Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Daily Threat Intel Brief — 6 October 2026

Executive Summary

Posture: Severe. The known-exploited catalog remains at 1,734 entries, snapshot 2026.10.04 (released 4 October) — no catalog adds dated 5–6 October this run.

• Citrix NetScaler CVE-2026-88779 (Atomic Risk 10) — due TOMORROW Wednesday 7 October; forensic triage Yes; vendor CVSS 8.7; SAML SP/IdP memory overflow → denial of service on unmitigated deployments; vendor-confirmed targeted exploitation; September 88771/88772 fixed builds do not close this row — primary co-lead with Wednesday fuse.
• Fortinet FortiMail CVE-2026-104286 (Atomic Risk 10) — due ELAPSED Sunday 4 October; forensic triage Yes; CVSS 9.8; unauth path traversal + NULL-byte → arbitrary file write; fixed builds 8.0.2 / 7.6.7 / 7.4.9 now SHIPPED (advisory solution update 5 October; release notes confirm CWE-22 closed on 8.0.2 and 7.6.7) — force upgrade now; 7.2 migrate to fixed 7.4+; workaround remains until patched.
• Zammad CVE-2026-102489 + Zammad CVE-2026-102490 (Atomic Risk 10) — due ELAPSED Monday 5 October; forensic triage Yes; CVSS 9.4/9.4; session fixation → RCE as the zammad user, chainable to local privilege escalation to root — force 7.2.0+; confirmed fix for 102490 still not shipped this run (vendor states solution in progress); 7.2.1 released 6 October addresses other issues and does not claim these two catalogued rows.
• Apple CoreGraphics CVE-2026-86950 (Atomic Risk 10) — due ELAPSED Friday 2 October; forensic triage Yes; CVSS 8.8; public crash PoC via crafted PDF with embedded font circulating; sophisticated targeted ITW on iOS before iOS 27 — residual, not closed.
• Cisco Catalyst SD-WAN Manager CVE-2026-76504 (Atomic Risk 10) — due ELAPSED Saturday 3 October; forensic triage Yes; CVSS 9.8; URI/hex auth bypass → unauth admin API; no workaround — residual, not closed.
• Citrix NetScaler CVE-2026-88771 + Citrix NetScaler CVE-2026-88772 (Atomic Risk 10) — due ELAPSED Wednesday 30 September; forensic triage Yes; vendor CVSS 9.5/9.5; vendor-confirmed zero-day ITW continues — keep 88779 distinct.
• WordPress Core CVE-2026-87902 (Atomic Risk 10) — due ELAPSED Monday 28 September; forensic triage Yes; CVSS 8.1; mass opportunistic exploitation post-disclosure.
• Microsoft SharePoint CVE-2026-65660 (Atomic Risk 10) — due ELAPSED Monday 28 September; forensic triage Yes; CVSS 8.8; residual ransomware-Known SharePoint CVE-2026-45659 stays named.
• MikroTik RouterOS CVE-2026-67279 + MikroTrick → MikroTik RouterOS CVE-2026-86060 (Atomic Risk 10) — 67279 due ELAPSED Monday 28 September; FT No on 67279 / FT Yes on 86060; sibling MikroTik RouterOS CVE-2026-67277 residual.
• WSO2 CVE-2026-5430 + Adobe Commerce/Magento CVE-2026-71362 (Atomic Risk 10) — both due ELAPSED Sunday 27 September; FT Yes; CVSS 10.0 / 9.1 — keep StyleSmuggler Magento/Adobe Commerce CVE-2026-75650 distinct.
• Check Point CVE-2026-85102 + Check Point CVE-2026-93616 + F5 BIG-IP APM CVE-2026-94127 + Arista VeloCloud Orchestrator CVE-2026-93952 (Atomic Risk 10) — all due ELAPSED Friday 25 September; FT Yes.
• Artifactory CVE-2026-42018 + Artifactory CVE-2026-42016 + residual Artifactory CVE-2026-82329 (Atomic Risk 10) — Fri 25 elapsed token-chain + earlier FT Yes residual.
• Shai-Hulud 7 Sep reactivation + Mini Shai-Hulud / openapi-react-query-codegen / ChainDrop / Coder registry / crates.io arrayref / yane88 / Miasma (Atomic Risk 9) — named worms auto-elevated; stubs re-verified 6 October; no new self-propagating wave 11 September–6 October.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

