Security daily

Synthesized by Clarity (Claude) from 16 sources · May contain errors — spot one? [email protected] · Methodology →

CVE-2026-20245 Hits Cisco SD-WAN Manager, No Patch Yet

Sources
16
Words
1,563
Read
8min

Topics AI Regulation Agentic AI AI Capital

◆ The signal

No vendor patch. Mitigation is jump-host ACLs and hunting anomalous admin sessions. Separately, the Miasma worm has trojanized 73 Microsoft-owned GitHub repositories and over 50 npm packages with a Rust infostealer. Any CI run that pulled fresh dependencies in the last 14 days is in scope.

◆ INTELLIGENCE MAP

Intelligence map

  1. 01

    Active Exploitation, No Patch: Cisco SD-WAN + Supply-Chain Worm

    act now

    CVE-2026-20245 in Cisco Catalyst SD-WAN Manager is actively exploited with zero-patch status — pure compensating-controls posture required. Simultaneously, Miasma worm hit 73 Microsoft GitHub repos across 4 orgs while IronWorm poisoned 50+ npm packages. SolarWinds Serv-U added to CISA KEV.

    73
    Microsoft repos compromised
    1
    source
    • Cisco CVSS
    • MS GitHub repos hit
    • npm packages poisoned
    • Patch available
    1. MS GitHub repos73 repos
    2. npm packages50+
    3. Cisco patch ETA0 days
  2. 02

    AI Development Pipeline as Tier-1 Attack Surface

    act now

    HuggingFace Transformers RCE exploitable via model config files across 2.2B installs. Meta's AI chatbot was socially engineered into changing Instagram account emails — prompt-as-privilege-escalation proven in the wild. Claude Code's bypassPermissions mode gives agents unmonitored shell access on dev workstations.

    2.2B
    HuggingFace installs exposed
    4
    sources
    • HF installs at risk
    • Claude Code risky modes
    • Meta exploit status
    • ML host EDR coverage
    1. 01HF Transformers RCE2.2B installs
    2. 02Meta AI account takeoverExploited ITW
    3. 03Claude Code MCPUnpatched
    4. 04Claude bypassPermissionsUngoverned
  3. 03

    AI-Powered Discovery Structurally Outpaces Vendor Patch Capacity

    monitor

    An AI agent autonomously found 21 zero-days in FFmpeg in a single research cycle. Anthropic's Project Glasswing expanded to 150 critical-infrastructure companies. Meanwhile, NIST NVD backlog is officially called a strategic-planning failure by the Commerce IG — your scanner data is degrading as the discovery rate accelerates.

    21
    FFmpeg zero-days by AI
    3
    sources
    • FFmpeg 0-days found
    • Glasswing companies
    • NVD status
    • Mythos engineers at NSA
    1. Manual vuln discovery3/cyclebaseline
    2. AI vuln discovery21/cycle+600%
  4. 04

    LLM Platform Trust Erosion: Lockdown Mode, Cross-Tenant Leaks, IBM Cover-Up

    monitor

    OpenAI shipped Lockdown Mode — an admission prompt injection has no clean fix (it disables Deep Research, Agent Mode, and image fetch). Anthropic has a suspected cross-tenant output leak under investigation. IBM whistleblower alleges multiple undisclosed breaches. Princeton finds GPT 5.5 and Claude Opus 4.7 are NOT more reliable than predecessors.

    3
    sources
    • Lockdown Mode status
    • Anthropic leak
    • IBM cover-up
    • Reliability improvement
    1. LLM vendor security maturity30
  5. 05

    Agent-Scale Code Supply Chain: 17M PRs and Non-Human Identity Sprawl

    background

    GitHub processed 17 million agent-generated pull requests in March 2026 alone. Copilot moved to usage-based billing June 1, creating a financial DoS vector via stolen PATs. New Chronicle feature persists agent sessions in cloud without DLP coverage. Human code review assumptions are now structurally broken at this volume.

    17M
    agent PRs per month
    1
    source
    • Agent PRs (March)
    • Billing model
    • New data sink
    • Review capacity gap
    1. Agent PRs/month17M
    2. Human review capacity2M (est)

◆ DEEP DIVES

Deep dives

  1. 01

    Cisco SD-WAN Zero-Day + Miasma Worm: Run This as an Incident Sprint

    act now

    Two concurrent critical events, one response posture

    CVE-2026-20245 in Cisco Catalyst SD-WAN Manager is being actively exploited right now with a CVSS 7.8 score and no vendor patch available. This is an internet-adjacent management plane vulnerability — successful exploitation gives an attacker WAN-wide blast radius across every branch connected to the compromised manager. Defenders are in pure compensating-controls mode.

