Security daily

Synthesized by Clarity (Claude) from 16 sources · May contain errors — spot one? [email protected] · Methodology →

Cisco SD-WAN 0-Day and Miasma Worm Hit npm at Same Time

Sources
16
Words
1,255
Read
6min

Topics Agentic AI AI Regulation AI Capital

◆ The signal

CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, CVSS 7.8, exploited in the wild, no patch. Separately, the Miasma worm has reached 73 Microsoft-owned GitHub repositories and 50+ npm packages, dropping a Rust-based info-stealer. The WAN management plane and the JavaScript dependency graph are both compromised at once.

◆ INTELLIGENCE MAP

Intelligence map

  1. 01

    Active Exploitation Sprint: Unpatched Cisco Zero-Day + Self-Replicating Supply-Chain Worm

    act now

    Cisco CVE-2026-20245 is actively exploited with NO vendor patch — defenders are in pure ACL/logging mode. Simultaneously, Miasma worm infected 73 Microsoft GitHub repos across 4 orgs and IronWorm poisoned 50+ npm packages with credential-harvesting payloads. SolarWinds Serv-U DoS added to CISA KEV. Treat this week as an incident sprint.

    73
    MS repos compromised
    2
    sources
    • Cisco CVSS
    • MS GitHub repos hit
    • npm packages poisoned
    • FFmpeg zero-days
    1. MS GitHub Repos73 repos
    2. npm Packages50+
    3. FFmpeg 0-days21 CVEs
    4. Cisco CVSS7.8/10
  2. 02

    AI Development Pipeline Is Now a Tier-1 Attack Surface

    act now

    HuggingFace Transformers RCE (2.2B installs) exploitable via model config files. Meta's AI chatbot was socially engineered into hijacking Instagram accounts — prompt-as-privilege-escalation is now proven in the wild. OpenAI shipped Lockdown Mode globally as an admission prompt injection has no clean fix. Anthropic may have leaked outputs across tenant boundaries.

    2.2B
    HuggingFace installs
    5
    sources
    • HF installs exposed
    • Lockdown Mode status
    • Anthropic incident
    • Attack surfaces
    1. 01HuggingFace RCE2.2B installs
    2. 02Meta AI Chatbot ATOExploited ITW
    3. 03Claude Code MCPUnpatched
    4. 04Anthropic Cross-TenantUnconfirmed
  3. 03

    Agent-Scale Code Pipeline: 17M Non-Human PRs Rewriting Supply Chain

    monitor

    GitHub processed 17M agent-authored pull requests in March 2026. Copilot moved to usage-based billing June 1 — stolen tokens now trigger real invoices. OpenAI is merging Codex into ChatGPT, widening prompt-injection blast radius. Claude Code's bypassPermissions mode gives agents unmonitored shell access on developer machines.

    17M
    agent PRs per month
    4
    sources
    • Agent PRs (March)
    • Billing switch
    • Claude Code modes
    • Copilot billing model
    1. Human PRs (est.)5M/mo
    2. Agent PRs (Mar '26)17M/mo+240%
  4. 04

    NVD Collapse & AI Discovery Outpacing Remediation

    monitor

    Commerce IG officially declared NIST's NVD backlog a strategic-planning failure — your scanner data is degrading. An AI agent found 21 FFmpeg zero-days in one cycle. Project Glasswing expanded to 150 critical-infrastructure firms. Patch SLAs are structurally obsolete; virtual patching must become the primary control.

    21
    AI-found FFmpeg 0-days
    3
    sources
    • FFmpeg 0-days (1 cycle)
    • Glasswing CI firms
    • NVD status
    • AI tooling on forums
    1. AI Discovery Rate21 vulns/cycleaccelerating
    2. Vendor Patch Capacity3 vulns/cycleflat
  5. 05

    Vendor Trust Erosion: IBM Cover-Up, Anthropic Leak, Reliability Plateau

    background

    IBM whistleblower alleges multiple undisclosed breaches — a vendor-risk event for any IBM customer. Anthropic's suspected cross-tenant exposure is unconfirmed but pattern-consistent. Princeton's ICML study finds GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are NOT more reliable than predecessors. AI vendor maturity is below what enterprise pricing implies.