1. MemOS / sckit dual-registry worm (23 Sep) — npm @memtensor/memos-cloud-openclaw-plugin 0.1.21/0.1.23/0.1.25 and PyPI MemoryOS 2.0.34 carry a runtime Go stealer that harvests registry, SCM, cloud, SSH, and AI-platform tokens and is built to re-publish. Impact: developer and CI identity takeover, then package fan-out. Atomic Risk 9. Why now: inside last_7_days, install-hook scanners miss it. Veracode: Package Firewall + SCA + SSCI; rotate secrets on any host that imported it.
2. Shai-Hulud family persistence (ChainDrop + Mini Shai-Hulud GitHub reinfection) — ChainDrop poisoned high-download caching packages (keyv, cacheable, siblings; ~2B monthly downloads) with valid provenance; Mini Shai-Hulud payload still landing in GitHub repos this month. Atomic Risk 9. Why now: worms outlive takedowns; lockfiles and Actions remain dirty. Veracode: Package Firewall + SCA + SSCI + Policy.
3. Citrix NetScaler dual KEV RCE (CVE-2026-88771 CVSS 9.8; CVE-2026-88772 CVSS 8.1) — unauthenticated command execution / memory-corruption RCE, exploited before patch, federal due 2026-09-30. Atomic Risk 9. Why now: due today. Veracode: EASM + Risk Manager (KEV) + DAST on apps behind the ADC.
4. TeamCity CVE-2026-63077 now flagged for ransomware use — unauth agent-protocol bypass → OS command as the build-server process; ~160 internet-facing hosts still unpatched. Atomic Risk 9. Why now: last_7_days ransomware flag on a CI/CD crown jewel. Veracode: EASM + Risk Manager + Policy + Container Security / IaC on pipeline artifacts.
5. Internet-facing app RCEs still hot + dark-web volume high — WordPress Core CVE-2026-87902 (KEV, unauth LFI→RCE), Adobe Commerce/Magento StyleSmuggler CVE-2026-75650 (CVSS 10, in-wild RCE + Rust implants) and CVE-2026-71362 (KEV authz bypass); Apple CoreGraphics CVE-2026-86950 added to KEV yesterday (targeted). Qilin / The Gentlemen lead leak-site volume; rival takeover of a major leak site shows Grav/CMS web flaws in criminal infrastructure. Atomic Risk 8. Veracode: EASM + DAST + Risk Manager; SAST + DryRun + Fix for custom/AI storefront and agent code.

Comprehensive Threats Table

MemOS sckit worm (npm + PyPI, 23 Sep)

CVSS: N/A (malware). Exploit status: In-wild worm; runtime trigger. Affected: AI-agent memory packages; CI/dev hosts. Atomic Risk: 9. Immediate mitigation: Pin npm 0.1.20 / PyPI 2.0.33 or remove; treat importers as compromised; rotate tokens; block C2. Veracode Tool Mapping: Package Firewall + SCA + SSCI.

ChainDrop / Shai-Hulud on keyv/cacheable family

CVSS: N/A (malware). Exploit status: Worm; valid provenance. Affected: npm caching stack, 1,300+ versions. Atomic Risk: 9. Immediate mitigation: Purge bad versions from lockfiles/caches; rotate GitHub/npm/cloud tokens; enforce firewall policies. Veracode Tool Mapping: Package Firewall + SCA + SSCI + Policy Management.

Mini Shai-Hulud GitHub reinfection

CVSS: N/A (malware). Exploit status: Ongoing repo infection. Affected: GitHub Actions / cloned repos. Atomic Risk: 8. Immediate mitigation: Hunt hook files and poisoned Actions; revoke PATs; block at install. Veracode Tool Mapping: Package Firewall + SCA + SSCI + Integrations.

CVE-2026-88771 NetScaler input validation RCE

CVSS: 9.8. Exploit status: KEV; exploited pre-patch. Affected: NetScaler ADC/Gateway. Atomic Risk: 9. Immediate mitigation: Patch today; isolate internet-facing appliances; forensic triage. Veracode Tool Mapping: EASM + Risk Manager.

CVE-2026-88772 NetScaler memory RCE/DoS

CVSS: 8.1. Exploit status: KEV; exploited pre-patch. Affected: NetScaler ADC/Gateway. Atomic Risk: 9. Immediate mitigation: Same as above. Veracode Tool Mapping: EASM + Risk Manager.

CVE-2026-63077 TeamCity auth bypass RCE

CVSS: ~9.8. Exploit status: KEV; ransomware use flagged. Affected: TeamCity On-Prem. Atomic Risk: 9. Immediate mitigation: Upgrade 2025.11.7 / 2026.1.3; take off internet; hunt implants. Veracode Tool Mapping: EASM + Risk Manager + Policy Management + Container Security.

CVE-2026-87902 WordPress page-template LFI→RCE

CVSS: 8.1 (9.2 alt). Exploit status: KEV; mass probing after patch. Affected: WordPress Core to 4.7 branches. Atomic Risk: 8. Immediate mitigation: Upgrade 7.1.2 or backports; hunt webshells. Veracode Tool Mapping: EASM + DAST + Risk Manager.

CVE-2026-75650 StyleSmuggler Magento/Commerce RCE

CVSS: 10.0. Exploit status: In-wild zero-day; implants. Affected: Adobe Commerce / Magento 2.4.4–2.4.9. Atomic Risk: 9. Immediate mitigation: Apply emergency hotfix; rotate store secrets; hunt Rust implants. Veracode Tool Mapping: EASM + DAST + Risk Manager.

