Security daily

Synthesized by Clarity (Claude) from 16 sources · May contain errors — spot one? [email protected] · Methodology →

Cisco SD-WAN Manager 0-Day Exploited, No Patch Available

Sources
16
Words
1,168
Read
6min

Topics Agentic AI AI Capital AI Regulation

◆ The signal

No patch is available. Separately, a self-replicating supply-chain worm tracked as Miasma has compromised 73 Microsoft-owned GitHub repositories and more than 50 npm packages, dropping a Rust-based info stealer. A Hugging Face Transformers RCE triggered through model config files sits on top of 2.2 billion installs.

◆ INTELLIGENCE MAP

Intelligence map

  1. 01

    Active Exploitation with No Patches: Cisco + Miasma Worm

    act now

    Cisco CVE-2026-20245 (CVSS 7.8) is actively exploited in SD-WAN Manager with zero patch available. Miasma worm self-replicated across 73 Microsoft GitHub repos and 50+ npm packages carrying a Rust info stealer. SolarWinds Serv-U added to CISA KEV. Defenders are in pure compensating-controls mode.

    73
    Microsoft repos compromised
    1
    source
    • Cisco CVSS
    • MS GitHub repos hit
    • npm packages poisoned
    • Patch available
    1. 01Miasma Worm (GitHub/npm)Critical - Self-replicating
    2. 02Cisco SD-WAN CVE-2026-20245CVSS 7.8 - No Patch
    3. 03FFmpeg Zero-Days21 CVEs - Patch staging
    4. 04SolarWinds Serv-UKEV - Patch available
  2. 02

    AI Development Stack Now Under Direct Attack

    act now

    Three distinct AI attack vectors confirmed this cycle: HuggingFace Transformers RCE via model config (2.2B installs), Meta AI chatbot socially engineered to hijack Instagram accounts via credential reset, and Claude Code MCP flaws exposing developer workstations. Detection maturity across all three is rated low to very low.

    2.2B
    HuggingFace installs at risk
    5
    sources
    • HF installs exposed
    • MCP detection maturity
    • Meta vector
    • MS attack categories
    1. HuggingFace RCE2200M installs
    2. Meta AI Chatbot100% exploited ITW
    3. Claude Code MCP0% patched
  3. 03

    AI Discovery Outpaces Patch Velocity — Gap Is Structural

    monitor

    An AI agent found 21 FFmpeg zero-days in a single research cycle. Anthropic's Glasswing expanded to 150 critical-infrastructure companies. NIST NVD backlog officially called a strategic-planning failure by Commerce IG. Weaponized AI tooling is now a commodity SKU on ransomware forums. The assumption that patches exist when vulns are disclosed is degrading.

    21
    FFmpeg zero-days in one cycle
    3
    sources
    • FFmpeg zero-days found
    • Glasswing companies
    • NVD status
    • AI offense tooling
    1. Manual Discovery Era3 vulns/cycle
    2. AI Discovery Era21 vulns/cycle+600%
  4. 04

    GitHub Agent Economy: 17M PRs Create Financial & Supply Chain Risk

    monitor

    GitHub processed 17M agent-generated PRs in March 2026. Copilot switched to usage-based billing June 1, making stolen tokens a financial DoS vector. Chronicle persists agent sessions in the cloud with no DLP coverage. GitHub API layer is evolving to be 'agent-centric' with new NHI scopes most IAM teams haven't catalogued.

    17M
    agent PRs per month
    2
    sources
    • Agent PRs/month
    • Billing switch
    • New data sink
    • API evolution
    1. Agent PRs (Mar 2026)17M
    2. Human PRs (est.)4M
  5. 05

    AI Vendor Risk Events Cluster: Lockdown Mode, Cross-Tenant Leak, IBM Cover-up

    background

    OpenAI shipped Lockdown Mode (prompt-injection mitigation via capability amputation). A suspected Anthropic cross-tenant output exposure is unconfirmed but fits the pattern. IBM whistleblower alleges concealed breaches. OpenAI merging Codex into ChatGPT widens blast radius. Princeton confirms GPT 5.5 and Claude Opus 4.7 are not more reliable than predecessors.

