Security daily

Synthesized by Clarity (Claude) from 16 sources · May contain errors — spot one? [email protected] · Methodology →

CVE-2026-20245 Hits Cisco SD-WAN Manager With No Patch Yet

Sources
16
Words
1,184
Read
6min

Topics Agentic AI AI Capital AI Regulation

◆ The signal

No patch yet. The Miasma worm has hit 73 Microsoft-owned GitHub repos and 50-plus npm packages in the last 14 days, dropping a Rust infostealer; self-replicating npm worms are now an annual genre.

◆ INTELLIGENCE MAP

Intelligence map

  1. 01

    Unpatched Cisco Zero-Day + SolarWinds KEV Under Active Exploitation

    act now

    Cisco CVE-2026-20245 (CVSS 7.8) in Catalyst SD-WAN Manager is actively exploited with no patch available — defenders are in compensating-controls-only posture on an internet-adjacent management plane. SolarWinds Serv-U DoS also added to CISA KEV. Both require immediate action today.

    7.8
    CVSS, no patch available
    1
    source
    • Cisco CVSS
    • Patch available
    • SolarWinds KEV
    • Blast radius
    1. 01Cisco SD-WAN MgrNo patch, exploited
    2. 02SolarWinds Serv-UPatch available, KEV
    3. 03Chrome 429 bugsPatched, deploy
  2. 02

    Self-Replicating Supply-Chain Worms Hit Microsoft GitHub + 50+ npm Packages

    act now

    Miasma is a self-replicating worm — not manual package poisoning — that hit 73 Microsoft GitHub repos across 4 orgs. A parallel variant plus IronWorm contaminated 50+ npm packages with a Rust-based infostealer harvesting CI tokens, SSH keys, and .npmrc credentials. Every compromised install becomes a new propagation node.

    73
    Microsoft repos compromised
    1
    source
    • MS GitHub repos hit
    • MS orgs affected
    • npm packages poisoned
    • Payload type
    1. MS GitHub Repos73 repos
    2. npm Packages50+
    3. MS Orgs4 orgs
  3. 03

    AI Platform Trust Boundaries Collapsing: HuggingFace RCE, Meta Chatbot Hijack, Anthropic Leak

    monitor

    Five concurrent AI platform security events: HuggingFace Transformers RCE (2.2B installs) via model configs, Meta's AI chatbot social-engineered into account takeover, Claude Code MCP vulnerabilities, suspected Anthropic cross-tenant data leak, and OpenAI shipping Lockdown Mode as an admission that prompt-injection exfiltration is a live attack chain.

    2.2B
    HuggingFace installs exposed
    6
    sources
    • HF installs at risk
    • AI platforms affected
    • Detection maturity
    • MCP logging
    1. HF Transformers RCE95% - Critical
    2. Meta Chatbot Hijack90% - Exploited
    3. Claude Code MCP80% - Unpatched
    4. Anthropic Leak70% - Unconfirmed
    5. OpenAI Lockdown40% - Mitigating
  4. 04

    Structural Defense Model Breaking: AI Discovery Rate, NVD Collapse, 17M Agent PRs

    monitor

    AI vulnerability discovery has structurally outpaced patch capacity (21 FFmpeg zero-days from one AI agent in one cycle). The NVD backlog is officially called a 'strategic-planning failure' by the Commerce IG. Meanwhile, 17M agent-authored PRs/month on GitHub overwhelm human code review. Patch-cycle thinking is obsolete.

    21
    FFmpeg 0-days, one AI cycle
    4
    sources
    • FFmpeg 0-days found
    • Agent PRs/month
    • Glasswing expansion
    • NVD status
    1. Agent PRs/month17M
    2. FFmpeg 0-days (1 cycle)21
    3. Glasswing firms150
  5. 05

    IBM Breach Cover-Up Allegations + Vendor Governance Shifts

    background

    IBM whistleblower alleges multiple undisclosed data breaches — a vendor-risk event for any org with IBM in the supply chain (Cloud, Watson, Red Hat, Maximo, mainframe). Simultaneously, OpenAI merges Codex into ChatGPT, collapsing two threat models into one auth boundary, and Copilot's June 1 usage-based billing creates a financial attack surface tied to stolen developer credentials.