CVE-2026-71362 Commerce/Magento incorrect authz

CVSS: 9.1. Exploit status: KEV. Affected: Adobe Commerce / Magento / B2B. Atomic Risk: 8. Immediate mitigation: Apply APSB26-92 train; verify authz on admin/API. Veracode Tool Mapping: EASM + DAST + Risk Manager.

CVE-2026-65660 SharePoint code injection

CVSS: High. Exploit status: KEV. Affected: Microsoft SharePoint. Atomic Risk: 8. Immediate mitigation: Patch; restrict external SharePoint; hunt webshells. Veracode Tool Mapping: EASM + DAST + Risk Manager.

CVE-2026-86950 Apple CoreGraphics OOB write

CVSS: 8.8. Exploit status: KEV yesterday; targeted. Affected: iOS/iPadOS/macOS. Atomic Risk: 7. Immediate mitigation: Update iOS/iPadOS 26.7.1, macOS 15.8.1 / 26.7.1. Veracode Tool Mapping: Risk Manager.

CVE-2026-81963 / CVE-2026-85880 Windows EoP

CVSS: 7.8. Exploit status: Exploited; Patch Tuesday. Affected: Windows Update Stack / ALPC. Atomic Risk: 7. Immediate mitigation: Confirm Sept 2026 patches landed. Veracode Tool Mapping: Risk Manager.

OpenCode upgrade-API RCE (GHSA-632h-h47v-g4x4)

CVSS: Critical (local agent). Exploit status: Public advisory; content-type confuse. Affected: OpenCode 1.14.30–1.18.21. Atomic Risk: 7. Immediate mitigation: Upgrade agent; bind UI off LAN; disable unauth local serve. Veracode Tool Mapping: SAST + DryRun + Policy Management.

Vibe-coded IDOR / broken auth / missing authz

CVSS: App-dependent. Exploit status: Research + live apps; residual. Affected: AI-generated web/API. Atomic Risk: 7. Immediate mitigation: Block merge on authz gaps; DeepScan high-churn services. Veracode Tool Mapping: SAST + DryRun + Fix.

Qilin / The Gentlemen / Panzer / INC leak-site surge

CVSS: N/A. Exploit status: Active extortion; OSINT leak sites. Affected: Mid-market + healthcare/tech. Atomic Risk: 8. Immediate mitigation: Assume initial access via creds/KEV/CI; harden identity. Veracode Tool Mapping: Risk Manager + EASM + Package Firewall.

Grav CMS unauth upload used on criminal leak site

CVSS: N/A. Exploit status: OSINT secondary. Affected: Exposed CMS. Atomic Risk: 6. Immediate mitigation: Inventory Grav/CMS on EASM; DAST those apps. Veracode Tool Mapping: EASM + DAST.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

1. Citrix NetScaler ADC/Gateway unauth RCE pair (CVE-2026-88771, CVE-2026-88772) — CVSS 9.5, KEV added 2026-09-27, federal due 2026-09-30, forensic triage required. Impact: total control of the access path (VPN/AAA/gateway). Atomic Risk 10. Why now: confirmed global in-wild use before/with patch; implants can survive a version bump. Veracode: EASM + Risk Manager (KEV).
2. WordPress Core template-include LFI→conditional RCE (CVE-2026-87902) — CVSS 8.1 (v3.1) / 9.2 (v4.0), KEV 2026-09-25, due today 2026-09-28, public exploit path published. Impact: unauthenticated include of local PHP; mass internet blast radius. Atomic Risk 9. Veracode: EASM + DAST + Risk Manager (KEV).
3. SharePoint code injection (CVE-2026-65660) — CVSS 8.8, KEV 2026-09-25, due today. Impact: authorized network attacker → code execution on collaboration estates. Atomic Risk 8. Veracode: EASM + Risk Manager (KEV).
4. Adobe Commerce / Magento storefront RCE + auth-bypass cluster (CVE-2026-75650 CVSS 10.0; CVE-2026-71362 CVSS 9.1, KEV) — in-wild implants (Rust backdoor / PHP web shell) and session-switch. Atomic Risk 9. Veracode: EASM + DAST + Risk Manager (KEV).
5. Supply-chain worms / OSS malware (Shai-Hulud family, Phantom Gyp / binding.gyp, Miasma, Mini Shai-Hulud) — no confirmed new registry worm wave in last_7_days or last_14_days. Residual risk remains first-priority: install-time execution that bypasses lifecycle-script controls, credential worming across npm/PyPI/RubyGems/Go, AI-assistant hook persistence. Atomic Risk 8 (persistent). Veracode: Package Firewall + SCA + SSCI. Dark-web OSINT (secondary): leak-site volume remains high (thousands of claimed victims in 90 days; multiple groups last-seen 2026-09-27/28); stealer-log and initial-access markets remain the ransomware feeder.