    4
    sources
    • IBM allegation
    • Anthropic status
    • Reliability gain
    • Models tested
    1. AI Vendor Security Maturity30

◆ DEEP DIVES

Deep dives

  1. 01

    Active Exploitation Sprint: Unpatched Cisco Zero-Day and Self-Replicating Supply-Chain Worm

    act now

    Situation

    Cisco shipped no patch this week for CVE-2026-20245 (CVSS 7.8), which is under active exploitation in Catalyst SD-WAN Manager and remains vendor-unaddressed. The Miasma worm, a self-replicating supply-chain payload, has compromised 73 GitHub repositories across four Microsoft-owned organizations. The related IronWorm campaign poisoned 50+ legitimate npm packages with a Rust-based information stealer. CISA added a SolarWinds Serv-U DoS flaw to KEV the same week.

    Why Miasma Is Different

    Manual package poisoning has a linear blast radius. A worm has a compounding one. Replication is autonomous, and propagation tracks CI runs rather than human publish events. The Rust payload harvests CI tokens, .npmrc credentials, SSH keys, and environment secrets, which is precisely the credential set needed to push poisoned versions further downstream. Microsoft's own repos sitting in the compromised set indicates that platform ownership confers no isolation from registry-level contagion.

    Worm logic is now resident in npm and GitHub, with propagation tied to CI execution rather than human commits. Treat any pipeline that consumed the affected packages as suspect until proven otherwise.

    The Cisco Exposure

    CVE-2026-20245 targets the management plane of Catalyst SD-WAN Manager, an internet-adjacent surface with WAN-wide blast radius. With no patch available, defenders are in pure compensating-controls mode: ACL restriction to jump hosts, enhanced audit logging, and active hunting for anomalous API calls and session creation events.

    Cross-Incident Comparison

    IncidentPatch StatusBlast Radius
    Cisco SD-WAN CVE-2026-20245None availableWAN-wide via management plane
    Miasma (Microsoft GitHub)Cleanup in progress; worm self-replicatesAll consumers of affected repos + transitive deps
    IronWorm (npm)Per-package; pin/audit requiredAny CI pulling fresh deps in last 14 days
    SolarWinds Serv-UPatch availableAny Serv-U instance; BOD 22-01 timeline
    FFmpeg 21 zero-daysStagingAnything touching video processing

    The FFmpeg Signal

    One AI agent autonomously disclosed 21 zero-days in FFmpeg in a single research cycle. FFmpeg ships inside container base images, Slack, browser-side wasm, and ML preprocessing pipelines, which is broader than most asset inventories acknowledge. The pattern to watch is AI-assisted discovery producing disclosure volume faster than vendor patch cycles can absorb.

    Action items

    • Restrict Cisco Catalyst SD-WAN Manager admin interfaces to jump-host-only via ACL and enable full audit logging. Hunt for anomalous session creation and config push events.
    • Run emergency npm/GitHub dependency audit: identify packages installed or updated in the last 14 days matching Miasma/IronWorm IOCs. Rotate all CI tokens, npm tokens, and developer credentials from suspect builds.
    • Patch all SolarWinds Serv-U instances and document remediation against BOD 22-01 timelines.
    • Inventory all FFmpeg usage (services, containers, client apps, wasm, ML pipelines) and pre-stage emergency patch playbooks per service tier.
    • Enforce npm ci with lockfiles, enable provenance verification, and quarantine suspicious packages at the proxy registry layer.

    Sources:Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs · AI vulnerability discovery is outpacing vendor patches — your exposure window just widened

  2. 02

    AI Development Pipeline Is Now a Tier-1 Attack Surface — Four Concurrent Vectors

    act now

    The Pattern

    Four AI-stack attack surfaces escalated in the same week. Each one exploits a trust boundary developers assumed was implicit. That is why they work.

    The model config was not supposed to be executable. The MCP server had no business reading ~/.aws/credentials. A chatbot should not be mutating account emails. Every one of those assumptions failed this week.