    4
    sources
    • IBM allegation
    • OpenAI consolidation
    • Copilot billing
    • Copilot billing start
    1. Jun 1Copilot usage-based billing live
    2. Jun 9OpenAI Codex→ChatGPT merge
    3. Jun 12SpaceX IPO (phishing lure)
    4. Q3 2026IBM disclosure timeline TBD

◆ DEEP DIVES

Deep dives

  1. 01

    Incident Sprint: Cisco Zero-Day Without a Patch + Self-Replicating Worms Inside Microsoft's GitHub

    act now

    Two Concurrent Critical Events — Same Week, Different Kill Chains

    Two active-exploitation stories landed in the same window and both demand response now. Cisco confirmed in-the-wild exploitation of CVE-2026-20245 (CVSS 7.8) in Catalyst SD-WAN Manager. No patch. Defenders get compensating controls and prayer against an internet-adjacent management plane whose compromise hands an attacker WAN-wide reach into every branch. We have flagged exactly this class of management-plane bug before. The pattern is not new. The absence of a fix is the part worth staring at. No vendor patch available is doing a lot of work in that sentence.

    Running concurrently: the Miasma worm, which is self-replicating supply-chain code, not the usual hand-rolled package poisoning. It hit 73 GitHub repositories across four of Microsoft's own organizations. A related strain plus IronWorm reached more than 50 legitimate npm packages carrying a Rust-based info-stealer. The payload pulls CI tokens, .npmrc credentials, SSH keys, and developer environment secrets. Those are the exact credentials required to publish the next poisoned version.

    Every install or CI run that pulls a contaminated package becomes a new propagation node. This is compounding, not linear. The worm has arrived in package ecosystems.

    Why the Worm Pattern Is a Category Shift

    Hand-poisoned packages produce a linear victim count. One package, one blast. A self-replicating worm compounds. The Microsoft repos detail matters: if platform owners cannot keep their internal repositories clean of registry-level contagion, smaller shops should not pretend they can. SolarWinds Serv-U is back on CISA KEV under active exploitation in the same week, which makes three concurrent patching obligations on the desk.

    Defensive Priority Matrix

    IncidentPatch StatusYour ExposureAction Window
    Cisco SD-WAN CVE-2026-20245None availableAny branch using Catalyst SD-WAN; management plane = WAN-wideToday
    Miasma worm (GitHub)Cleanup in progress; self-replicatingAnyone consuming affected MS-owned repos or transitive depsThis week
    IronWorm + Miasma (npm)Per-package; pin/audit requiredAny CI run pulling fresh deps in last 14 daysThis week
    SolarWinds Serv-U DoSPatch availableAny Serv-U instance; BOD 22-01 appliesImmediate

    Action items

    • Restrict Cisco Catalyst SD-WAN Manager admin/API access to jump-host-only via ACL today; enable enhanced logging and deploy hunt queries for anomalous session creation and config push events
    • Run emergency npm/GitHub dependency audit: identify any packages installed or updated in the last 14 days matching Miasma/IronWorm IOC lists; rotate all CI tokens, npm tokens, GitHub PATs, and cloud credentials touched by suspect builds
    • Enforce npm ci with locked versions and enable provenance verification at the proxy registry layer; quarantine suspect packages
    • Patch all SolarWinds Serv-U instances and document against BOD 22-01 timelines; restrict ingress to known partner IP ranges

    Sources:Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs

  2. 02

    AI Platform Trust Boundaries Are Failing — Five Events, One Pattern

    monitor

    The AI Stack Is Now a Tier-1 Attack Surface

    Six independent sources this cycle converge on one finding: every major AI platform has had a material security event, and detection tooling has not caught up. Different vendors, different vectors, different blast radii. The shared architecture is the point. Trust boundaries that used to be implicit are now exploitable.