    In parallel, the Miasma worm represents a qualitative shift in supply-chain attacks. This is not manual package poisoning — it's self-replicating. Every CI run that pulls a contaminated package becomes a new propagation node. The worm compromised 73 GitHub repositories across four of Microsoft's own organizations. A parallel variant (IronWorm) poisoned 50+ legitimate npm packages with a Rust-based information stealer designed to harvest CI tokens, .npmrc credentials, SSH keys, and developer environment secrets.

    Self-replicating worm logic has arrived in package ecosystems. This is not linear blast radius — it compounds.

    Why the worm pattern is different

    Manual supply-chain poisoning requires an attacker to compromise packages one at a time. A worm has a compounding propagation model — the credentials harvested from one compromised CI run are used to push poisoned versions to the next tier of dependencies. Microsoft's own repos being hit signals that even platform owners can't isolate from registry-level contagion.

    Concurrent action plan

    IncidentSeverityPatch StatusYour First Action
    Cisco CVE-2026-20245CVSS 7.8, exploited ITWNone availableACL to jump-host only; hunt for anomalous admin sessions
    Miasma (GitHub)Critical, self-replicatingCleanup in progressDiff SBOM against IOC lists for 73 affected repos
    IronWorm (npm)Critical, 50+ packagesPer-package removalAudit any npm install/update in last 14 days; rotate all tokens
    SolarWinds Serv-UHigh, KEV-listedPatch availablePatch immediately; BOD 22-01 timelines apply

    Why this week is different from a normal patch cycle

    The Cisco zero-day has no remediation path except network segmentation. The Miasma worm propagates faster than cleanup. Treating these as normal patch items guarantees you're behind. The correct posture is incident response with compensating controls, not vulnerability management with an SLA.

    Action items

    • Restrict Cisco Catalyst SD-WAN Manager admin/API interfaces to jump-host-only access via ACL and enable full audit logging today
    • Run emergency npm/GitHub dependency audit against published Miasma/IronWorm IOC lists for any package installed or updated in the last 14 days
    • Rotate all npm publish tokens, GitHub PATs, CI runner cloud credentials, and SSH keys touched by suspect builds
    • Patch SolarWinds Serv-U instances and restrict ingress to known partner ranges per CISA KEV BOD 22-01 timelines

    Sources:Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs

  2. 02

    AI Development Pipeline Is Now a Tier-1 Attack Surface — Three Proof Points This Week

    act now

    The convergence

    Three independent attack vectors landed this week. All three target the same thing: the AI/ML stack engineering teams shipped to production without a security review. Each abuses a different trust assumption. Together they describe a campaign pattern, not a coincidence.

    1. HuggingFace Transformers RCE via model config

    The vector is a remote code execution flaw in HuggingFace Transformers, triggered by crafted model configuration files. The trust assumption being exploited: that downloading a model is a passive act. The package reports 2.2 billion installs. Detonation occurs on GPU inference hosts, notebooks, and CI runners — historically the worst-instrumented boxes in the enterprise. Most ML hosts run without EDR, without egress inspection, and outside normal patch compliance.

    2. Meta AI chatbot performs account takeover

    Attackers socially engineered Meta's AI chatbot into changing the recovery email on high-profile Instagram accounts. The model treated an account-recovery request as a support conversation. No identity proofing. No human review. No rate limiting. This is prompt-as-privilege-escalation, demonstrated against a named platform, in the wild. The pattern generalizes to any LLM wired to a tool that mutates state.

    3. Claude Code's bypassPermissions grants unmonitored shell access

    Claude Code ships with seven permission tiers. Two of them, bypassPermissions and dontAsk, suppress interactive approval for tool calls and shell commands. Enable either on a workstation with cloud SSO or signing keys present and you have delegated execution authority to a model whose input channel includes every file in the repo. Indirect prompt injection through a README or issue body becomes a shell access vector.

    Every LLM connected to a tool that mutates identity, money, or data is now a Tier-1 attack surface. The Meta/Instagram hijack is the proof of concept the board will hear about next.

