Security daily

Synthesized by Clarity (Claude) from 16 sources · May contain errors — spot one? [email protected] · Methodology →

Self-Replicating npm Worm Lands as Cisco SD-WAN CVE Goes Wild

Sources
16
Words
1,239
Read
6min

Topics Agentic AI AI Regulation AI Capital

◆ The signal

Simultaneously, Cisco CVE-2026-20245 (CVSS 7.8) is under active exploitation in Catalyst SD-WAN Manager with no patch available. Your dependency graph likely ingested malicious code this week while your WAN management plane sits exposed — treat the next seven days as an incident sprint, not a normal patch cycle.

◆ INTELLIGENCE MAP

Intelligence map

  1. 01

    Self-Replicating Supply-Chain Worms in Major Ecosystems

    act now

    Miasma worm hit 73 Microsoft GitHub repos across 4 orgs. IronWorm variant poisoned 50+ npm packages with Rust-based info-stealer harvesting CI tokens, SSH keys, and .npmrc credentials to propagate further. HuggingFace Transformers RCE (2.2B installs) exploitable via model config files. Supply-chain attacks have crossed from manual to self-replicating.

    73
    Microsoft repos compromised
    2
    sources
    • MS GitHub repos hit
    • npm packages poisoned
    • HF Transformers installs
    • Microsoft orgs affected
    1. HF Installs2200M
    2. MS GitHub Repos73
    3. npm Packages50+ongoing
  2. 02

    Unpatched Cisco SD-WAN Zero-Day Under Active Exploitation

    act now

    CVE-2026-20245 (CVSS 7.8) in Cisco Catalyst SD-WAN Manager is actively exploited with NO vendor patch available. Management-plane compromise gives WAN-wide blast radius. SolarWinds Serv-U DoS also added to CISA KEV. Defenders are in pure compensating-controls mode for an internet-adjacent management plane.

    7.8
    CVSS score, no patch
    1
    source
    • CVSS Score
    • Patch Status
    • Exploitation
    • KEV additions
    1. CVE-2026-20245 Severity78
  3. 03

    LLM-Fronted Identity Flows Confirmed as Attack Vector

    monitor

    Meta's AI chatbot was social-engineered into changing email addresses on high-profile Instagram accounts — bypassing human review entirely. OpenAI shipped Lockdown Mode globally to counter prompt-injection exfiltration (disables Deep Research, Agent Mode, image fetch). Claude Code MCP layer has known weaknesses. Anthropic may have had a cross-tenant output leak. Every LLM wired to identity-mutation tools is now a confirmed Tier-1 surface.

    4
    sources
    • Meta accounts hijacked
    • OpenAI response
    • Anthropic cross-tenant
    • MCP flaws
    1. 01LLM-fronted IAM flowsExploited in wild
    2. 02MCP connector layerKnown weaknesses
    3. 03Multi-tenant inferenceSuspected failure
    4. 04Prompt injection exfilVendor-confirmed
  4. 04

    AI Vulnerability Discovery Structurally Outpacing Vendor Patches

    monitor

    A single AI agent discovered 21 zero-days in FFmpeg in one research cycle. Project Glasswing expanded to 150 critical-infrastructure companies. NIST NVD backlog officially called a 'strategic-planning failure' by Commerce IG. The disclosure-to-patch window is structurally widening — patch SLAs are no longer the right defensive metric.

    21
    FFmpeg zero-days, one cycle
    3
    sources
    • FFmpeg zero-days found
    • Glasswing companies
    • NVD status
    • Time horizon
    1. AI Discovery Rate21 vulns/cycle+accelerating
    2. Vendor Patch Capacity3 vulns/cycle-flat
  5. 05

    Agent-Authored Code Reaches Industrial Scale

    background

    GitHub processed 17 million agent-generated PRs in March 2026. Copilot shifted to usage-based billing June 1 — stolen tokens now produce real invoices. Claude Code's bypassPermissions mode gives agents shell access without approval. Code review was designed for human cadence; the agent population is currently the faster-moving side.