    4
    sources
    • Lockdown Mode
    • Anthropic incident
    • IBM allegations
    • Reliability gain
    1. AI Vendor Security Maturity30

◆ DEEP DIVES

Deep dives

  1. 01

    Incident Sprint: Cisco Zero-Day + Self-Replicating Supply Chain Worm — Two Concurrent Crises

    act now

    Situation

    Two incidents landed the same week and require parallel response. Cisco CVE-2026-20245 (CVSS 7.8) is under active exploitation in Catalyst SD-WAN Manager, with no vendor patch available. Separately, the Miasma worm — self-replicating, supply-chain — has propagated across 73 GitHub repositories inside four Microsoft-owned organizations. A parallel variant tracked as IronWorm has poisoned 50+ legitimate npm packages with a Rust-based information stealer.

    This is not a patch cycle. It is compensating controls and forensic triage, in parallel.

    Why Miasma Is Different from Prior Supply-Chain Attacks

    Manual package poisoning has a linear blast radius. A worm has a compounding one. Every CI run that pulls a contaminated package becomes a new propagation node. The Rust payload harvests CI tokens, .npmrc credentials, SSH keys, and developer environment secrets. Those are precisely the credentials needed to push poisoned versions further down the dependency tree.

    Microsoft's own GitHub organizations being hit signals that even platform owners cannot assume their internal repos are isolated from registry-level contagion.

    Any organization consuming transitive dependencies from those repos has potential exposure. Self-replication means the IOC list is growing daily, not weekly.

    Cisco SD-WAN: Management Plane Exposure

    CVE-2026-20245 targets the management plane of Catalyst SD-WAN Manager — the centralized controller that pushes configuration to every branch router. Successful exploitation produces WAN-wide blast radius. With no patch available, the available options are architectural:

    • Restrict admin and API interfaces to jump-host-only access via ACL.
    • Enable enhanced audit logging and deploy hunt queries for anomalous session creation.
    • Monitor configuration-push events originating from unauthorized sessions.

    SolarWinds Serv-U (DoS, now on CISA KEV) adds a third item to the immediate queue. That one does have a fix available.

    Cross-Incident Pattern

    The thread connecting these events is straightforward: management and build infrastructure is the target. SD-WAN Manager controls the network. GitHub repos and npm packages control the software supply chain. Neither is a traditional endpoint. Both carry disproportionate blast radius when compromised. Detection engineering has historically under-invested in both planes, and the adversaries have noticed.

    Action items

    • Restrict Cisco Catalyst SD-WAN Manager admin interfaces to jump-host-only ACL access and enable full audit logging immediately
    • Run emergency npm/GitHub dependency audit: identify any packages installed or updated in the last 14 days matching Miasma/IronWorm IOC lists
    • Rotate all CI tokens, npm publish tokens, GitHub PATs, and cloud credentials touched by any build job that consumed suspect packages
    • Patch SolarWinds Serv-U instances and document against BOD 22-01 timelines
    • Inventory FFmpeg usage across services, containers, client apps, and browser-side WASM builds this sprint

    Sources:Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs

  2. 02

    AI Infrastructure Is the New Perimeter: Three Attack Vectors, One Quarter to Harden

    act now

    The Pattern

    Five independent intelligence sources this cycle converge on the same conclusion: the AI stack your engineering teams assembled over the last 18 months is now a Tier-1 attack surface. Three distinct attack vectors crystallized simultaneously:

    VectorMechanismBlast RadiusDetection Maturity
    HuggingFace Transformers RCEMalicious model config triggers code execution on load2.2B installs — GPU inference, notebooks, CILow — most ML hosts lack EDR
    Meta AI Chatbot HijackLLM socially engineered to mutate account identity stateHigh-profile Instagram accounts; pattern generalizes to any LLM with tool accessVery Low — no logging of AI-mediated identity actions
    Claude Code MCPTrusted dev tool with over-privileged MCP serversSource code, secrets, local filesystem, cloud credsVery Low — MCP traffic rarely logged

    The HuggingFace RCE

    The trigger path is the model configuration file — something most pipelines treat as inert metadata. Exploitation lands silently on GPU-accelerated inference hosts, which are historically the worst-instrumented machines in the enterprise. No EDR, no egress inspection, high-privilege for compute scheduling. The 2.2 billion install count is the ceiling, but the floor is still enormous for any organization running ML workloads.

    The Meta Chatbot Pattern

    Attackers convinced Meta's AI chatbot to change the email address on high-profile Instagram accounts, bypassing human review and rate-limit logic. This is prompt-as-privilege-escalation — the attacker didn't breach the account; they convinced the chatbot to do it for them.

    Every LLM connected to a tool that mutates identity, money, or data is now a Tier-1 attack surface. The Meta/Instagram hijack is the proof of concept the board will hear about next.

    This pattern generalizes immediately to any organization that has wired an LLM into account recovery, helpdesk, or identity-proofing flows.

    Claude Code MCP + Microsoft's New Taxonomy

    Microsoft expanded its AI agent failure-mode taxonomy by seven new attack categories this week — meaning every agentic deployment shipped in the last 12 months was threat-modeled against an incomplete framework. Claude Code's MCP protocol gives models tools, files, and credentials. A vulnerability in the client is a vulnerability in everything the client was trusted to touch.

    OpenAI's Response: Lockdown Mode

    OpenAI shipped Lockdown Mode globally — the first vendor-shipped mitigation against prompt-injection-driven exfiltration. It works by amputating capabilities: Deep Research, Agent Mode, internet image fetch, and file downloads are all disabled. This is an honest admission that prompt injection has no clean technical fix. Enterprise/Team tenants are not explicitly covered in the rollout.

    Action items

    • Inventory all hosts running HuggingFace Transformers (GPU inference, Jupyter, MLOps runners) and pin to patched version; block loading untrusted model configs from the Hub at egress proxy
    • Audit every LLM-fronted support/IAM flow for ability to mutate identity state; require human-in-the-loop or out-of-band verification for any AI-initiated account recovery action
    • Allowlist and sign MCP servers in Claude Code installations; enforce least-privilege scopes and log all MCP traffic
    • Re-threat-model production AI agents against Microsoft's expanded seven-category failure-mode taxonomy and document compensating controls
    • Pilot OpenAI Lockdown Mode for executive assistants, legal, M&A, and IR users; document capability trade-offs in AI acceptable-use policy

    Sources:Two disclosures, one surface · The claim: Meta's AI chatbot has been characterized as an account-takeover vector · Three items on the desk this week · Two items this week, weighted differently · Two surfaces worth naming

  3. 03

    AI Finds 21 Zero-Days in One Cycle, NVD Can't Keep Up — Patch SLAs Are Structurally Broken

    monitor

    Three Trends Converging

    The assumption that a patch exists when a vulnerability is disclosed is breaking on three fronts at once:

    1. AI discovery velocity: One vendor's AI agent autonomously surfaced 21 zero-days in FFmpeg in a single research cycle. Anthropic's Project Glasswing just widened to 150 critical-infrastructure companies, alongside OpenAI's tooling and the next frontier-model wave informally called 'son of Mythos.'
    2. NVD metadata collapse: The Commerce IG labeled NIST's NVD backlog a "strategic-planning failure." Scanners that depend on NVD for CVSS, CPE matching, or CWE classification will produce silent coverage gaps on recent CVEs. That is the operating reality, not a forecast.
    3. Weaponized AI goes commodity: Offensive AI tooling now ships as a productized SKU on ransomware marketplaces, with vendor-style support models. The skill floor for attacks has dropped.
    Patch SLAs are no longer the right defensive metric. AI-driven discovery has structurally outpaced vendor remediation, and security architecture needs to assume the patch may never arrive on time.