    The unified defensive pattern

    The three incidents share one root cause: trust boundaries that were implicit are now exploitable. The model config was not supposed to be executable. The chatbot was not supposed to reset passwords. The coding agent was not supposed to require governance. Each violates a developer mental-model assumption.

    SurfaceTrust Assumption ViolatedControl RequiredDetection Maturity
    HF model configs"Config files are inert metadata"Egress proxy blocking untrusted model loads; FIM on model dirsLow
    LLM-fronted IAM"The bot can't do things humans can't"Human-in-the-loop on all recovery actionsVery low — MCP traffic rarely logged
    Claude Code permissions"Developer tools don't need governance"MDM/EDR detection of dangerous config flagsLow — most shops unaware of the modes

    OpenAI's response, Lockdown Mode, is instructive. It works by amputating capabilities — disabling Deep Research, Agent Mode, image fetch — rather than hardening them. Read that as an admission that prompt injection has no clean technical fix. Do not retire compensating controls on the strength of this feature shipping.

    Action items

    • Inventory all HuggingFace Transformers installs across GPU inference, notebooks, and CI this week — pin to patched version and block untrusted model config loads at egress proxy
    • Audit every LLM-fronted support, helpdesk, and IAM flow for ability to mutate identity state — require human-in-the-loop or out-of-band verification for account recovery
    • Publish an AI coding-agent permissions policy banning bypassPermissions and dontAsk modes on any workstation with production credentials; enforce via MDM/EDR config detection
    • Add prompt injection, jailbreak, and AI-mediated privilege escalation to quarterly red-team scope for any product surface using LLMs

    Sources:Two disclosures, one surface. The HuggingFace remote code execution affects a library footprint reported at 2.2 billion installs. · The claim: Meta's AI chatbot has been characterized as an account-takeover vector. · Two surfaces worth naming. Claude Code's bypassPermissions mode and Google's TPU 8i. · Three items on the desk this week. The NSA and Anthropic arrangement some are calling Mythos.

  3. 03

    AI Discovery vs. Vendor Patch Capacity: The Gap Is Now a Market Structure

    monitor

    The structural shift

    The pattern this cycle is consistent: AI-powered vulnerability discovery has outpaced vendor patch development capacity, and the gap is widening. This is not a backlog. It is a new equilibrium, and patch-SLA thinking no longer functions as a primary defensive metric.

    The evidence

    1. 21 FFmpeg zero-days from a single AI agent in one research cycle. FFmpeg sits inside Slack, browser WASM builds, container base images, and ML preprocessing pipelines. One agent run previews what AI-assisted fuzzing produces once it scales across the OSS dependency graph.
    2. Anthropic's Project Glasswing expanded to 150 critical-infrastructure companies. The same model family (Mythos) is deployed at NSA with roughly 6 embedded Anthropic engineers on offensive operations. Discovery has scaled. Remediation has not.
    3. NIST NVD backlog formally indicted by the Commerce Inspector General as a "strategic-planning failure." The canonical vulnerability data underpinning most scanners is running behind the disclosure curve. CVSS, CPE matching, and CWE classification are stale for recent CVEs.
    Patch SLAs are no longer the right defensive metric. AI-driven discovery has structurally outpaced vendor remediation, and security architecture should assume the patch may never arrive on time.

    The compounding problem

    On the offensive side, offensive AI tooling is being listed as a commodity SKU on ransomware forums that run vendor-style support tiers. The exploitation skill floor keeps dropping as discoverable vulnerability volume rises, which means AI-augmented offense is compounding faster than AI-augmented defense.

    NVD degradation produces silent coverage gaps in vulnerability scanners. Most teams will find these in a post-incident review, not on a dashboard. Compensating feeds: CISA KEV for exploitation-driven prioritization, EPSS for probabilistic scoring, GitHub Security Advisories for OSS.

    Defensive posture shift required

    The primary control shifts from patching to virtual patching. WAF, RASP, IPS, and runtime exploit prevention move to the first line, not the compensating control. The tabletop to run in advance: "Critical RCE in tier-1 vendor, no patch for 30 days, PoC public in 48 hours." Teams that work it through ahead of the page decide isolation, customer comms, and regulator notification at hour zero rather than hour three.

