Security daily

Synthesized by Clarity (Claude) from 16 sources · May contain errors — spot one? mail@promitb.dev · Methodology →

Cisco SD-WAN CVE-2026-20245 Exploited as Miasma Worm Hits npm

Sources
16
Words
1,240
Read
6min

Topics Agentic AI AI Capital AI Regulation

◆ The signal

Simultaneously, a self-replicating worm (Miasma) has poisoned 73 Microsoft-owned GitHub repos and 50+ npm packages, meaning any CI run in the last 14 days may have ingested malicious code.

◆ INTELLIGENCE MAP

Intelligence map

  1. 01

    Unpatched Cisco SD-WAN Zero-Day Under Active Exploitation

    act now

    CVE-2026-20245 (CVSS 7.8) in Cisco Catalyst SD-WAN Manager is actively exploited with no patch. SolarWinds Serv-U also added to CISA KEV. Management planes are the target — WAN-wide blast radius if compromised. Pure compensating controls until vendor ships a fix.

    7.8
    CVSS score, no patch
    1
    source
    • CVSS Score
    • Patch Status
    • Exploitation
    • KEV Additions
    1. 01Cisco SD-WAN Mgr7.8 - No Patch
    2. 02SolarWinds Serv-UHigh - Patch Available
    3. 03FFmpeg (21 bugs)TBD - Staging
    4. 04Chrome (429 bugs)Mixed - Patched
  2. 02

    Self-Replicating Supply Chain Worms Hit Microsoft's Own Repos

    act now

    Miasma is a self-replicating worm — not manual package poisoning — that compromised 73 Microsoft GitHub repos across 4 orgs. A parallel IronWorm campaign poisoned 50+ npm packages with a Rust info-stealer harvesting CI tokens, SSH keys, and .npmrc credentials. Every compromised install becomes a new propagation node.

    73
    Microsoft repos compromised
    1
    source
    • Microsoft Repos Hit
    • Microsoft GitHub Orgs
    • npm Packages Poisoned
    • Payload Type
    1. Microsoft GitHub Repos73
    2. npm Packages50+
    3. FFmpeg Zero-Days21
  3. 03

    AI Development Stack Emerges as Tier-1 Attack Surface

    monitor

    Three concurrent AI-stack attacks: HuggingFace Transformers RCE via model configs (2.2B installs), Claude Code MCP over-privileged integrations exposing dev credentials, and Meta's AI chatbot socially engineered into hijacking Instagram accounts. Detection maturity across all three is rated Low or Very Low.

    2.2B
    HuggingFace installs exposed
    4
    sources
    • HF Installs at Risk
    • Meta ATO Vector
    • MCP Detection
    • ML Host EDR Coverage
    1. AI Stack Detection Maturity15
  4. 04

    AI Vendor Trust Erosion: Lockdown Mode, Cross-Tenant Leaks, NVD Collapse

    monitor

    OpenAI shipped Lockdown Mode — admission prompt injection has no clean fix, only capability amputation. Anthropic has a suspected cross-tenant data leak. Commerce IG indicted NIST NVD backlog as strategic-planning failure. IBM whistleblower alleges undisclosed breach cover-ups. Vendor trust assumptions require immediate re-evaluation.

    5
    sources
    • OpenAI Control
    • Anthropic Incident
    • NVD Status
    • IBM Allegation
    1. 01Anthropic (cross-tenant)Unconfirmed leak
    2. 02IBM (breach cover-up)Whistleblower
    3. 03OpenAI (Lockdown Mode)Mitigation shipped
    4. 04NIST NVD (backlog)IG indicted
  5. 05

    Agent-Scale Code Velocity Creates New Financial and Supply Chain Risk

    background

    GitHub processed 17M agent-authored PRs in March 2026. Copilot moved to usage-based billing June 1 — stolen tokens now cause financial DoS. OpenAI is merging Codex into ChatGPT, collapsing two threat models into one auth boundary. Review pipelines designed for human-cadence code are overwhelmed.

    17M
    agent PRs per month
    3
    sources
    • Agent PRs (March)
    • Billing Change
    • OpenAI Merger
    • Review Capacity
    1. Human PRs (baseline)3M
    2. Agent PRs (Mar 2026)17M+467%

◆ DEEP DIVES

Deep dives

  1. 01

    Cisco SD-WAN Zero-Day and Miasma Worm — Two Concurrent Critical Events Demand Incident Sprint

    act now

    Situation

    Two unrelated critical events, both live, both competing for the same analyst hours. Cisco disclosed active exploitation of CVE-2026-20245 (CVSS 7.8) in Catalyst SD-WAN Manager. No patch. In parallel, a self-replicating supply-chain worm called Miasma has compromised 73 GitHub repositories across four of Microsoft's own organizations. IronWorm has poisoned 50+ npm packages with a Rust-based information stealer.