    The Five Events

    1. HuggingFace Transformers RCE — triggered by crafted model config files. The vector weaponizes the assumption that downloading a model is inert. The package has 2.2 billion installs. GPU inference hosts have historically been the worst-instrumented boxes in the enterprise.
    2. Meta AI Chatbot Account Takeover — the chatbot was social-engineered into changing the email address on high-profile Instagram accounts. The model handled a credential-reset path as a support conversation. Call this prompt-as-privilege-escalation. The attacker convinced the AI to perform the breach.
    3. Claude Code MCP Vulnerabilities — the protocol used to grant LLMs tools, files, and credentials has known weaknesses. A vulnerability in the MCP client is a vulnerability in everything the client was trusted to touch.
    4. Anthropic Suspected Cross-Tenant Leak — unconfirmed. Consistent with multi-tenant isolation failure. If it confirms, every major AI platform vendor has had at least one credible cross-tenant or prompt-injection incident in the last twelve months.
    5. OpenAI Lockdown Mode — shipped globally. The shipping itself is the admission that prompt-injection-driven exfiltration is a live attack chain. The mitigation works by amputating capabilities. Deep Research, Agent Mode, image fetch, and file downloads are disabled, not hardened.
    The model config was not supposed to be executable. The MCP server was not supposed to read ~/.aws/credentials. The chatbot was not supposed to change account emails. Each violates a developer mental-model assumption. That is why they work.

    Cross-Source Tension

    Sources disagree on severity. One treats the Anthropic leak as unverified rumor. Another treats it as consistent with the isolation bug class seen against Copilot and Gemini earlier this year. Honest answer: scope is unknown. The pattern is sustained whether or not this specific incident confirms.

    On the HuggingFace RCE, the 2.2 billion installs figure is the ceiling, not the exposure. The relevant question is how many installs are reachable by an attacker staging a malicious artifact, versus pinned or air-gapped. For most defenders the distinction is academic. The exposure is still large enough to act on.

    Detection Maturity Is the Gap

    SurfaceDetection MaturityWhy
    HF Transformers / ML inference hostsLowMost GPU hosts lack EDR or egress inspection
    MCP traffic (Claude Code)Very lowMCP traffic rarely logged anywhere
    LLM-fronted identity flowsLowNo standard for monitoring AI-mediated account changes
    Multi-tenant LLM inferenceLowNo public attestation comparable to SOC 2 CC6 for LLM inference isolation

    Action items

    • Inventory all hosts running HuggingFace Transformers (GPU inference, Jupyter, MLOps runners) and pin to patched version; block loading of untrusted model configs from the Hub at egress proxy
    • Audit every LLM-fronted support, helpdesk, and IAM flow for ability to mutate identity state; require human-in-the-loop or out-of-band verification for any account recovery action initiated via AI agent
    • Mandate OpenAI Lockdown Mode for high-sensitivity users (execs, legal, M&A, IR) and require MCP servers to be allowlisted, signed, and run with least-privilege scopes
    • Open vendor incident review with Anthropic: request RCA, scope, and tenant-list confirmation for the suspected cross-tenant exposure; preserve all Claude API call logs from the affected window

    Sources:Two disclosures, one surface. The HuggingFace remote code execution affects a library footprint reported at 2.2 billion installs. · The claim: Meta's AI chatbot has been characterized as an account-takeover vector. · Three items on the desk this week. The NSA and Anthropic arrangement some are calling Mythos. · Two items this week, weighted differently. Publicly: OpenAI shipped ChatGPT Lockdown Mode. · Two surfaces worth naming. Claude Code's bypassPermissions mode and Google's TPU 8i.

  3. 03

    The Patch-Cycle Model Is Structurally Broken — Plan Around It

    monitor

    Three Forces Converging on One Conclusion

    The premise of vulnerability management was that a patch exists when a CVE drops. That premise is degrading. Three forces, independent, all pointing the same direction.