    1. HuggingFace Transformers RCE (2.2 Billion Installs)

    A remote code execution reachable through crafted model configuration files. The trigger path weaponizes what most pipelines treat as inert metadata. "Just downloading a model" from the Hub becomes code execution. Blast radius lands on GPU inference hosts, Jupyter environments, and MLOps runners, historically the worst-instrumented boxes in any enterprise. Detection maturity is low. Most ML hosts run without EDR or egress inspection.

    2. Meta AI Chatbot Account Takeover (Exploited in the Wild)

    Attackers socially engineered Meta's AI chatbot into changing the email address on high-profile Instagram accounts. Read it as prompt-as-privilege-escalation: the chatbot performed an identity-state mutation a human agent would have flagged. The pattern generalizes to any LLM wired to tools that can mutate identity, payments, or data. In MITRE ATT&CK terms, T1098 (Account Manipulation) executed through a non-human intermediary.

    3. Claude Code MCP Integration Flaws

    MCP is the protocol teams use to hand LLMs tools, files, and credentials. A vulnerability in the MCP client is a vulnerability in everything the client was trusted to touch. This is not shaped like a deserialization bug. The threat model for MCP is not settled, and over-privileged servers with wildcard filesystem access are the default rather than the exception.

    4. OpenAI Lockdown Mode (Shipped Globally)

    OpenAI's mitigation works by removing capabilities, not hardening them. Deep Research, Agent Mode, internet image fetch, and file downloads are all disabled. That is an honest admission that prompt injection has no clean technical fix. Available on all personal accounts. Enterprise and Team tenants are not explicitly covered, so tenant-level DLP remains load-bearing.

    Anthropic Cross-Tenant Exposure (Unconfirmed)

    Reports describe a possible cross-tenant output leakage during an Anthropic outage, consistent with multi-tenant isolation failure. Treat as unverified until a vendor statement confirms. If it validates, every major AI platform vendor will have had at least one credible isolation incident in the last 12 months.

    Detection Maturity Assessment

    SurfaceDetection MaturityPriority Control
    HF Transformers on ML hostsLow — no EDR, no egressPatch + egress controls + FIM on model dirs
    LLM-fronted identity flowsVery low — MCP traffic rarely loggedHuman-in-the-loop on all recovery actions
    Prompt injection via connectorsEmerging — Lockdown Mode is first vendor controlEnable Lockdown Mode + DLP on connector egress
    Multi-tenant LLM inferenceLow — no SOC 2-comparable isolation testingPreserve logs, demand RCA from vendor

    Action items

    • Inventory all hosts running HuggingFace Transformers (GPU inference, notebooks, MLOps runners) and pin to patched version. Block loading untrusted model configs from the Hub at egress proxy.
    • Audit every LLM-fronted support, helpdesk, and IAM flow for ability to mutate identity state. Require human-in-the-loop or out-of-band verification for any account recovery action via AI agent.
    • Mandate ChatGPT Lockdown Mode for high-sensitivity users (execs, legal, M&A, IR). Document capability trade-offs in AI acceptable-use policy.
    • Allowlist and sign all MCP servers; enforce least-privilege scopes; log MCP traffic. Default-allow is over.
    • Open vendor incident review with Anthropic: request RCA, scope, and tenant-list confirmation for suspected cross-tenant exposure. Preserve all Claude API call logs from the affected window.

    Sources:Two disclosures, one surface. · Matthias from THE DECODER · Techpresso · AINews · ByteByteGo EP217

  3. 03

    17 Million Agent PRs Per Month: The Code Supply Chain, Identity Perimeter, and Financial Attack Surface All Moved

    monitor

    The Scale Shift

    GitHub reported 17 million agent-generated pull requests in March 2026. One month. One platform. Review pipelines built for human-authored diffs are now triaging machine output at machine cadence. The control assumes a human on at least one side of the change. At this volume that assumption is a budgeting problem, not a policy.

    Code review was designed around the assumption that the author was a human with a job title and a Slack handle. Agents do not have those. They have API keys and prompts — and the prompts are increasingly authored by other agents.