Comprehensive Threats Table

NetScaler unauth command injection + buffer RCE (CVE-2026-88771, CVE-2026-88772)

CVSS: 9.5. Exploit status: KEV; in-wild; zero-day. Affected: NetScaler ADC/Gateway (unpatched trains before vendor fixed builds). Atomic Risk: 10. Immediate mitigation: Forensic image first; apply vendor builds; hunt logs/tmp; rotate tokens. Veracode Tool Mapping: EASM + Risk Manager (KEV).

WordPress Core page-template LFI (CVE-2026-87902)

CVSS: 8.1 / 9.2. Exploit status: KEV; public PoC; mass probing. Affected: WordPress Core through 7.1.1; backports to 4.7. Atomic Risk: 9. Immediate mitigation: Patch to 7.1.2 or branch backport today; hunt included PHP / new files. Veracode Tool Mapping: EASM + DAST + Risk Manager (KEV).

SharePoint code injection (CVE-2026-65660)

CVSS: 8.8. Exploit status: KEV. Affected: SharePoint Server 2016/2019/Subscription. Atomic Risk: 8. Immediate mitigation: Patch today; restrict authorized remote admin paths. Veracode Tool Mapping: EASM + Risk Manager (KEV).

MikroTik RouterOS workflow bypass (CVE-2026-67279)

CVSS: ~6.5–6.9. Exploit status: KEV; unauth session/exec chain. Affected: RouterOS. Atomic Risk: 7. Immediate mitigation: Patch; pull management planes off internet. Veracode Tool Mapping: EASM + Risk Manager (KEV).

Adobe Commerce template RCE StyleSmuggler (CVE-2026-75650)

CVSS: 10.0. Exploit status: In-wild; implants. Affected: Commerce / Magento 2.4.4–2.4.9 trains incl. Aug builds until hotfix. Atomic Risk: 9. Immediate mitigation: Emergency hotfix; rotate encryption keys and secrets; hunt implants. Veracode Tool Mapping: EASM + DAST + Risk Manager (KEV).

Adobe Commerce incorrect authorization (CVE-2026-71362)

CVSS: 9.1. Exploit status: KEV; post-disclosure abuse. Affected: Commerce / Magento / B2B. Atomic Risk: 8. Immediate mitigation: Move to Aug security train; session/account review. Veracode Tool Mapping: EASM + DAST + Risk Manager (KEV).

Identity/edge cluster (Check Point, F5 BIG-IP APM, Arista on-prem orchestrator, Cisco ISE)

CVSS: 9.8–10.0. Exploit status: KEV last_7–14d. Affected: VPN, APM/OAuth, SD-WAN orchestrator, ISE. Atomic Risk: 9. Immediate mitigation: Patch exposed control planes; forensic triage where directed. Veracode Tool Mapping: EASM + Risk Manager (KEV).

Shai-Hulud / Mini Shai-Hulud / Miasma / Phantom Gyp residual

CVSS: N/A (malware). Exploit status: Persistent campaign watch; no new 7–14d wave confirmed. Affected: npm, PyPI, RubyGems, Go modules, GitHub Actions. Atomic Risk: 8. Immediate mitigation: Point package managers at firewall; deny malware/typosquat/High-Critical; rotate tokens. Veracode Tool Mapping: Package Firewall + SCA + SSCI.

AI coding-agent Git-config execution (GitSpawn class; CVE-2026-72718 and siblings)

CVSS: 7.0 class. Exploit status: Public research; mixed patch state early Sept. Affected: Claude Code, Codex, Cursor, and peer agents. Atomic Risk: 7. Immediate mitigation: Upgrade agents; do not open untrusted repos; treat agent-written authz as untrusted. Veracode Tool Mapping: SAST + DryRun + Policy Management.

AI-generated / vibe-coded logic flaws (IDOR, broken auth)

CVSS: N/A (class). Exploit status: Repeated research + incident pattern. Affected: Apps built in Cursor, Claude Code, Codex. Atomic Risk: 7. Immediate mitigation: PR-gate SAST; add intent/logic review on authz paths. Veracode Tool Mapping: SAST + DryRun + Fix.

Ransomware leak-site + stealer-log markets

CVSS: N/A. Exploit status: Active OSINT listings. Affected: Enterprise identity, schools, mid-market. Atomic Risk: 7. Immediate mitigation: Assume credential reuse; KEV-prioritize exposed apps. Veracode Tool Mapping: Risk Manager + EASM + Policy Management.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Veracode Threat-to-Control Daily Command Brief | 2026-09-23