    1. AI-Powered Discovery Is Outrunning Vendor Capacity

    One security startup's AI agent found 21 zero-days in FFmpeg in a single research cycle. Anthropic's Project Glasswing just expanded to 150 critical-infrastructure companies, alongside parallel programs at OpenAI and the 'son of Mythos' frontier-model wave. Discovery scales at machine speed. Remediation scales at human speed.

    2. The NVD Is Failing

    The Commerce Inspector General was blunt: "NIST's lack of strategic planning and decisive action have allowed the backlog of unprocessed vulnerabilities to continue growing." Scanners that depend on NVD for CVSS, CPE matching, or CWE classification now ship silent coverage gaps on recent CVEs. Most teams will learn this in a post-incident review.

    3. Agent-Authored Code Overwhelms Human Review

    GitHub processed 17 million agent-generated pull requests in March 2026. Code review was built on the assumption that the author was human. AppSec gates that assume a human on one end of the diff are now a headcount problem, not a policy one.

    Patch SLAs are no longer the right defensive metric. AI-driven discovery has structurally outpaced vendor remediation. Your security architecture needs to assume the patch may never arrive on time.

    Compensating Strategy

    The move is from patch-cycle thinking to compensating-control thinking. Virtual patching via WAF, RASP, IPS. Exploit-prevention runtime controls. Tabletops that assume an unpatched, AI-discovered RCE sitting in a tier-1 vendor for 30+ days.

    For vulnerability intelligence: diversify off NVD now. CISA KEV for exploitation-driven prioritization. EPSS for probabilistic scoring. GitHub Security Advisories, which routinely beat NVD on open-source, plus direct vendor PSIRT feeds. NVD is one feed of several. It is not canonical.

    For agent-authored code: branch protection that requires SAST, secret-scan, SCA, and dependency-confusion checks on any PR from a Copilot or agent identity. Measure vulnerability density of agent versus human PRs across a 60-day window. The dataset exists either way. Decide who owns it.

    Action items

    • Audit virtual-patching coverage (WAF, RASP, IPS) across all internet-facing assets and tier-1 vendor software this quarter; identify gaps where no compensating control exists if a zero-day drops
    • Diversify VM intelligence feeds: add CISA KEV, EPSS, GitHub Security Advisories, and vendor PSIRTs as primary sources; flag CVEs with stale or missing NVD enrichment for manual triage
    • Run a tabletop exercise: 'Critical RCE disclosed in tier-1 vendor, no patch for 30 days, PoC public within 48 hours' — pre-bake decisions on isolation, customer comms, and regulator notification
    • Implement mandatory SAST + SCA + secret-scan gates on all agent-tagged PRs; sample 10% for human audit and track vulnerability density vs. human-authored code

    Sources:Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs · Two disclosures, one surface. The HuggingFace remote code execution affects a library footprint reported at 2.2 billion installs. · AI vulnerability discovery is outpacing vendor patches · GitHub is now seeing seventeen million agent-authored pull requests per month.

◆ QUICK HITS

Quick hits

  • IBM whistleblower alleges undisclosed breach cover-ups — if IBM is in your supply chain, request written attestation on notification clause compliance this week

    Three items on the desk this week. The NSA and Anthropic arrangement some are calling Mythos.

  • Update: Anthropic Mythos confirmed deployed at NSA with ~6 embedded engineers for offensive cyber operations under Project Glasswing — assume nation-state phishing fluency has been meaningfully uplifted

    Three items on the desk this week. The NSA and Anthropic arrangement some are calling Mythos.

  • GitHub Copilot switched to usage-based billing June 1 — a stolen developer PAT now generates real invoices at frontier-model prices; reclassify Copilot tokens as financially sensitive credentials

    GitHub is now seeing seventeen million agent-authored pull requests per month.

  • Claude Code ships bypassPermissions and dontAsk modes that suppress all interactive approval on shell commands — ban both on any endpoint with production credentials via MDM/EDR detection of config flags

    Two surfaces worth naming. Claude Code's bypassPermissions mode and Google's TPU 8i.