    Action items

    • Inventory FFmpeg usage across all services, container images, client apps, and WASM builds this sprint — pre-stage patch playbooks for the 21 disclosed zero-days
    • Audit virtual-patching coverage (WAF, RASP, IPS) across internet-facing assets and tier-1 vendor software — identify gaps where zero compensating control exists if a zero-day drops
    • Diversify vulnerability intelligence beyond NVD: ingest CISA KEV, EPSS, and GitHub Security Advisories directly into your VM pipeline; flag CVEs with stale NVD enrichment
    • Run a tabletop exercise: 'Critical RCE in tier-1 vendor, no patch for 30 days, PoC public in 48 hours' — pre-bake isolation and notification decisions

    Sources:Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs · Two disclosures, one surface. The HuggingFace remote code execution affects a library footprint reported at 2.2 billion installs. · AI vulnerability discovery is outpacing vendor patches — your exposure window just widened

  4. 04

    LLM Vendor Trust Model Under Stress: Lockdown Mode, Cross-Tenant Leaks, and the IBM Cover-Up Allegation

    monitor

    Three vendor-risk events in one cycle

    The LLM platform trust model is immature relative to what enterprises are running through it, and this week's vendor-risk register reflects that across three concurrent items worth logging.

    OpenAI Lockdown Mode: the honest admission

    OpenAI shipped Lockdown Mode globally, the first vendor-shipped, user-toggleable mitigation against prompt-injection-driven data exfiltration. It works by disabling Deep Research, Agent Mode, internet image fetch, and file downloads. That is amputation, not a fix. The shipping decision confirms OpenAI treats prompt-injection exfiltration as a live, exploitable attack chain serious enough to sacrifice flagship features. Enterprise and Team tenants are not explicitly covered in the rollout, so DLP and tenant policy remain load-bearing.

    Anthropic: suspected cross-tenant output exposure

    An unconfirmed report describes a cross-tenant output leak during an Anthropic scaling event. If accurate, this is a multi-tenant isolation failure in which prompts, RAG context, and tool outputs from one customer were visible to another. No CVE, no advisory, no named victim. Treat as unverified but log it in the vendor-incident file. Request a written RCA and affected-tenant determination from Anthropic. Pre-position legal counsel on GDPR Art. 33 timers before confirmation arrives.

    IBM whistleblower: breach concealment alleged

    A former IBM cyber executive alleges the company covered up multiple data breaches without customer notification. Specifics are not public. If IBM processes data in any capacity — Cloud, Watson, Red Hat OpenShift, Maximo, mainframe, consulting — the allegation directly implicates breach-notification clauses, GDPR processor duties, SOC 2 controls, and SEC Item 1.05 disclosure obligations.

    AI vendor security maturity is well below what enterprise pricing implies. Assume prompt injection is exploited and that multi-tenant isolation can fail, and treat reliability claims as unverified until independently measured.

    Princeton's reliability finding

    Princeton's ICML 2026 study confirms that GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are not meaningfully more reliable than their predecessors. Any AI governance policy that approved use cases on the basis of "we'll use the latest model" is treating marketing as a control. Reliability has to be enforced outside the model, with deterministic validators, human gates on irreversible actions, and idempotency where retries can occur.

    Action items

    • Mandate ChatGPT Lockdown Mode for high-sensitivity users (execs, legal, M&A, IR) this week and update acceptable-use policy to document capability trade-offs
    • Open vendor incident review with Anthropic: request RCA, scope, and affected-tenant list for the suspected cross-tenant exposure; preserve all Claude API call logs from the suspected window
    • Initiate IBM vendor risk re-attestation: pull contracts, identify breach-notification clauses, request written statement on whistleblower allegations, inventory data IBM processes
    • Add 'reliability ceiling' clause to AI use-case approvals: any workflow making irreversible decisions requires deterministic validation outside the LLM, citing Princeton ICML 2026 findings

    Sources:Three items on the desk this week. The NSA and Anthropic arrangement some are calling Mythos. · Two items this week, weighted differently. Publicly: OpenAI shipped ChatGPT Lockdown Mode. · Two shifts this week. Neither is a breach. Both change the threat surface a SOC has to defend.

◆ QUICK HITS

Quick hits

  • Update: Anthropic Project Glasswing expanded to 150 critical-infrastructure companies with ~6 engineers embedded at NSA deploying Mythos for offensive cyber — expect nation-state phishing fluency uplift within 12-24 months

    AI vulnerability discovery is outpacing vendor patches — your exposure window just widened

  • GitHub processed 17 million agent-generated PRs in March 2026; Copilot moved to usage-based billing June 1 — stolen PATs now create financial DoS with real invoices attached

    GitHub is now seeing seventeen million agent-authored pull requests per month.