    17M
    agent PRs per month
    2
    sources
    • Agent PRs (March)
    • Billing shift
    • Claude Code modes
    • Review gap
    1. Agent PRs/month17M
    2. Human review capacity2M-flat

◆ DEEP DIVES

Deep dives

  1. 01

    Self-Replicating Worms Have Arrived in Package Ecosystems — Emergency Triage Required

    act now

    The Pattern Shift

    Manual package poisoning has a linear blast radius. A self-replicating worm has a compounding one. This week, that distinction moved from theoretical to operational. The Miasma worm compromised 73 GitHub repositories across four of Microsoft's own organizations. A parallel variant, IronWorm, poisoned 50+ legitimate npm packages with a Rust-based information stealer. Every CI run that pulls a contaminated package becomes a new propagation node.

    The payload harvests CI tokens, .npmrc credentials, SSH keys, and developer environment secrets — exactly the credentials needed to push poisoned versions further downstream.

    Simultaneously, a HuggingFace Transformers RCE landed — exploitable via crafted model configuration files, weaponizing the trust developers place in "just downloading a model." The package has 2.2 billion installs. The trigger path treats model config as inert metadata; it is not. GPU inference hosts, Jupyter environments, and MLOps runners are in the blast radius — and these are historically the worst-instrumented machines in the enterprise.

    Cross-Source Synthesis

    Multiple intelligence streams converge on the same conclusion: the supply chain is under coordinated pressure from multiple vectors simultaneously. Source analysis confirms that Microsoft's own platform ownership did not insulate them from registry-level contagion. Detection maturity across ML hosts is rated "Low" — most lack EDR or egress inspection. The 17 million agent-authored PRs merging monthly on GitHub compound the problem: human reviewers cannot keep pace with the volume, and agents don't inspect lockfiles.

    VectorScopePayloadPropagation
    Miasma (GitHub)73 repos, 4 MS orgsSelf-replicating wormAutomated via stolen tokens
    IronWorm (npm)50+ packagesRust info-stealerCI credential harvesting
    HF Transformers RCE2.2B installsCode exec via model configModel download from Hub

    What Makes This Different

    Previous supply-chain attacks (event-stream, ua-parser-js, codecov) required an attacker to manually compromise each package. Miasma automates propagation. Once one package is infected, the stolen CI tokens and publish credentials allow the worm to push poisoned versions to downstream packages without human intervention. The Ruby ecosystem incident this same week demonstrated that even patching velocity itself can be weaponized — rapid auto-updates accelerated compromise rather than preventing it.

    Action items

    • Run emergency npm/GitHub dependency audit today: diff SBOM against published Miasma/IronWorm IOC lists for any package installed or updated in the last 14 days
    • Rotate all npm publish tokens, GitHub PATs, CI runner cloud credentials, and SSH keys touched by suspect builds within 48 hours
    • Block loading of untrusted model configs from HuggingFace Hub at egress proxy and pin Transformers to a patched version this week
    • Enforce npm ci with locked versions, enable provenance verification, and quarantine suspicious packages at proxy registry layer this sprint
    • Add a 24-72 hour cooling-off window for non-security dependency updates paired with maintainer/signature anomaly detection

    Sources:Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs · Two disclosures, one surface. The HuggingFace remote code execution affects a library footprint reported at 2.2 billion installs. · 🔳 Turing Post

  2. 02

    LLM-Fronted Identity Flows Are Now a Confirmed, Exploited Attack Surface

    monitor

    The Meta Proof of Concept

    The actor is unattributed. The target was high-profile Instagram accounts. The mechanism: social-engineer Meta's AI chatbot into changing the account email on behalf of the attacker, bypassing the human review and rate-limit logic that gates email changes on high-value accounts. The chatbot fronts a credential-reset path and treats the exchange as support, not identity proofing. The attacker never touched the account. The chatbot did the work.