    Why This Is Different

    The Cisco bug is a management-plane flaw on an internet-adjacent surface. Successful exploitation hands the attacker every branch and site managed by the compromised instance. There is no patch and no fix timeline. Compensating controls are the entire defense.

    Miasma is the escalation we flagged as plausible after the npm incidents earlier this year. Self-replicating worm logic in package ecosystems means every CI run that pulls a contaminated package becomes a new propagation node. The Rust payload harvests CI tokens, .npmrc credentials, SSH keys, and developer environment secrets. That is the exact key ring needed to push poisoned versions further downstream. Microsoft's own repos were hit, which settles the question of whether platform owners are isolated from registry-level contagion. They are not.

    Manual package poisoning has a linear blast radius. A worm has a compounding one. Every install becomes a new propagation node.

    Compensating Controls for Cisco (Today)

    1. Restrict SD-WAN Manager admin and API interfaces to jump-host-only access via ACL.
    2. Enable enhanced audit logging. Deploy hunt queries for anomalous administrator session creation and configuration push events.
    3. Subscribe to Cisco PSIRT for patch notification.
    4. If possible, remove the management interface from direct internet exposure entirely.

    Supply Chain Triage (This Week)

    1. Diff your SBOM against the published Miasma and IronWorm IOC lists.
    2. For any npm package installed or updated in the last 14 days from the affected set: rotate npm publish tokens, GitHub PATs, CI runner cloud credentials, and any secrets exposed to those builds.
    3. Enforce npm ci with locked versions. Enable provenance verification.
    4. Quarantine suspect packages at the proxy registry layer.

    Separately, SolarWinds Serv-U was added to CISA KEV under active exploitation. Patch immediately if in environment. BOD 22-01 timelines apply for FCEB and contractors.

    Action items

    • Restrict Cisco SD-WAN Manager to jump-host-only access via ACL and enable full audit logging
    • Run emergency npm/GitHub dependency audit against Miasma/IronWorm IOC lists for all packages installed in last 14 days
    • Rotate all CI tokens, npm publish tokens, and developer credentials touched by any suspect builds
    • Patch SolarWinds Serv-U instances and document against BOD 22-01 timelines
    • Inventory all FFmpeg usage across services, containers, and client apps and pre-stage patch playbooks for 21 disclosed zero-days

    Sources:Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs

  2. 02

    LLM-Mediated Privilege Escalation Is Now Live — Meta's AI Chatbot Hijacked Instagram Accounts

    monitor

    The Proof of Concept

    The target: high-profile Instagram accounts. The vector: Meta's AI chatbot, socially engineered into changing the email address on those accounts. The mechanism: a credential-reset path fronted by an LLM, which treated the exchange as a support conversation rather than an identity-proofing one. No account was breached. The chatbot performed the takeover on the attacker's behalf.

    This is not a theoretical risk category anymore. It is prompt-as-privilege-escalation, observed in the wild against a named platform.

    Every LLM connected to a tool that mutates identity, money, or data is now a Tier-1 attack surface. The Meta/Instagram hijack is the proof of concept the board will hear about next.

    Why This Generalizes

    The pattern — convince the AI to perform a privileged identity action that a human agent would have flagged — applies to any LLM wired to tools that mutate state. In MITRE ATLAS terms: LLM Prompt Injection → Privilege Escalation via Tool Use. In ATT&CK terms: Account Manipulation (T1098) and Account Access Removal (T1531), executed through a non-human intermediary.

    The Meta incident is not isolated. Claude Code's MCP integration layer has documented weaknesses: MCP servers run with over-privileged access to filesystem, shell, and cloud credentials. A vulnerability in the MCP client is a vulnerability in everything the client was trusted to touch. OpenAI shipping Lockdown Mode — which works by disabling capabilities rather than hardening them — is the vendor admitting the prompt-injection attack class has no clean technical fix.

    SurfaceAttack PatternStatusDefense Priority
    LLM-fronted IAM/supportSocial-engineered identity mutationExploited in wildCritical
    Claude Code MCP serversOver-privileged tool access via trusted dev toolDemonstratedHigh
    ChatGPT connectorsPrompt-injection-driven exfiltrationLockdown Mode shipped as mitigationHigh

    Defensive Response

    The fix is architectural. Any flow where an LLM can change email, phone, MFA factor, password, or recovery method requires out-of-band verification or a human reviewer. Treat the AI as an unauthenticated requester regardless of session context.

    For Claude Code specifically: MCP servers must be allowlisted, signed, and scoped to least privilege. Default-allow posture for MCP is over. The bypassPermissions and dontAsk modes that suppress interactive approval must be blocked on any endpoint holding production credentials.