  • Cloudflare reports bots now outnumber humans on the open web — residential-IP reputation as a sole trust signal is broken; reweight bot defense toward behavioral fingerprints

    The claim: Meta's AI chatbot has been characterized as an account-takeover vector.

  • OpenAI merging Codex into ChatGPT — DLP/CASB rules scoped to coding-tool endpoints will go blind as developer code flows through general chat surface

    Two shifts this week. Neither is a breach. Both change the threat surface a SOC has to defend.

  • Bright Data iOS SDK turns consumer apps and smart TVs into scraping exit nodes — credential stuffing increasingly originates from consumer ASNs that bypass datacenter blocklists

    Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs

  • Chrome shipped fix for 429 bugs — confirm >95% of managed endpoints have auto-updated; bulk releases of this size routinely contain silently-fixed in-the-wild exploits

    Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs

  • Five U.S. regional banks (Huntington, First Horizon, M&T, KeyCorp, Old National) now moving deposits on ZKsync-based Cari Network — smart-contract risk inside the regulated banking perimeter

    The a16z crypto PMF playbook landed this week.

◆ Bottom line

The take.

An unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos and 50+ npm packages, and a HuggingFace RCE across 2.2 billion installs all landed in the same cycle — while AI-powered vulnerability discovery (21 FFmpeg zero-days from one agent) and the NIST NVD backlog confirm that patch-SLA thinking is no longer your primary defense. Treat the AI development pipeline as a Tier-1 attack surface starting today, and shift primary controls from patching to virtual patching and compensating controls.

— Promit, reading as Security ·

Frequently asked

What compensating controls should we apply for CVE-2026-20245 since no Cisco patch exists?
Restrict the Catalyst SD-WAN Manager admin and API interfaces to jump-host-only access via ACL, enable full audit logging, and actively hunt for anomalous administrator sessions. Because the vulnerability is being exploited in the wild with no vendor fix, network segmentation and session anomaly detection are the only viable defenses until a patch ships.
How do we scope exposure to the Miasma worm and its IronWorm npm variant?
Audit every CI run that pulled fresh GitHub or npm dependencies in the last 14 days against published Miasma and IronWorm IOC lists, covering the 73 affected Microsoft-owned repos and 50+ trojanized npm packages. Then rotate all npm publish tokens, GitHub PATs, CI runner cloud credentials, and SSH keys touched by suspect builds, since the Rust infostealer specifically targets those credentials to propagate.
Why is a self-replicating package worm different from previous supply-chain attacks?
Manual package poisoning scales linearly because attackers compromise packages one at a time, but a worm compounds — credentials harvested from one poisoned CI run are used to push malicious versions into the next tier of dependencies. Microsoft's own organizations being hit demonstrates that even platform owners cannot isolate from registry-level contagion, so cleanup speed matters more than usual.
Should patch SLAs still be our primary vulnerability management metric?
No — AI-assisted vulnerability discovery (e.g., 21 FFmpeg zero-days from a single agent run) has structurally outpaced vendor patch capacity, and the NVD backlog compounds the gap. Shift primary reliance to virtual patching via WAF, RASP, and IPS, and diversify vulnerability intelligence with CISA KEV, EPSS, and GitHub Security Advisories rather than trusting NVD enrichment alone.
Is OpenAI's Lockdown Mode sufficient to retire other prompt-injection controls?
No. Lockdown Mode works by amputating capabilities — disabling Deep Research, Agent Mode, image fetch, and file downloads — which is an implicit admission that prompt injection has no clean technical fix. Enterprise and Team tenants aren't explicitly covered in the rollout, so DLP, tenant policy, and human-in-the-loop gates on irreversible actions remain load-bearing.

◆ Same day, different angle

Read this day as…

  1. 39 shared

    Two items, neither of them a patch problem.

    This week stacks an actively exploited Cisco SD-WAN zero-day with no patch, a self-replicating worm inside Microsoft's own GitHub organizati…

  2. 36 shared

    Two concurrent active-exploitation events with no vendor patch

    This week stacks an unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos a…

  3. 35 shared

    Cisco Catalyst SD-WAN Manager CVE-2026-20245 is under active exploitation.

    This week stacks an actively exploited Cisco SD-WAN zero-day with no patch, a self-replicating worm inside Microsoft's own GitHub repos pois…

◆ Recent in security

Keep reading.

Spot an error? [email protected]