Risk Manager (KEV).
Identity/edge cluster (Check Point, F5 BIG-IP APM, Arista on-prem orchestrator, Cisco ISE)
CVSS: 9.8–10.0. Exploit status: KEV last_7–14d. Affected: VPN, APM/OAuth, SD-WAN orchestrator, ISE. Atomic Risk: 9. Immediate mitigation: Patch exposed control planes; forensic triage where directed. Veracode Tool Mapping: EASM + Risk Manager (KEV).
Shai-Hulud / Mini Shai-Hulud / Miasma / Phantom Gyp residual
CVSS: N/A (malware). Exploit status: Persistent campaign watch; no new 7–14d wave confirmed. Affected: npm, PyPI, RubyGems, Go modules, GitHub Actions. Atomic Risk: 8. Immediate mitigation: Point package managers at firewall; deny malware/typosquat/High-Critical; rotate tokens. Veracode Tool Mapping: Package Firewall + SCA + SSCI.
AI coding-agent Git-config execution (GitSpawn class; CVE-2026-72718 and siblings)
CVSS: 7.0 class. Exploit status: Public research; mixed patch state early Sept. Affected: Claude Code, Codex, Cursor, and peer agents. Atomic Risk: 7. Immediate mitigation: Upgrade agents; do not open untrusted repos; treat agent-written authz as untrusted. Veracode Tool Mapping: SAST + DryRun + Policy Management.
AI-generated / vibe-coded logic flaws (IDOR, broken auth)
CVSS: N/A (class). Exploit status: Repeated research + incident pattern. Affected: Apps built in Cursor, Claude Code, Codex. Atomic Risk: 7. Immediate mitigation: PR-gate SAST; add intent/logic review on authz paths. Veracode Tool Mapping: SAST + DryRun + Fix.
Ransomware leak-site + stealer-log markets
CVSS: N/A. Exploit status: Active OSINT listings. Affected: Enterprise identity, schools, mid-market. Atomic Risk: 7. Immediate mitigation: Assume credential reuse; KEV-prioritize exposed apps. Veracode Tool Mapping: Risk Manager + EASM + Policy Management.
.png){kind=logo}
Detailed First-Principles Analysis
NetScaler pair
Root cause: unsanitized attacker-controlled fields written to appliance logs, then interpolated into a privileged shell pipeline; plus a default-on DTLS memory flaw on VPN virtual servers. Mechanism: one unauthenticated HTTP POST can plant metacharacters; execution may be delayed until a maintenance script runs, or forced sooner. Blast radius: the box that issues sessions and enforces network policy. Control point: EASM to find internet-facing ADC/Gateway; Risk Manager to force KEV SLAs; patch and forensic triage are infrastructure actions outside AppSec scanners.
WordPress template include
Root cause: locate_template() / get_page_template() accepted a decoded pagename and included a .php path outside theme roots. Mechanism: unauthenticated query → local include → conditional RCE when a useful gadget file exists. Blast radius: the default CMS of the public web; public PoC lowers skill. Control point: EASM for Core/version exposure; DAST for runtime include/path issues on custom plugins/themes you own; Risk Manager for KEV due-today.
Commerce cluster
Root cause: template-engine neutralization failure plus incorrect authorization on customer identity. Mechanism: unauth RCE → persistent implant; or session switch without credentials. Blast radius: payment and PII stores. Control point: EASM + DAST on storefronts/APIs; Risk Manager for KEV/hotfix status.
Supply-chain family (watch, not a new 48h wave)
Root cause: maintainer/OIDC/CI token theft plus install-time execution hidden in binding.gyp / native-build hooks rather than preinstall. Mechanism: one infected laptop or runner republishes the worm into every package the token can sign. Blast radius: CI secrets, cloud identities, Vault, AI-assistant hook directories. Control point: Package Firewall at ingest; SCA on what already landed; SSCI threat/reputation feed for malware packages that have no CVE.
AI-code / logic
Root cause: agents execute repo-controlled Git helpers before trust prompts; generated handlers check identity for one role and skip it for others (IDOR / broken auth). Control point: SAST as system of record; DryRun for intent/business-logic and AI-native PR review; Fix for deterministic SAST patches.
Broader Signals
KEV additions remain dense (dozens in 30 days); yesterday's batch is edge-infrastructure RCE, not AppSec CVEs. No confirmed new npm/PyPI worm in last_7 or last_14 days — treat as Status Quo + Persistent Campaign Watch. Zero-day tempo is high on browsers, Windows LPE, and network appliances. APT-relevant pattern: shared exploit kits chaining browser + Windows LPE. AI-code residual: agent RCE via repo config plus systematic authz bugs in generated APIs. Dark-web (OSINT secondary): leak sites still publishing daily; stealer logs remain the access commodity behind ransomware.
Coverage Self-Audit
Last 24–48h CVE/zero-day/PoC/KEV/ransomware — done. Last 7–14d supply chain (npm/PyPI/RubyGems/Maven/GitHub, Phantom Gyp, binding.gyp, Shai-Hulud/Miasma) — done; no new confirmed wave. Last 7–14d AI-code/logic — done (GitSpawn class + generated IDOR/broken auth). Last 7–14d dark-web OSINT secondary — done. X Latest for CVE/zero-day since yesterday, worm terms since last_7_days, ransomware/APT since yesterday — done (Citrix confirmed; worm terms were noise). Core catalogs (KEV/NVD/advisories/PoC) — done. Live Veracode catalog refreshed from official docs/marketplace on 2026-09-28. Newly confirmed live this run: Fix for SCA (LA) and SAST integration with DryRun; Marketplace partner named: DryRun Security.
Veracode Tool Reference with Links
Veracode Dynamic Recommendations
Malicious Packages & Supply Chain Worms
Residual worm family still harvests CI and cloud tokens. Why: ingest block beats post-hoc CVE. Action: point npm/PyPI/Maven remotes at Package Firewall; enable malware, typosquat, and High/Critical deny. Tools: Package Firewall, SCA, SSCI.
New/KEV CVEs
NetScaler, WordPress, SharePoint, Commerce, identity appliances. Why: confirmed exploitation, not score theater. Action: ingest KEV into Risk Manager; SLA exposed assets first. Tool: Risk Manager.
Web/Runtime
WordPress/Commerce storefronts and APIs. Why: LFI/RCE and authz bypass are runtime-visible. Action: schedule DAST on internet apps; use ISM for internal ones. Tools: DAST, ISM.
Custom Code
Generated and first-party authz still ships IDOR. Action: Pipeline Scan + policy fail on high authz CWEs. Tools: SAST, Pipeline Scan, IDE Scan, Fix.
AI-Assisted / Business-Logic Code
Agents and vibe-coded APIs miss role checks; Git-config execution is outside SAST. Action: enable DryRun on GitHub/GitLab PRs for Cursor/Claude Code/Codex repos; keep SAST authoritative. Tool: DryRun (+ SAST).
EASM
NetScaler, WordPress, SharePoint, Magento, VPN/APM. Action: refresh discovery; tag KEV products. Tool: EASM.
Containers
Worms and implants land in build images. Action: CLI/image scan on build. Tool: Container Security.
Governance
Due-today KEV and malware-at-ingest need policy, not slides. Action: Policy Management fail-closed on KEV + malicious package. Tool: Policy Management.
Prioritized Action Plan
This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.