Executive Summary

1. MemTensor / sckit dual-ecosystem worm (npm + PyPI, published 2026-09-23) — Malicious versions of @memtensor/memos-cloud-openclaw-plugin (0.1.21, 0.1.23, 0.1.25) and PyPI MemoryOS 2.0.34 ship a Go implant that harvests home-directory credentials and contains self-copy logic into other packages/repos reachable with stolen tokens. Tokens were taken from GitHub Actions release jobs. Atomic Risk 10. Why now: same-day latest tag exposure on an AI-agent memory plugin; worm-class blast radius. Strong Veracode applicability: Package Firewall + SCA + SSCI.
2. Four KEV additions dated 2026-09-22, federal due 2026-09-25 — Check Point Gateway/Spark VPN RCE CVE-2026-85102 (9.8, exploited against Spark from ~2026-09-12); Check Point Management pre-auth path traversal CVE-2026-93616 (9.8, exploited as far back as 2026-07-23); F5 BIG-IP APM unauth heap-overflow RCE CVE-2026-94127 (9.8, vendor-confirmed in the wild); Arista on-prem VeloCloud Orchestrator CVE-2026-93952 (10.0, vendor-confirmed exploited). Atomic Risk 10. Why now: three-day due window and internet-facing identity/SD-WAN control planes. Strong applicability: EASM + Risk Manager (KEV) + Policy Management.
3. Underground extortion feud + claimed PeopleSoft zero-day — Public OSINT secondary reporting: one extortion crew seized a rival leak site (2026-09-19–21) and claims a new Oracle PeopleSoft RCE used against a U.S. federal recruiting stack, with 2–3 TB alleged. Prior PeopleSoft Environment Management RCE CVE-2026-35273 (9.8) was already mass-exploited mid-2026. Atomic Risk 9. Why now: leak-site chaos raises dump/reuse risk; PeopleSoft remains a high-value internet-facing HR/ERP surface. Applicability: EASM + DAST + Risk Manager.
4. D-Link DIR-822A CVE-2026-86296 (CVSS 10.0) + CVE-2026-86510 — Unauth stack overflow in DHCP/udhcpcd with public PoC; vendor investigating, no fix at disclosure; second public-PoC OOB-write on L2TP. Atomic Risk 8 for environments that still run this model. Applicability: EASM + Risk Manager + Policy Management.
5. BigDiskBuster Defender update-block PoC (2026-09-22) — Public tool fills disk during Defender platform/signature updates so definitions go stale while the product still "runs." No CVE/patch at disclosure. Atomic Risk 7 as a post-foothold enabler, not an initial remote vector. Applicability: Risk Manager + Policy Management.

Comprehensive Threats Table

Full analysis, recommendations, and action plan continue in the comments below.

The Secretaria de Estado de Fazenda de Minas Gerais (SEF/MG), Brazil's Minas Gerais state revenue department, has published its application security journey with Veracode — and there's a lot here for anyone scaling AppSec across a large development organization.

With 300 developers and a significant legacy footprint, SEF/MG needed to move from catching vulnerabilities right before production to finding them during development. They integrated Veracode Static Analysis and Software Composition Analysis directly into their GitLab and Azure DevOps pipelines via API, and paired it with Veracode eLearning to build security skills across the team.

Highlights from the case study:

• 99.6% scan coverage (283 of 284 repositories)
• Policy compliance up from 10.5% to 49.6%, peaking at 73.5%
• Mean time to remediate of roughly 40 days
• 100% developer adoption of automated scanning
• Strengthened support for ISO 27001, LGPD, and CIS

Read the full case study here:

https://www.veracode.com/case-studies/sef-mg-devsecops-veracode/

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

1. ChainDrop / Shai-Hulud fourth-wave npm worm (keyv / cacheable family) — Self-propagating install-time credential worm still in the 7–14 day operational window. Hundreds of packages, combined reach on the order of 2 billion monthly installs. Atomic Risk 10. First principles: one stolen maintainer token plus CI publish rights equals autonomous republish across the graph; provenance/SLSA did not stop it. Strong Veracode applicability: Package Firewall + SCA + SSCI + Risk Manager.
2. PaperCut NG/MF pre-auth RCE chain (CVE-2026-81578 + CVE-2026-82078) — Zero-day exploitation confirmed from 2026-08-26; emergency patches on 2026-08-27/28. Auth bypass (8.8) chained to unsafe dynamic class loading (9.8) → unauthenticated RCE on the print-management server. Atomic Risk 9. Print servers are high-privilege, often internet-adjacent, historically used as ransomware beachheads. EASM + Risk Manager + DAST + Policy Management.
3. CISA KEV surge 2026-08-26/27 — New catalog entries include JFrog Artifactory path write (CVE-2026-66384), ownCloud pre-auth file access (CVE-2023-49105, CVSS 9.8), Linux kernel IPv6 privilege escalation (CVE-2026-53362), plus the prior-week Citrix NetScaler (CVE-2026-8452) and SQL Server RCE (CVE-2019-1068) batch. Atomic Risk 8. Artifact registries and file-sync platforms sit on the same trust path as SCA. Risk Manager (KEV) + SCA + Container Security + EASM.
4. On-prem SharePoint unauth RCE chain (CVE-2026-55040 + CVE-2026-63520) and Metabase pre-auth SQLi-to-RCE (CVE-2026-72898, CVSS 10) — Public exploit code in circulation; SharePoint already KEV. Atomic Risk 9 / 8. These are internet-facing application control planes. DAST + EASM + Risk Manager + SAST + Fix.
5. Ransomware + dark-web OSINT (secondary reporting only) — Qilin publicly claimed a U.S. federal firearms/explosives agency system; Medusa advisory update documents 500+ critical-infrastructure victims; leak-site volume remains high (The Gentlemen, Akira, DragonForce, new brands Emperador / iah6477). Atomic Risk 8. Initial access remains unpatched edge + stolen creds + OSS worms. Risk Manager + EASM + Package Firewall + Policy Management.