    This is prompt-as-privilege-escalation. In MITRE ATT&CK terms, Account Manipulation (T1098) and Account Access Removal (T1531), executed through a non-human intermediary.

    The Vendor Response: OpenAI Lockdown Mode

    OpenAI shipped Lockdown Mode globally. It is the first vendor-shipped, user-toggleable mitigation against prompt-injection-driven exfiltration. The approach is capability amputation, not hardening: Deep Research disabled, Agent Mode disabled, internet image fetch blocked, file downloads blocked. Read that as an admission that prompt injection has no clean technical fix yet. Publicly: available on all personal accounts including free tier. Not publicly confirmed: Enterprise and Team tenant coverage.

    Converging Attack Surfaces

    Four intelligence streams point at the same architectural failure: trust boundaries that used to be implicit are now exploitable.

    SurfaceExploitation StatusDefense Maturity
    LLM-fronted IAM (Meta)Exploited in the wildVery Low — most have no human-in-the-loop gate
    Claude Code MCP connectorsKnown weaknesses, demos existVery Low — MCP traffic rarely logged
    Anthropic multi-tenant inferenceSuspected cross-tenant leak (unconfirmed)Low — no SOC 2-equivalent isolation attestation for LLM inference
    ChatGPT prompt injection via connectorsVendor-confirmed (Lockdown Mode is the tell)Emerging — Lockdown Mode + egress monitoring

    The Claude Code MCP vulnerability is the structurally interesting one. MCP is the protocol teams use to hand LLMs tools, files, and credentials. A vulnerability in the MCP client is a vulnerability in everything the client was trusted to touch. That is not a bad deserializer. That is the entire developer workstation.

    The Detection Gap

    The sources converge on one finding. Princeton's ICML 2026 study reports that GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are not meaningfully more reliable than their predecessors. Any governance policy that approved use cases on the basis of "we'll use the latest model" is treating a marketing claim as a control. Reliability ceilings must be enforced outside the LLM.

    Action items

    • Audit every LLM-fronted support, helpdesk, and IAM self-service flow for ability to mutate identity state (email, phone, MFA, password reset) within 2 weeks
    • Require human-in-the-loop or out-of-band verification for any account recovery action initiated via AI agent immediately
    • Mandate ChatGPT Lockdown Mode for executive, legal, M&A, and IR users and document capability trade-offs in AI acceptable-use policy within 30 days
    • Allowlist and sign all MCP servers, enforce least-privilege scopes, and log MCP traffic — default-allow posture must end this quarter
    • Open vendor incident review with Anthropic: request RCA and tenant-list confirmation for suspected cross-tenant exposure; preserve all Claude API logs from affected window

    Sources:Matthias from THE DECODER · Two disclosures, one surface. The HuggingFace remote code execution affects a library footprint reported at 2.2 billion installs. · Techpresso · AINews

  3. 03

    AI Vulnerability Discovery Has Structurally Outpaced Patching — Redesign Controls Accordingly

    monitor

    The Data Point That Changes the Math

    One security startup's AI agent autonomously surfaced 21 zero-days in FFmpeg in a single research cycle. FFmpeg sits inside Slack, browser WASM builds, ML preprocessing pipelines, container base images, and media transcoding services. Most security teams cannot enumerate their FFmpeg footprint, let alone patch it at the cadence disclosure will impose.

    This is not a one-off. Project Glasswing expanded to 150 critical-infrastructure companies this cycle. Anthropic engineers are embedded at NSA running Mythos for offensive operations. AI-weaponized tooling is now a productized SKU on ransomware marketplaces. Discovery scales with compute. Remediation scales with human engineering hours. The two curves have diverged.

    Patch SLAs are no longer the right defensive metric. AI-driven discovery has structurally outpaced vendor remediation, and your security architecture needs to assume the patch may never arrive on time.