  • Cloudflare reports bots now outnumber humans on the open web — residential-IP reputation as a sole trust signal is dead; re-baseline WAF/bot-defense scoring toward behavioral fingerprints

    The claim: Meta's AI chatbot has been characterized as an account-takeover vector.

  • OpenAI merging Codex into ChatGPT collapses two threat models into one — DLP/CASB rules scoped to Codex-specific endpoints will go blind; generalize monitoring to all chat.openai.com traffic before cutover

    Two shifts this week. Neither is a breach. Both change the threat surface a SOC has to defend.

  • AI-weaponized ransomware kits now sold as productized SKUs with vendor-like business models on underground forums — retire phishing detections that rely on spelling/grammar tells

    Two disclosures, one surface. The HuggingFace remote code execution affects a library footprint reported at 2.2 billion installs.

  • Princeton ICML 2026 study: GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are not measurably more reliable than predecessors — any AI governance policy relying on 'latest model' as a safety control is ungrounded

    Two items this week, weighted differently. Publicly: OpenAI shipped ChatGPT Lockdown Mode.

◆ Bottom line

The take.

An unpatched Cisco SD-WAN zero-day is actively exploited while a self-replicating worm lives inside Microsoft's own GitHub repos and 50+ npm packages — and across the industry, AI is discovering vulnerabilities faster than vendors can ship patches while the NVD degrades, meaning the patch-cycle model that underpins most security programs is structurally breaking in real time.

— Promit, reading as Security ·

Frequently asked

What compensating controls should we deploy for the unpatched Cisco SD-WAN Manager flaw?
Restrict admin and API access to Catalyst SD-WAN Manager to jump-host-only via ACL, enable enhanced logging, and deploy hunt queries for anomalous session creation and config push events. Because no patch exists for CVE-2026-20245, network isolation of the management plane is the only defense against WAN-wide compromise.
How is the Miasma worm different from typical npm package poisoning attacks?
Miasma is self-replicating: each contaminated install harvests CI tokens, .npmrc credentials, SSH keys, and developer secrets, then uses those to publish the next poisoned version. Traditional package poisoning produces a linear victim count from one malicious upload, while a worm compounds — every CI run pulling fresh deps becomes a propagation node.
Which credentials need rotation if our builds pulled affected npm packages in the last 14 days?
Rotate all CI tokens, npm publish tokens, GitHub PATs, SSH keys, and any cloud credentials that were present in the environment of a suspect build. The Rust-based infostealer specifically targets these artifacts to enable further propagation, so partial rotation leaves the chain intact.
Should we still rely on NVD for vulnerability prioritization?
No — treat NVD as one feed among several, not canonical. The Commerce Inspector General confirmed NIST's backlog of unprocessed vulnerabilities is growing, causing silent coverage gaps in scanners that depend on CVSS, CPE, or CWE enrichment. Supplement with CISA KEV for exploitation signal, EPSS for probabilistic scoring, GitHub Security Advisories, and direct vendor PSIRT feeds.
Why is OpenAI's Lockdown Mode significant beyond the feature itself?
Shipping Lockdown Mode is an implicit admission that prompt-injection-driven exfiltration is a live attack chain against production LLM platforms. The mitigation works by amputating capabilities — disabling Deep Research, Agent Mode, image fetch, and file downloads — rather than hardening them, which signals the underlying trust boundaries cannot yet be defended while enabled.

◆ Same day, different angle

Read this day as…

  1. 28 shared

    Cisco Catalyst SD-WAN Manager CVE-2026-20245 is under active exploitation with no patch

    This week stacks an unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos p…

  2. 26 shared

    CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, CVSS 7.8, is being exploited in the wild.

    An unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos and 50+ npm packag…

  3. 25 shared

    Two items, neither of them a patch problem.

    This week stacks an actively exploited Cisco SD-WAN zero-day with no patch, a self-replicating worm inside Microsoft's own GitHub organizati…

◆ Recent in security

Keep reading.

Spot an error? [email protected]