    Action items

    • Audit every LLM-fronted support/IAM flow for ability to mutate identity state and require human-in-the-loop or OOB verification for account recovery actions
    • Allowlist and sign all MCP servers in Claude Code deployments; enforce least-privilege scopes with no wildcard filesystem or shell access
    • Block Claude Code bypassPermissions and dontAsk modes on any endpoint with production credentials via MDM/EDR policy
    • Add prompt injection, jailbreak, and AI-mediated privilege escalation to quarterly red-team scope

    Sources:The claim: Meta's AI chatbot has been characterized as an account-takeover vector. · Two disclosures, one surface. · Two surfaces worth naming. Claude Code's bypassPermissions mode and Google's TPU 8i. · Three items on the desk this week.

  3. 03

    AI Vendor Security Posture Is Eroding — Lockdown Mode, Cross-Tenant Leaks, NVD Collapse, and IBM Cover-Up Allegations

    monitor

    Four Trust Signals Degrading Simultaneously

    Four pieces of defender infrastructure are weakening in the same cycle: vulnerability data, vendor transparency, AI platform isolation, and patch intelligence.

    1. OpenAI Lockdown Mode: Amputation, Not a Cure

    OpenAI shipped ChatGPT Lockdown Mode globally. The mechanism is disabling capabilities: Deep Research, Agent Mode, internet image fetch, and file downloads are off. Read it as an admission that prompt injection has no clean technical fix. Coverage extends to all personal accounts, free tier included. Enterprise and Team tenants are not explicitly covered in the rollout. DLP and tenant policy stay load-bearing.

    2. Anthropic Suspected Cross-Tenant Exposure

    Anthropic is the subject of a suspected cross-tenant output exposure consistent with a multi-tenant isolation failure during a scaling event. This is unconfirmed. No CVE, no advisory, no named victim. If it validates, prompt data, RAG context, and tool outputs sent to shared Claude inference may have crossed boundaries. That would put every major AI platform vendor at one or more credible cross-tenant or prompt-injection incidents in the last twelve months.

    3. NIST NVD Backlog: Strategic-Planning Failure

    The Commerce Inspector General is direct: "NIST's lack of strategic planning and decisive action have allowed the backlog of unprocessed vulnerabilities to continue growing." Scanners that depend on NVD for CVSS, CPE matching, or CWE classification will exhibit silent coverage gaps on recent CVEs. Compensating feeds: CISA KEV for exploitation-driven prioritization, EPSS for probabilistic scoring, GitHub Security Advisories for OSS.

    4. IBM Breach Cover-Up Allegations

    A former IBM cyber executive, now whistleblower, alleges IBM covered up several data breaches and declined to notify customers. If IBM is in scope — Cloud, Watson, Red Hat OpenShift, Maximo, mainframe, or consulting — treat it as a vendor-risk event now, not after confirmation. Cover-up allegations bear directly on breach-notification clauses, GDPR Art. 33/34 processor duties, and SOC 2 vendor management controls.

    The CVE data used to defend the stack is degrading at the same moment the AI platforms holding the data are failing at isolation. These are not independent events. They compound.

    Princeton Finding: Reliability Is Not Improving

    Princeton's ICML 2026 study finds GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are not meaningfully more reliable than their predecessors. Any AI governance policy that cleared use cases on the basis of 'we'll use the latest model' is treating a marketing claim as a control. Reliability has to be enforced outside the LLM, via deterministic validators and human-in-the-loop gates on irreversible actions.

    Action items

    • Open vendor incident review with Anthropic: request RCA, scope, and tenant-list confirmation; preserve all Claude API/Cowork logs from the suspected window
    • Initiate IBM vendor risk re-attestation: pull contracts, identify breach-notification clauses, request written statement on whistleblower allegations
    • Diversify vulnerability intelligence beyond NVD: add CISA KEV, EPSS, and GitHub Security Advisories as primary feeds in VM pipeline
    • Mandate ChatGPT Lockdown Mode for high-sensitivity users (execs, legal, M&A, IR) and update AI acceptable-use policy
    • Add explicit 'agent reliability ceiling' clause to AI use-case approvals: irreversible decisions require deterministic validation outside the LLM

    Sources:Two disclosures, one surface. · Two items this week, weighted differently. · Three items on the desk this week. · AI vulnerability discovery is outpacing vendor patches

◆ QUICK HITS

Quick hits

  • Update: AI-discovered vulnerabilities now production-grade — single AI agent found 21 FFmpeg zero-days in one research cycle, validating structural compression of disclosure-to-exploit windows previously flagged

    Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs

  • Cloudflare reports bots now outnumber humans on the open web — residential-IP reputation as sole trust signal is obsolete; Bright Data iOS SDK turns consumer devices into scraping exit nodes

    The claim: Meta's AI chatbot has been characterized as an account-takeover vector.