    Three New Attack Surfaces

    1. Agent-Authored Code at Scale

    Repositories already contain non-trivial agent-generated code merged by humans on review fatigue. Observed failure modes: slopsquatting via hallucinated dependencies, over-permissive IAM in IaC, secrets in test fixtures, license contamination. SAST and SCA were tuned to a slower cadence than the one shipping the code.

    2. Copilot Usage-Based Billing (Financial DoS)

    Since June 1, GitHub Copilot runs on usage-based billing with semantic routing across MAI Code One Flash, Opus, and GPT. A compromised developer credential no longer just leaks code. It spends money. A stolen PAT looped against an agent endpoint produces an invoice, not just an incident.

    3. Claude Code's Dangerous Permission Modes

    Claude Code ships seven permission tiers, including bypassPermissions and dontAsk, which suppress interactive approval on tool calls and shell commands. Enabling either on a workstation with cloud SSO or signing keys delegates execution authority to a model whose input channel includes every README, issue, and dependency in the repo.

    OpenAI Codex-to-ChatGPT Merger

    OpenAI is collapsing Codex into ChatGPT. Developer code, secrets, and proprietary logic will traverse the same endpoints as general chat traffic. DLP rules scoped to coding-tool endpoints go blind. Prompt-injection blast radius widens because the unified assistant carries broader tool access and context.

    Concentration Risk

    GitHub is shedding load into Azure after hitting single-data-center limits. Dev pipeline (GitHub), identity (Entra), productivity (M365), and AI tooling (Copilot/OpenAI) now share fate. BCP plans that model GitHub-only outages are stale.

    SurfaceWhat ChangedDetection Gap
    Agent-authored PRs17M/month; dominant inputSAST/SCA tuned for human cadence
    Copilot billingUsage-based since June 1No SOC alerts on spend anomalies
    Claude Code permissionsbypassPermissions = unmonitored shellEDR not fingerprinting agent configs
    Codex→ChatGPT mergeCode flows shift to chat endpointsDLP rules scoped to Codex miss

    Action items

    • Implement branch protection requiring SAST, secret-scan, SCA, and dependency-confusion checks on any PR from a Copilot or agent identity. Tag and sample for human audit.
    • Reclassify Copilot tokens and PATs as financially sensitive credentials. Enforce short TTL, conditional access, IP allowlists, and per-user/per-org spend caps with anomaly alerts.
    • Publish AI coding-agent permissions policy banning bypassPermissions and dontAsk on any workstation with production credentials. Enforce via MDM/EDR detection of Claude Code config flags.
    • Update DLP/CASB rules ahead of Codex-to-ChatGPT merger: broaden monitoring from coding-tool-specific endpoints to all chat.openai.com/api.openai.com developer traffic.
    • Tabletop a correlated GitHub + Azure + M365 + OpenAI degradation scenario and document degraded-mode CI/CD procedures.

    Sources:🔳 Turing Post · ByteByteGo EP217 · The Information · The Information (SpaceX)

◆ QUICK HITS

Quick hits

  • IBM whistleblower alleges multiple undisclosed data breaches — if IBM touches your stack, initiate vendor re-attestation and pull breach-notification contract clauses this week

    Techpresso

  • NIST NVD backlog officially called a 'strategic-planning failure' by Commerce IG — diversify VM intelligence to CISA KEV, EPSS, and GitHub Security Advisories immediately

    Two disclosures, one surface.

  • Cloudflare reports bots now outnumber humans on the open web — residential-IP reputation as a sole trust signal is dead; re-baseline WAF/bot-defense for behavioral fingerprints

    Matthias from THE DECODER

  • Princeton ICML 2026 study: GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are NOT measurably more reliable than predecessors — any AI governance policy relying on 'latest model' as a control is treating marketing as a safeguard

    AINews

  • Update: Project Glasswing expanded to 150 critical-infrastructure firms; ~6 Anthropic engineers embedded at NSA deploying Mythos for offensive operations — offensive tradecraft trickle-down to financially motivated actors expected within 12-24 months