    The FFmpeg Case Study

    FFmpeg sits in nearly every enterprise video path: Slack, Teams, browser-side WASM, ML preprocessing, CDN tooling. Most security teams cannot enumerate where FFmpeg runs in their estate. Twenty-one simultaneous zero-days means the exposed surface is large and the patch playbook does not yet exist. This is the preview for what AI-scale discovery does to every ubiquitous OSS library.

    Compensating Intelligence Sources

    With NVD degrading, diversify now:

    FeedStrengthLimitation
    CISA KEVExploitation-confirmed prioritizationConservative; limited scope
    EPSSProbabilistic exploitation scoringRequires own enrichment pipeline
    GitHub Security AdvisoriesOften beats NVD on OSSScope limited to GitHub-hosted code
    Vendor PSIRTsAuthoritative for named productsInconsistent formats, no aggregation

    The Operational Shift

    The Cisco zero-day with no patch, the 21 FFmpeg zero-days with patches staging, and the Glasswing expansion all point at the same conclusion: virtual patching must become the primary control, not the compensating one. WAF, RASP, IPS, and runtime exploit prevention need coverage on every internet-facing asset and tier-1 vendor application.

    The Bright Data disclosure — consumer iOS apps and smart TVs silently repurposed as web-scraping exit nodes — adds a second axis. Residential-IP reputation as a trust signal is degrading. Credential stuffing and exploitation traffic increasingly originate from consumer ASNs that walk past datacenter-IP blocklists.

    Action items

    • Audit virtual-patching coverage (WAF, RASP, IPS) across internet-facing assets and tier-1 vendor software this quarter; identify gaps where no compensating control exists if a zero-day drops
    • Diversify vulnerability intelligence beyond NVD: ingest CISA KEV, EPSS, GitHub Security Advisories, and vendor PSIRTs directly into VM pipeline; flag CVEs with stale or missing NVD enrichment
    • Run a tabletop exercise: 'Critical RCE in tier-1 vendor, no patch for 30 days, PoC public in 48 hours' — pre-bake isolation, customer comms, and regulator decisions
    • Update WAF/bot-defense logic to deprioritize residential-IP reputation as sole trust signal; hunt for credential-stuffing from consumer ASNs matching Bright Data exit-node patterns

    Sources:Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs · Two disclosures, one surface · AI vulnerability discovery is outpacing vendor patches

◆ QUICK HITS

Quick hits

  • Update: Anthropic Mythos now confirmed operational inside NSA with ~6 embedded engineers; same model family powering Claude enterprise integrations is now powering nation-state offense under Project Glasswing

    Three items on the desk this week

  • IBM whistleblower alleges multiple undisclosed data breaches — if IBM is in your supply chain, request written attestation on breach-notification obligations now; cover-up claim directly implicates SOC 2, GDPR Art. 33, and SEC Item 1.05

    Three items on the desk this week

  • Cloudflare reports bots now outnumber humans on the open web — combined with Bright Data SDK turning iOS apps and smart TVs into exit nodes, residential-IP trust signals are structurally degrading

    The claim: Meta's AI chatbot has been characterized as an account-takeover vector

  • GitHub Copilot switched to usage-based billing June 1 — a stolen developer token looped against agent endpoints is now a financial denial-of-service with a real invoice; reclassify PATs as financially sensitive credentials

    GitHub is now seeing seventeen million agent-authored pull requests per month

  • Claude Code ships bypassPermissions and dontAsk modes that disable all interactive approval for shell commands — a developer with these enabled on a prod-credentialed machine is running an unmonitored insider with shell access