Comprehensive Threats

ChainDrop / Shai-Hulud 4th wave (keyv, flat-cache, file-entry-cache, cacheable, cache-manager, ecto + 400–1,280+ downstream packages)

CVSS: N/A (malware). Exploit status: in-wild worm; install-time preinstall + Bun second stage; stolen npm tokens republish. Affected: npm graph, CI runners, developer workstations, org-scoped packages. Atomic Risk: 10. Immediate mitigation: pin known-good versions; block malicious versions at ingest; rotate npm/GitHub/cloud/K8s/Vault tokens; rebuild from clean lockfiles; hunt .claude/, .vscode/tasks.json, setup.mjs, binding.gyp. Veracode Tool Mapping: Package Firewall + SCA + SSCI.

PaperCut NG/MF chain CVE-2026-81578 + CVE-2026-82078

CVSS: 8.8 / 9.8. Exploit status: actively exploited from 2026-08-26; emergency patch release 2. Affected: all NG/MF prior to v24/v25/v26 Emergency Patch Release 2. Atomic Risk: 9. Immediate mitigation: pull Application Server off the internet; apply Emergency Patch Release 2; hunt IoCs and dropped Java classes; assume compromise if previously exposed. Veracode Tool Mapping: EASM + Risk Manager + DAST + Policy Management.

SharePoint JWT bypass + RCE CVE-2026-55040 + CVE-2026-63520

CVSS: High / Critical. Exploit status: KEV; public exploit for unauth RCE chain on-prem 2016/2019/Subscription. Affected: on-prem SharePoint. Atomic Risk: 9. Immediate mitigation: apply both patches; remove internet exposure; rotate farm secrets; hunt webshells. Veracode Tool Mapping: EASM + DAST + Risk Manager (KEV).

FortiClient EMS CVE-2026-35616

CVSS: 9.1–9.8. Exploit status: KEV; ongoing use to drop infostealer via EMS control plane. Affected: FortiClient EMS 7.4.5–7.4.6 (and related 7.x). Atomic Risk: 8. Immediate mitigation: hotfix immediately; no public EMS; rotate endpoint/VPN creds; treat managed fleet as potentially scripted. Veracode Tool Mapping: EASM + Risk Manager (KEV).

Metabase password-reset SQLi CVE-2026-72898

CVSS: 10.0. Exploit status: public exploit to RCE (H2 default and Postgres); KEV-class activity. Affected: exposed Metabase. Atomic Risk: 8. Immediate mitigation: patch; take password-reset off the internet; rotate DB and app secrets. Veracode Tool Mapping: EASM + DAST + Risk Manager.

ownCloud WebDAV pre-signed URL auth bypass CVE-2023-49105

CVSS: 9.8. Exploit status: KEV added 2026-08-27 (due 2026-08-30). Affected: ownCloud ≥10.6.0 without signing key. Atomic Risk: 8. Immediate mitigation: patch or disable unsigned pre-signed URLs; assume file read/write/delete if username known. Veracode Tool Mapping: EASM + Risk Manager (KEV) + DAST.

JFrog Artifactory path restriction CVE-2026-66384

CVSS: 5.3 (KEV). Exploit status: KEV added 2026-08-27 (due 2026-09-10). Affected: Artifactory Docker cache / remote-repo write. Atomic Risk: 7. Immediate mitigation: vendor mitigation; treat as artifact-integrity event; rescan consumed images/packages. Veracode Tool Mapping: SCA + Package Firewall + Container Security + Risk Manager (KEV).

Linux kernel IPv6 CVE-2026-53362

CVSS: 7.8. Exploit status: KEV added 2026-08-27 (due 2026-08-30); forensic triage flagged. Affected: Linux distributions using vulnerable IPv6 path. Atomic Risk: 7. Immediate mitigation: kernel update across fleet and container base images. Veracode Tool Mapping: Container Security + Risk Manager (KEV).

Citrix NetScaler ADC/Gateway CVE-2026-8452

CVSS: High. Exploit status: KEV added 2026-08-26. Affected: NetScaler ADC / Gateway. Atomic Risk: 8. Immediate mitigation: vendor fix; pull management/data plane off public internet if unpatched. Veracode Tool Mapping: EASM + Risk Manager (KEV).

Microsoft SQL Server CVE-2019-1068

CVSS: High. Exploit status: KEV added 2026-08-26. Affected: SQL Server Database Engine. Atomic Risk: 7. Immediate mitigation: patch engine; restrict network path to SQL; credential hygiene. Veracode Tool Mapping: Risk Manager (KEV) + Policy Management.

