The Watch

Two Concurrent Critical Events

Two unrelated incidents are on the desk this morning. A self-replicating supply-chain worm in the npm and GitHub ecosystems, and an unpatched, actively-exploited network management zero-day in Cisco. Neither waits for the other.

Miasma: The First Supply-Chain Worm

Miasma is not the manual package poisoning we have been writing up since event-stream. It is self-replicating worm logic inside package ecosystems. Every install or CI run that pulls a contaminated package becomes a new propagation node. Spread is compounding, not linear.

• 73 GitHub repositories across 4 Microsoft-owned organizations are contaminated
• 50+ npm packages are carrying a Rust-based information stealer; a parallel variant is tracked as IronWorm
• The payload harvests CI tokens, .npmrc credentials, SSH keys, and developer environment secrets — i.e. exactly the credentials needed to push poisoned versions further downstream

Microsoft's own GitHub orgs being hit signals that even platform owners cannot assume their internal repos are isolated from registry-level contagion.

Cisco CVE-2026-20245: No Patch, Active Exploitation

Cisco Catalyst SD-WAN Manager has a CVSS 7.8 vulnerability under active exploitation with no vendor patch. This is the management plane. Compromise means WAN-wide reach across every branch. Defenders are in pure compensating-controls posture until Cisco ships.

SolarWinds Serv-U: KEV Addition

CISA added SolarWinds Serv-U DoS to KEV under active exploitation. A patch is available. This is the second SolarWinds product family requiring KEV-driven remediation recently. Readers of last week's note will recognize the pattern.

Why Miasma Is Different

The reference cases — ua-parser-js, event-stream, colors.js — were single-package, single-actor events. Cleanup was bounded. Miasma introduces worm mechanics: each compromised CI environment propagates to every repo it can write to. Spread is geometric, not linear. If any CI run pulled fresh dependencies in the last 14 days from affected packages, the build pipeline should be treated as potentially compromised.

Five Independent Events, One Conclusion

Five AI-stack incidents landed this week across five vendors. The pattern they describe is consistent: the AI development and inference pipeline is now a first-class attack surface, not a future concern.

The Meta Pattern Generalizes

The Instagram hijack is the cleanest proof of concept. The attacker convinced Meta's AI chatbot to change the email address on high-profile accounts, bypassing the rate limits and human review that traditionally gate identity changes. Call it prompt-as-privilege-escalation. It generalizes to any LLM wired to tools that mutate state: password resets, MFA changes, access grants.

Every LLM connected to a tool that mutates identity, money, or data is now a Tier-1 attack surface. The Meta/Instagram hijack is the proof of concept the board will hear about next.

HuggingFace: The ML Host Problem

The Transformers RCE triggers through model configuration files, artifacts most teams treat as inert metadata. GPU inference hosts are historically the worst-instrumented machines in the enterprise: no EDR, limited egress inspection, provisioned by ML teams outside security review. The 2.2B install figure is the ceiling. Real exposure is every host pulling models from the Hub.

OpenAI's Honest Admission

Lockdown Mode works by amputating capabilities: Deep Research disabled, Agent Mode disabled, internet image fetch blocked, file downloads blocked. That is not a fix; it is an acknowledgment that prompt injection has no clean technical solution. Five sources independently flagging this control as load-bearing for enterprise tenants is the signal.

The Pattern

Trust boundaries that used to be implicit are now exploitable: a model config that was not supposed to be executable, an MCP server that was not supposed to read ~/.aws/credentials, a chatbot that was not supposed to perform identity mutations. Each violation targets a developer mental-model assumption. That is why they work.

The Structural Shift

Three data points from this cycle, taken together, indicate that the working assumption behind patch management — that a patch exists when a vulnerability is disclosed — is degrading.

1. A single AI agent autonomously surfaced 21 zero-days in FFmpeg in one research cycle.
2. Anthropic's Project Glasswing expanded to 150 critical-infrastructure companies, putting AI-scale vulnerability scanning in front of OT/ICS vendors.
3. The Commerce Inspector General formally cited NIST's NVD backlog as a strategic-planning failure. The canonical source of vulnerability metadata is running behind the disclosure curve.

Patch SLAs are not the right defensive metric anymore. AI-driven discovery has outpaced vendor remediation. Security architecture should assume the patch will not arrive on time.

FFmpeg: Broader Than the Label Suggests

FFmpeg is not only a media-server component. It ships inside Slack, browser-side WASM builds, ML preprocessing pipelines, container base images, and mobile apps. Twenty-one zero-days from one AI cycle means the disclosure-to-exploit window for ubiquitous OSS is about to compress. Most teams do not have a complete FFmpeg inventory.

NVD Is No Longer Authoritative

The Commerce IG's wording is direct: "NIST's lack of strategic planning and decisive action have allowed the backlog of unprocessed vulnerabilities to continue growing." Scanners relying on NVD for CVSS, CPE matching, or CWE classification have silent coverage gaps on recent CVEs. Promote the compensating feeds to primary: CISA KEV, EPSS, GitHub Security Advisories, and direct vendor PSIRTs.

AI Offense Is Now Commodity

Publicly, multiple sources confirm AI-augmented offensive tooling has moved from research curiosity to commodity SKU on ransomware forums with vendor-style business models. The skill floor for attacks against the stack has dropped. Detection logic that keys on language tells in phishing — grammar, spelling — is now actively counterproductive.

The Compensating-Control Imperative

The correct response is not faster patching. It is assuming the patch does not arrive and building accordingly. Virtual patching via WAF, RASP, and IPS, runtime exploit prevention, and isolation controls become the primary layer, not the compensating one. That is a budget conversation for next quarter.

The Numbers Are No Longer Experimental

Two measurements crossed from interesting to load-bearing this week:

• GitHub processed 17 million agent-generated pull requests in March 2026 — one month, one platform
• Cloudflare reports bots now outnumber humans on the open web

These are not projections. They are counts. Code review, session-timing alerts, MFA prompts, IP reputation — every one of those controls was tuned to human cadence. The population it now meets is not human.

Code Supply Chain at Agent Scale

Agent-authored PRs are a dominant input to the code supply chain. Most repos already contain non-trivial agent-written code, merged by humans working under review fatigue. Branch protection, SAST, and secrets scanning were sized for thousands of PRs, not millions. The controls still run. The signal-to-volume ratio has inverted.

Copilot Billing: Credentials Are Now Financial

GitHub Copilot moved to usage-based billing on June 1, 2026, with semantic routing across frontier models. A stolen developer PAT no longer just leaks code. It spends money. Rapid model-tier escalation through the semantic router runs up invoices at machine speed. Most SOCs do not alert on Copilot spend anomalies.

The Bot Majority Changes Detection Logic

Cloudflare's traffic data, paired with Bright Data's iOS SDK turning consumer handsets into scraping exit nodes, means residential-IP reputation is degrading as a trust signal. Credential stuffing increasingly originates from consumer ASNs that walk past datacenter blocklists. WAF rules and bot-defense logic that weight IP reputation as the primary signal need rewriting.

The human-in-the-loop assumption is being deprecated as an industry default. Audit which detections depend on human-cadence signals. Build agent-aware variants now.