The Watch

Situation

Two incidents landed the same week and require parallel response. Cisco CVE-2026-20245 (CVSS 7.8) is under active exploitation in Catalyst SD-WAN Manager, with no vendor patch available. Separately, the Miasma worm — self-replicating, supply-chain — has propagated across 73 GitHub repositories inside four Microsoft-owned organizations. A parallel variant tracked as IronWorm has poisoned 50+ legitimate npm packages with a Rust-based information stealer.

This is not a patch cycle. It is compensating controls and forensic triage, in parallel.

Why Miasma Is Different from Prior Supply-Chain Attacks

Manual package poisoning has a linear blast radius. A worm has a compounding one. Every CI run that pulls a contaminated package becomes a new propagation node. The Rust payload harvests CI tokens, .npmrc credentials, SSH keys, and developer environment secrets. Those are precisely the credentials needed to push poisoned versions further down the dependency tree.

Microsoft's own GitHub organizations being hit signals that even platform owners cannot assume their internal repos are isolated from registry-level contagion.

Any organization consuming transitive dependencies from those repos has potential exposure. Self-replication means the IOC list is growing daily, not weekly.

Cisco SD-WAN: Management Plane Exposure

CVE-2026-20245 targets the management plane of Catalyst SD-WAN Manager — the centralized controller that pushes configuration to every branch router. Successful exploitation produces WAN-wide blast radius. With no patch available, the available options are architectural:

• Restrict admin and API interfaces to jump-host-only access via ACL.
• Enable enhanced audit logging and deploy hunt queries for anomalous session creation.
• Monitor configuration-push events originating from unauthorized sessions.

SolarWinds Serv-U (DoS, now on CISA KEV) adds a third item to the immediate queue. That one does have a fix available.

Cross-Incident Pattern

The thread connecting these events is straightforward: management and build infrastructure is the target. SD-WAN Manager controls the network. GitHub repos and npm packages control the software supply chain. Neither is a traditional endpoint. Both carry disproportionate blast radius when compromised. Detection engineering has historically under-invested in both planes, and the adversaries have noticed.

The Pattern

Five independent intelligence sources this cycle converge on the same conclusion: the AI stack your engineering teams assembled over the last 18 months is now a Tier-1 attack surface. Three distinct attack vectors crystallized simultaneously:

The HuggingFace RCE

The trigger path is the model configuration file — something most pipelines treat as inert metadata. Exploitation lands silently on GPU-accelerated inference hosts, which are historically the worst-instrumented machines in the enterprise. No EDR, no egress inspection, high-privilege for compute scheduling. The 2.2 billion install count is the ceiling, but the floor is still enormous for any organization running ML workloads.

The Meta Chatbot Pattern

Attackers convinced Meta's AI chatbot to change the email address on high-profile Instagram accounts, bypassing human review and rate-limit logic. This is prompt-as-privilege-escalation — the attacker didn't breach the account; they convinced the chatbot to do it for them.

Every LLM connected to a tool that mutates identity, money, or data is now a Tier-1 attack surface. The Meta/Instagram hijack is the proof of concept the board will hear about next.

This pattern generalizes immediately to any organization that has wired an LLM into account recovery, helpdesk, or identity-proofing flows.

Claude Code MCP + Microsoft's New Taxonomy

Microsoft expanded its AI agent failure-mode taxonomy by seven new attack categories this week — meaning every agentic deployment shipped in the last 12 months was threat-modeled against an incomplete framework. Claude Code's MCP protocol gives models tools, files, and credentials. A vulnerability in the client is a vulnerability in everything the client was trusted to touch.

OpenAI's Response: Lockdown Mode

OpenAI shipped Lockdown Mode globally — the first vendor-shipped mitigation against prompt-injection-driven exfiltration. It works by amputating capabilities: Deep Research, Agent Mode, internet image fetch, and file downloads are all disabled. This is an honest admission that prompt injection has no clean technical fix. Enterprise/Team tenants are not explicitly covered in the rollout.

Three Trends Converging

The assumption that a patch exists when a vulnerability is disclosed is breaking on three fronts at once:

1. AI discovery velocity: One vendor's AI agent autonomously surfaced 21 zero-days in FFmpeg in a single research cycle. Anthropic's Project Glasswing just widened to 150 critical-infrastructure companies, alongside OpenAI's tooling and the next frontier-model wave informally called 'son of Mythos.'
2. NVD metadata collapse: The Commerce IG labeled NIST's NVD backlog a "strategic-planning failure." Scanners that depend on NVD for CVSS, CPE matching, or CWE classification will produce silent coverage gaps on recent CVEs. That is the operating reality, not a forecast.
3. Weaponized AI goes commodity: Offensive AI tooling now ships as a productized SKU on ransomware marketplaces, with vendor-style support models. The skill floor for attacks has dropped.

Patch SLAs are no longer the right defensive metric. AI-driven discovery has structurally outpaced vendor remediation, and security architecture needs to assume the patch may never arrive on time.

The FFmpeg Case Study

FFmpeg sits in nearly every enterprise video path: Slack, Teams, browser-side WASM, ML preprocessing, CDN tooling. Most security teams cannot enumerate where FFmpeg runs in their estate. Twenty-one simultaneous zero-days means the exposed surface is large and the patch playbook does not yet exist. This is the preview for what AI-scale discovery does to every ubiquitous OSS library.

Compensating Intelligence Sources

With NVD degrading, diversify now:

The Operational Shift

The Cisco zero-day with no patch, the 21 FFmpeg zero-days with patches staging, and the Glasswing expansion all point at the same conclusion: virtual patching must become the primary control, not the compensating one. WAF, RASP, IPS, and runtime exploit prevention need coverage on every internet-facing asset and tier-1 vendor application.

The Bright Data disclosure — consumer iOS apps and smart TVs silently repurposed as web-scraping exit nodes — adds a second axis. Residential-IP reputation as a trust signal is degrading. Credential stuffing and exploitation traffic increasingly originate from consumer ASNs that walk past datacenter-IP blocklists.