    The NVD Is Failing

    The Commerce Inspector General is unambiguous: "NIST's lack of strategic planning and decisive action have allowed the backlog of unprocessed vulnerabilities to continue growing." Scanners that depend on NVD for CVSS, CPE matching, or CWE classification now have silent coverage gaps on recent CVEs. The CVE-2026-20245 Cisco zero-day this week — active exploitation, no patch, high CVSS, internet-facing — is exactly the profile that lands before NVD can process it.

    Feeds to promote to primary: CISA KEV for exploitation-driven prioritization, EPSS for probabilistic scoring, GitHub Security Advisories which routinely beat NVD on OSS, and direct vendor PSIRT feeds.

    The Structural Asymmetry

    Multiple sources describe the same asymmetry, independently. AI-augmented offense — vulnerability discovery, weaponized tooling, RaaS professionalization — is compounding faster than AI-augmented defense, which means patch generation, detection tuning, and response automation. Sources split on whether the gap closes. Vendors claim AI-assisted patch generation will pull it back. Independent researchers argue discovery will always run ahead, because the attacker needs one flaw and the defender owes a fix for all of them. The second argument has the better track record.

    Discovery DriverStatusImpact on Defenders
    Project Glasswing (Anthropic)150 critical-infra companiesOT/ICS vendors being scanned at AI scale
    FFmpeg AI research21 zero-days, one cycleVideo processing stack broadly exposed
    RaaS marketplace AI toolsCommodity SKULower skill floor for exploitation
    NVD backlogOfficially degradingScanner coverage gaps on recent CVEs

    The Shift in Defensive Posture

    The implication is architectural, not procedural. Virtual patching — WAF, RASP, IPS, runtime exploit prevention — moves to the primary control. The tabletop that matters now is the one we flagged last cycle: "Critical RCE in tier-1 vendor, no patch available for 30 days, PoC public within 48 hours." Isolation, customer communications, and regulator notification get decided before the bulletin lands, not after.

    Action items

    • Inventory FFmpeg usage across your stack (services, container images, client apps, browser WASM, ML preprocessing) this sprint and subscribe to upstream FFmpeg security advisories
    • Audit virtual-patching coverage (WAF, RASP, IPS) across all internet-facing assets and tier-1 vendor software this quarter — identify gaps where no compensating control exists if a zero-day drops
    • Diversify vulnerability intelligence beyond NVD immediately: ingest CISA KEV, EPSS, GitHub Security Advisories, and vendor PSIRTs directly; flag CVEs with stale or missing NVD enrichment
    • Run tabletop exercise: 'Critical RCE in tier-1 vendor, no patch for 30 days, PoC public in 48 hours' — pre-bake isolation, comms, and regulator decisions this quarter

    Sources:Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs · Two disclosures, one surface. The HuggingFace remote code execution affects a library footprint reported at 2.2 billion installs. · AI vulnerability discovery is outpacing vendor patches — your exposure window just widened

◆ QUICK HITS

Quick hits

  • IBM whistleblower alleges company covered up multiple data breaches — initiate vendor re-attestation and pull notification clauses if IBM is in your supply chain

    Techpresso

  • Cisco CVE-2026-20245 (CVSS 7.8, no patch): restrict Catalyst SD-WAN Manager admin interfaces to jump-host-only ACL today and enable enhanced audit logging for anomalous API/session activity

    Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs

  • Cloudflare reports bots now outnumber humans online; Bright Data iOS SDK turns consumer apps and smart TVs into scraping exit nodes — residential-IP reputation as a trust signal is degrading

    Matthias from THE DECODER

  • GitHub processed 17M agent-authored PRs in March 2026; Copilot's June 1 usage-based billing means stolen developer tokens now produce real invoices — reclassify PATs as financially sensitive

    🔳 Turing Post

  • Claude Code ships bypassPermissions and dontAsk modes that give agents shell access without approval — publish explicit policy banning these on endpoints with production credentials via MDM/EDR