Windows afd.sys Lazarus zero-day CVE-2026-68820

CVSS: 7.0. Exploit status: exploited in-wild (nation-state); patched Aug 2026 Patch Tuesday; KEV. Affected: Windows (local EoP to SYSTEM after code execution). Atomic Risk: 7. Immediate mitigation: confirm August 2026 OS patches; hunt kernel rootkit/FudModule-class persistence. Veracode Tool Mapping: Risk Manager (KEV).

SPIP unauth RCE CVE-2026-77647

CVSS: Critical. Exploit status: exploited as zero-day; public exploit. Affected: SPIP CMS. Atomic Risk: 8. Immediate mitigation: patch or isolate CMS; hunt webshells. Veracode Tool Mapping: EASM + DAST + Risk Manager.

Ajax.NET Professional deserialization CVE-2021-23758

CVSS: 8.1–9.8. Exploit status: KEV 2026-08-26. Affected: apps embedding AjaxPro. Atomic Risk: 7. Immediate mitigation: remove/replace library; SAST/SCA find usages. Veracode Tool Mapping: SCA + SAST + Veracode Fix + Risk Manager (KEV).

Qilin / Medusa / Gentlemen / Akira ransomware + new leak-site brands

CVSS: N/A. Exploit status: active leak-site claims; Medusa 500+ CI victims; Qilin federal-agency claim. Affected: edge, identity, backups, healthcare, gov, manufacturing. Atomic Risk: 8. Immediate mitigation: patch KEV/edge; MFA; segment; immutable backups; hunt broker access. Veracode Tool Mapping: Risk Manager + EASM + Policy Management.

Dark-web OSINT: new extortion brands (Emperador, iah6477), XSS forum infra shift, French SDIS multi-org claims, stealer-log credential markets

CVSS: N/A. Exploit status: secondary OSINT only — leak-site and forum reporting, not independently validated datasets. Affected: identity, emergency services, enterprise creds. Atomic Risk: 7. Immediate mitigation: assume credential reuse; force rotation on exposed identities; raise Risk Manager urgency on KEV + identity findings. Veracode Tool Mapping: Risk Manager + EASM.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

Persistent high-blast-radius npm supply-chain worm activity (ChainDrop / Shai-Hulud family variants) continues to dominate, with credential-stealing self-propagating malware that compromised high-download packages and cascaded across hundreds of artifacts totaling billions of monthly installs; Atomic Risk 10. This remains the top immediate threat because of automatic propagation via stolen maintainer tokens and CI secrets, enabling rapid ecosystem-wide compromise of developer tooling and downstream applications. Strong Veracode applicability via Package Firewall + SCA + SSCI.

Actively exploited Windows kernel privilege-escalation zero-day (CVE-2026-68820) added to KEV and leveraged in nation-state campaigns for SYSTEM access and rootkit deployment; Atomic Risk 9. First-principles impact is local escalation that converts any foothold into full host control. Strong Risk Manager (KEV) + Policy Management fit.

Critical unauthenticated SQLi in Metabase (CVE-2026-72898, CVSS 10.0) under active exploitation granting database admin and credential theft from connected data sources; Atomic Risk 9. Self-hosted instances remain exposed at scale. Risk Manager (KEV) + DAST/EASM prioritization.

VMware vCenter critical RCE (CVE-2026-59310, CVSS 9.8) under active exploitation leading to reverse shells, lateral movement, and ransomware deployment across hundreds of instances; Atomic Risk 9. Container Security + Risk Manager + EASM.

Secondary dark-web/underground signals (OSINT reporting only) show continued high volume of stealer-log credential dumps, enterprise Azure/Entra directory harvests, and ransomware leak-site activity tied to ongoing campaigns. These amplify urgency for identity and supply-chain controls.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

npm ChainDrop / Shai-Hulud Family Worm

Root cause is compromised maintainer GitHub accounts used to push malicious releases carrying preinstall droppers (or binding.gyp / Phantom Gyp variants in related waves) that execute on npm install. Mechanism: harvest hundreds of credential types (npm/GitHub/cloud/CI/AI-tool tokens), exfiltrate (including via blockchain C2 in some variants), then use stolen tokens to republish poisoned versions of any packages the victim controls — creating automatic worm propagation.

Blast radius is extreme: core packages alone exceed hundreds of millions of weekly downloads and appear in a large percentage of cloud environments; secondary infections reach organizational packages. Dark-web amplification risk exists via stolen secrets fueling further campaigns.

Veracode Control Point: Package Firewall blocks known-malicious and high-risk packages at the registry/policy layer before install; SCA + SSCI continuously monitors dependency graphs and proprietary threat feed for worm signatures and newly compromised artifacts; Risk Manager elevates the finding for immediate remediation.