  • GitHub Copilot switched to usage-based billing June 1 — stolen developer tokens now cause financial DoS via Opus/GPT routing; reclassify PATs as financially sensitive credentials

    GitHub is now seeing seventeen million agent-authored pull requests per month.

  • NSA has ~6 Anthropic engineers embedded deploying Mythos for offensive cyber operations under Project Glasswing — assume nation-state phishing fluency has been structurally uplifted

    Three items on the desk this week.

  • Project Glasswing expanded to 150 critical-infrastructure companies — your OT/ICS vendors are being scanned for vulnerabilities at AI scale; update vendor questionnaires to require disclosure of participation

    AI vulnerability discovery is outpacing vendor patches

  • OpenAI merging Codex into ChatGPT — DLP/CASB rules scoped to Codex-specific endpoints will go blind; generalize monitoring to all chat.openai.com traffic before merger lands

    Two shifts this week. Neither is a breach.

  • Google paying SpaceX $920M/month for 110K GPUs; Anthropic paying $1.25B/month for Colossus 1 — map AI workload dependencies on SpaceX-operated infrastructure before it becomes single point of failure

    Three items on the desk this week.

  • Weaponized AI tooling now a commodity SKU on ransomware forums with vendor-like business models — retire phishing detections relying on spelling/grammar tells

    AI vulnerability discovery is outpacing vendor patches

◆ Bottom line

The take.

Three simultaneous critical events define this week: an unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos and 50+ npm packages, and the first confirmed LLM-mediated account takeover against a major platform (Meta/Instagram). The AI stack your engineers shipped without a security review is now the attack surface, the vulnerability data you depend on (NVD) is officially degrading, and the vendor trust model (Anthropic cross-tenant leak, IBM cover-up allegations) is fracturing. Treat this as an incident sprint: lock down the SD-WAN management plane, audit dependencies against Miasma IOCs, and quarantine any LLM with the ability to mutate identity state.

— Promit, reading as Security ·

Frequently asked

What compensating controls should I apply for the unpatched Cisco SD-WAN Manager flaw?
Restrict admin and API interfaces to jump-host-only access via ACL, remove the management interface from direct internet exposure if possible, and enable enhanced audit logging with hunt queries for anomalous admin session creation and configuration push events. Subscribe to Cisco PSIRT for patch notification. With no patch available for CVE-2026-20245, compensating controls are the entire defense.
How do I determine if my CI pipelines ingested Miasma or IronWorm payloads?
Diff your SBOM against published Miasma and IronWorm IOC lists for any npm package installed or updated in the last 14 days. For matches, rotate npm publish tokens, GitHub PATs, CI runner cloud credentials, SSH keys, and any secrets exposed to those builds. Enforce npm ci with locked versions, enable provenance verification, and quarantine suspect packages at the proxy registry layer.
Why does the Meta chatbot Instagram takeover matter beyond that one platform?
It's the first in-the-wild proof that an LLM wired to identity-mutation tools can be socially engineered into performing account takeover on the attacker's behalf — prompt-as-privilege-escalation. The same architecture exists in most AI-fronted support and IAM deployments, so any flow where an LLM can change email, phone, MFA factor, password, or recovery method needs out-of-band verification or human review.
If NVD coverage is degrading, what feeds should I prioritize for vulnerability management?
Layer CISA KEV for exploitation-driven prioritization, EPSS for probabilistic exploit scoring, and GitHub Security Advisories for OSS coverage alongside vendor PSIRT feeds. The Commerce IG confirmed NIST's NVD backlog is systemic, so scanners depending on NVD for CVSS, CPE matching, or CWE classification will show silent gaps on recent CVEs until diversified.
How should I harden Claude Code MCP deployments against tool-use abuse?
Allowlist and cryptographically sign all MCP servers, scope them to least privilege with no wildcard filesystem or shell access, and block bypassPermissions and dontAsk modes on any endpoint holding production credentials via MDM or EDR policy. MCP servers frequently run with over-privileged access, so a compromise of the client compromises everything it was trusted to touch.

◆ Same day, different angle

Read this day as…

  1. 32 shared

    Two concurrent active-exploitation events with no vendor patch

    This week stacks an unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos a…

  2. 30 shared

    Cisco Catalyst SD-WAN Manager CVE-2026-20245 (CVSS 7.8)

    A self-replicating worm inside Microsoft's own GitHub organizations, a Cisco SD-WAN zero-day under active exploitation with no patch, and Me…

  3. 30 shared

    Two active items this week.

    Your dependency graph is under attack by a self-replicating worm (Miasma, 73 Microsoft repos, 50+ npm packages), your Cisco SD-WAN managemen…

◆ Recent in security

Keep reading.

Spot an error? mail@promitb.dev