    ByteByteGo

  • OpenAI merging Codex into ChatGPT collapses code-generation and chat into single auth boundary — update DLP/CASB rules scoped to Codex-specific endpoints before the consolidation lands

    The Information

  • SolarWinds Serv-U DoS flaw added to CISA KEV under active exploitation — patch immediately and restrict ingress to known partner ranges

    Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs

  • Update: Anthropic-NSA Mythos deployment confirmed with ~6 embedded engineers; assume nation-state offensive capability uplifted on phishing fluency and exploit synthesis with 12-24 month trickle-down to financially motivated actors

    Techpresso

◆ Bottom line

The take.

Self-replicating worms are now propagating through GitHub and npm at machine speed while a Cisco SD-WAN zero-day sits unpatched under active exploitation — and the AI agent that found 21 FFmpeg zero-days in one cycle just proved that discovery will permanently outpace patching. Treat this week as an incident sprint: audit your dependency graph for Miasma/IronWorm contamination, restrict your SD-WAN management plane to jump hosts, and accept that virtual patching is now your primary control, not your backup plan.

— Promit, reading as Security ·

Frequently asked

What immediate steps should I take if my org uses npm or GitHub Actions this week?
Diff your SBOM against published Miasma and IronWorm indicators for any package installed or updated in the last 14 days, then rotate every npm publish token, GitHub PAT, CI runner credential, and SSH key touched by suspect builds within 48 hours. The worm's payload specifically harvests those credentials to propagate downstream, so rotation is what actually breaks the chain.
Is there a workaround for the Cisco Catalyst SD-WAN Manager zero-day while no patch exists?
Restrict the management plane to a jump-host-only network segment, enforce MFA on all admin access, and deploy virtual patching signatures at the WAF or IPS layer for CVE-2026-20245. Preserve full audit logs and treat any anomalous session as an incident until Cisco ships a fix, because active exploitation is confirmed and there is no vendor remediation available.
Why can't I just rely on my scanner's CVSS scores to prioritize this week's work?
The Commerce Inspector General confirmed NIST's NVD backlog is structurally growing, meaning recent CVEs — including the Cisco SD-WAN zero-day — often lack enrichment your scanner depends on. Promote CISA KEV for exploitation signal, EPSS for probability scoring, GitHub Security Advisories for OSS, and direct vendor PSIRT feeds to primary inputs instead of trusting NVD-derived severity alone.
Does the HuggingFace Transformers RCE affect us if we only download models, not code?
Yes — the exploit triggers through crafted model configuration files, which the library treats as inert metadata but actually parses as code paths. Any GPU inference host, Jupyter notebook, or MLOps runner that pulled a model from the Hub is in the blast radius, and these systems typically lack EDR and egress inspection, so block untrusted model configs at the egress proxy and pin to a patched Transformers version.
How should I brief leadership on why this is an incident sprint rather than a normal patch cycle?
Frame it as three simultaneous failures: a self-replicating worm is compounding through package registries without human intervention, a critical WAN management zero-day is being exploited with no patch available, and the national vulnerability database that underpins prioritization is degraded. The combination means the standard 30-day patch SLA cannot contain exposure this cycle, so isolation, credential rotation, and virtual patching become the primary controls for the next seven days.

◆ Same day, different angle

Read this day as…

  1. 35 shared

    A self-replicating supply-chain worm (Miasma)

    A self-replicating worm has infected Microsoft's own GitHub repos and 50+ npm packages while Cisco's SD-WAN zero-day sits under active explo…

  2. 28 shared

    CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, CVSS 7.8, is being exploited in the wild.

    An unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos and 50+ npm packag…

  3. 26 shared

    Two active items this week.

    Your dependency graph is under attack by a self-replicating worm (Miasma, 73 Microsoft repos, 50+ npm packages), your Cisco SD-WAN managemen…

◆ Recent in security

Keep reading.

Spot an error? [email protected]