CVE-2026-68820 — Windows Kernel Privilege Escalation (afd.sys UAF)

Root cause is a use-after-free race condition in the Windows Ancillary Function Driver for WinSock (afd.sys). Mechanism: low-privilege local attacker triggers the race to achieve SYSTEM. Already chained in nation-state operations for kernel rootkits. Blast radius is any Windows endpoint or server with a foothold.

Veracode Control Point: Risk Manager surfaces the KEV entry with unified prioritization and due-date context; Policy Management enforces rapid remediation SLAs across the portfolio.

CVE-2026-72898 — Metabase Unauthenticated SQLi (CVSS 10.0)

Root cause is improper input handling in Metabase's password-reset endpoint allowing unauthenticated SQL injection that yields application-database administrator access (including credentials for connected data sources). Mechanism enables full data exfiltration and further lateral movement. Thousands of self-hosted instances were still vulnerable post-disclosure.

Veracode Control Point: Risk Manager (KEV) for prioritization; DAST for runtime confirmation of exposed instances; EASM for discovery of public-facing Metabase.

CVE-2026-59310 — VMware vCenter Syslog Directory Traversal RCE (CVSS 9.8)

Root cause is directory traversal in the vCenter Syslog server enabling unauthenticated remote code execution. Mechanism leads to reverse shells, new admin accounts, credential theft from vmdir, ESXi lateral movement, and ransomware. Hundreds of instances compromised within days of disclosure.

Veracode Control Point: Container Security for vSphere/K8s-adjacent posture; EASM for exposed management interfaces; Risk Manager for urgency scoring.

Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

The dominant high-blast-radius threat remains the active self-propagating npm supply-chain worm campaign (Shai-Hulud / Mini Shai-Hulud / ChainDrop lineage and related Miasma/Phantom Gyp variants). In the last 7 days a single compromised maintainer account triggered rapid infection of hundreds to over 1,200 packages (including high-download caching libraries) totaling billions of monthly installs; the worm executes at install time, steals developer/CI/cloud credentials, and self-propagates while carrying valid provenance. Atomic Risk 10. First-principles impact: any organization pulling npm packages in the last week faces potential credential compromise and further package poisoning; Veracode Package Firewall + SCA + SSCI provides the direct control point to block malicious packages and surface proprietary threat intelligence.

Multiple critical unauthenticated RCE and authentication-bypass CVEs were added to the KEV catalog in the last 7 days (Progress LoadMaster, JetBrains TeamCity, IBM Langflow, N-able N-central). Atomic Risk 9. These enable immediate remote takeover of internet-facing or management systems and map directly to Risk Manager prioritization plus EASM discovery.

Ransomware activity remains elevated with splintering groups, active exploitation of VPN/appliance flaws, and social-engineering vectors leading to encryption; dark-web secondary OSINT shows continued leak-site postings and stealer-log circulation. Atomic Risk 8. Strong Veracode applicability across SCA, Risk Manager, EASM, and Policy Management for rapid prioritization and governance.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

npm Supply-Chain Worm (Shai-Hulud Lineage)

Root cause: Compromised legitimate maintainer GitHub/npm credentials allow automated republication of packages containing install-time execution (preinstall scripts or binding.gyp / node-gyp abuse). Mechanism: Payload harvests broad credential classes (npm, GitHub, cloud, Kubernetes, SSH, CI secrets), then uses stolen tokens to infect additional packages under the same or related maintainers, achieving worm-like spread within hours. Valid SLSA provenance is generated because the build runs through legitimate workflows.

Blast radius: Packages present in a large percentage of cloud and enterprise environments; any npm install of an affected version executes the stealer before application code runs. Propagation risk is extreme because downstream transitive dependencies amplify reach.

Veracode Control Point: Package Firewall blocks known-malicious and high-risk packages at the point of ingestion; SCA continuously scans dependency trees and flags the specific versions; SSCI supplies proprietary threat-feed context that elevates these packages above generic CVE scoring for immediate policy enforcement.

Recent KEV Unauthenticated RCEs (LoadMaster, TeamCity, Langflow)

Root cause: Insufficient input sanitization or deserialization of untrusted data on management/agent endpoints with no authentication required. Mechanism: Network-reachable crafted requests yield full code execution or admin takeover. Blast radius: Internet-exposed instances (common for these products) become immediate footholds for ransomware or data theft.

Veracode Control Point: Risk Manager ingests KEV status and applies elevated priority scoring with due-date context; EASM discovers external exposure of the affected products so remediation can be forced on the highest-risk assets first.

Ransomware & Dark-Web Signals

Root cause: Combination of appliance zero-days / incomplete patches plus social engineering (Teams vishing) and ready-made RaaS tooling. Mechanism: Initial access → credential dumping → rapid encryption or data exfiltration to leak sites. Dark-web secondary reporting confirms elevated leak-site postings and stealer-log circulation, increasing the value of any compromised credentials.

Veracode Control Point: Risk Manager unifies KEV and dark-web-informed urgency into a single prioritized queue; Policy Management enforces consistent blocking and remediation SLAs across SCA, SAST, and container findings.