    AI vulnerability discovery is outpacing vendor patches — your exposure window just widened

  • Bright Data iOS SDK turns consumer apps and smart TVs into web-scraping exit nodes — credential stuffing from consumer ASNs will bypass datacenter-IP blocklists; update bot-defense logic

    Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs

  • Google paying SpaceX $920M/month for 110,000 GPUs; Anthropic at $1.25B/month on Colossus 1 — map your AI vendors' indirect SpaceX compute dependency before it becomes a concentration risk

    Techpresso

  • ChatGPT now stores narrative dossiers on users (work, hobbies, travel) — move org users to enterprise tenancies with memory disabled or scoped; update DLP rules for bulk pastes to AI endpoints

    Matthias from THE DECODER

◆ Bottom line

The take.

Your dependency graph is under attack by a self-replicating worm (Miasma, 73 Microsoft repos, 50+ npm packages), your Cisco SD-WAN management plane is actively exploited with no patch available, and your AI development pipeline — from HuggingFace model configs to LLM-fronted identity flows to 17 million agent-authored PRs per month — is now a Tier-1 attack surface that most security programs haven't instrumented. Treat this week as an incident sprint: audit dependencies against Miasma IOCs, restrict Cisco SD-WAN admin access to jump hosts, and mandate human-in-the-loop on any LLM that can mutate identity or spend money.

— Promit, reading as Security ·

Frequently asked

What compensating controls should I apply for CVE-2026-20245 with no Cisco patch available?
Restrict Catalyst SD-WAN Manager admin interfaces to jump-host-only via ACL, enable full audit logging, and actively hunt for anomalous session creation and configuration push events. Since the flaw is under active exploitation on an internet-adjacent management plane with WAN-wide blast radius, these compensating controls are the only defense until Cisco ships a fix.
Why is the Miasma worm materially different from prior npm and GitHub supply-chain attacks?
Miasma self-replicates rather than requiring manual package poisoning, so its blast radius compounds instead of growing linearly. Propagation is tied to CI execution rather than human publish events, and its Rust payload harvests CI tokens, .npmrc credentials, SSH keys, and environment secrets — exactly what it needs to push poisoned versions further downstream. Microsoft's own repos being in the compromised set shows platform ownership offers no isolation.
How should we handle the HuggingFace Transformers RCE across ML infrastructure?
Inventory every host running Transformers — GPU inference nodes, Jupyter environments, and MLOps runners — and pin to a patched version immediately. Block loading of untrusted model configs from the Hub at the egress proxy and add file integrity monitoring on model directories. These hosts historically lack EDR and egress inspection, so structural controls matter more than detection here.
What is the risk model for LLM chatbots wired to identity or account-recovery flows?
Treat them as prompt-as-privilege-escalation vectors. The Meta AI chatbot was socially engineered into changing the email on high-profile Instagram accounts — an identity-state mutation a human agent would have flagged. Any LLM with tools that can mutate identity, payments, or data needs human-in-the-loop or out-of-band verification on recovery actions, and MCP traffic should be logged and scoped to least privilege.
Why does Copilot's usage-based billing change how we treat developer credentials?
A stolen PAT or Copilot token is now a financial liability, not just a code-leak risk. Since June 1, Copilot runs on usage-based billing with semantic routing across multiple models, so a compromised credential looped against an agent endpoint produces real invoices. Enforce short TTLs, conditional access, IP allowlists, and per-user and per-org spend caps with anomaly alerts — the same posture used for payment credentials.

◆ Same day, different angle

Read this day as…

  1. 31 shared

    CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, CVSS 7.8, is being exploited in the wild.

    An unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos and 50+ npm packag…

  2. 30 shared

    Cisco Catalyst SD-WAN Manager CVE-2026-20245 is under active exploitation with NO vendor

    Three simultaneous critical events define this week: an unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm i…

  3. 28 shared

    Two items, neither of them a patch problem.

    This week stacks an actively exploited Cisco SD-WAN zero-day with no patch, a self-replicating worm inside Microsoft's own GitHub organizati…

◆ Recent in security

Keep reading.

Spot an error? [email protected]