    Two surfaces worth naming

  • OpenAI merging Codex into ChatGPT collapses two threat models into one — DLP/CASB rules scoped to Codex-specific endpoints will go blind; generalize to all chat.openai.com traffic before the consolidation lands

    Two shifts this week

  • Princeton ICML 2026 study finds GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are not measurably more reliable than predecessors — any AI use-case approval based on 'we'll use the latest model' is treating marketing as a control

    Two items this week, weighted differently

  • White House AI policy advisor Sriram Krishnan exits end of June 2026, creating 60-90 day regulatory ambiguity window — flag any AI compliance roadmap milestones dependent on near-term federal guidance

    Two shifts this week

◆ Bottom line

The take.

This week stacks an actively exploited Cisco SD-WAN zero-day with no patch, a self-replicating worm inside Microsoft's own GitHub repos poisoning 50+ npm packages, a HuggingFace Transformers RCE across 2.2 billion installs, and an AI agent that found 21 FFmpeg zero-days in a single cycle — all while NIST's NVD backlog was officially declared a strategic failure. The AI stack is simultaneously the weapon, the target, and the unmonitored surface in between.

— Promit, reading as Security ·

Frequently asked

What compensating controls should we apply to Cisco Catalyst SD-WAN Manager while no patch exists for CVE-2026-20245?
Restrict admin and API interfaces to jump-host-only access via ACL, enable enhanced audit logging, and deploy hunt queries for anomalous session creation and unauthorized configuration-push events. Because the flaw sits in the management plane that pushes config to every branch router, successful exploitation has WAN-wide blast radius, so architectural isolation is the only defense until Cisco ships a fix.
Why is the Miasma worm treated differently from previous npm or GitHub supply-chain compromises?
Miasma is self-replicating, which turns a linear blast radius into a compounding one. Every CI run that pulls a contaminated package becomes a new propagation node, and the Rust info-stealer payload specifically harvests CI tokens, .npmrc credentials, SSH keys, and developer secrets — exactly what's needed to push poisoned versions further down the dependency tree. IOCs grow daily, so scoping and credential rotation cannot wait for a weekly cadence.
How does the Hugging Face Transformers RCE actually get triggered, and why is it especially dangerous?
Execution is triggered when a malicious model configuration file is loaded — something most pipelines treat as inert metadata. It lands on GPU inference hosts, Jupyter notebooks, and MLOps runners, which are historically the worst-instrumented machines in the enterprise: no EDR, minimal egress inspection, and high privileges for compute scheduling. The 2.2 billion install base sets the ceiling on exposure.
What immediate credential hygiene steps are required if our builds may have consumed a Miasma-tainted package?
Rotate every CI token, npm publish token, GitHub PAT, and cloud credential touched by any build job that consumed a suspect package within the last 14 days. The Rust payload targets those secrets to propagate the worm, so failing to rotate leaves the attacker with the keys needed to publish further poisoned versions under your identity.
Should we still treat patch SLAs as our primary vulnerability metric given AI-driven discovery velocity?
No — AI discovery has structurally outpaced vendor remediation, as shown by 21 FFmpeg zero-days surfaced in one cycle and the unpatched Cisco SD-WAN flaw. Virtual patching via WAF, RASP, and IPS should become the primary control on internet-facing and tier-1 vendor assets, with patch SLA treated as a downstream cleanup metric rather than the defensive front line.

◆ Same day, different angle

Read this day as…

  1. 37 shared

    Cisco Catalyst SD-WAN Manager CVE-2026-20245 is under active exploitation with no patch

    This week stacks an unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos p…

  2. 36 shared

    Two items, neither of them a patch problem.

    This week stacks an actively exploited Cisco SD-WAN zero-day with no patch, a self-replicating worm inside Microsoft's own GitHub organizati…

  3. 35 shared

    CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, CVSS 7.8, is being exploited in the wild.

    An unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos and 50+ npm packag…

◆ Recent in security

Keep reading.

Spot an error? [email protected]