The Watch

Two Critical Events, One Response Window

Two unrelated campaigns, one patch window. CVE-2026-20245 in Cisco Catalyst SD-WAN Manager is under active exploitation at CVSS 7.8 with no vendor patch available. In parallel, the Miasma worm, a self-replicating supply-chain attack rather than manual package poisoning, has contaminated 73 repositories across four Microsoft-owned GitHub organizations. A sibling variant tracked as IronWorm has poisoned more than 50 legitimate npm packages.

Cisco SD-WAN: Management Plane at Risk

The bug sits in the management plane of Catalyst SD-WAN Manager. Successful exploitation produces a WAN-wide blast radius across the entire fabric. Without a patch, the available defense is compensating controls: restrict admin and API interfaces to jump-host-only access via ACL, enable enhanced audit logging, and hunt for anomalous administrator session creation and configuration push events. We have written this paragraph for management-plane bugs three times in the last two years. The advice has not changed.

A management-plane compromise in SD-WAN is not a single-host event. It is network-wide control loss. Treat the compensating controls as mandatory, not advisory.

Miasma: Worm Logic in Package Ecosystems

Worm propagation compounds. Manual poisoning is linear; Miasma is compounding. Every CI run that pulls a contaminated package becomes a new propagation node. The Rust-based info-stealer payload targets exactly the credentials needed to keep propagating: CI tokens, .npmrc credentials, SSH keys, and environment secrets.

Microsoft's own organizations being hit indicates that even platform owners cannot assume internal repos are isolated from registry-level contagion. The 50+ npm packages are the downstream vector into customer builds.

SolarWinds Serv-U: KEV Addition

CISA added a SolarWinds Serv-U DoS flaw to KEV under active exploitation. A patch is available. BOD 22-01 timelines apply for FCEB and contractor estates. The simpler item on the list, and still time-bound.

Cross-Incident Pattern

Three attacks hit three infrastructure layers in the same cycle: the network management plane at Cisco, the code supply chain via Miasma and npm, and file transfer at Serv-U. The common thread is not technical. It is temporal. Defenders have to run parallel triage streams without letting any single one consume the incident-response bench.

The Pattern

Four vectors hit the AI stack this cycle. Each one exploits a trust boundary that application teams, building on research-grade libraries, assumed was inert.

1. HuggingFace Transformers RCE (2.2 Billion Installs)

The trigger is a crafted model configuration file. Most pipelines treat config as metadata. It is not. Code execution lands on GPU inference hosts, which are the least-instrumented boxes in the estate. No EDR. Limited egress inspection. Privileged access to training data.

2. Meta AI Chatbot: Prompt-as-Privilege-Escalation

Attackers socially engineered Meta's AI chatbot into changing account email addresses on high-profile Instagram accounts. The model handled a credential-reset request as support dialogue, not as identity proofing. The generalization is straightforward: any LLM wired to tools that mutate identity state inherits this class. MITRE maps it to T1098 (Account Manipulation) executed through a non-human intermediary.

Every LLM connected to a tool that mutates identity, money, or data is now a Tier-1 attack surface. The Meta Instagram hijack is the proof of concept the board will hear about next.

3. Claude Code MCP: Over-Privileged Developer Tooling

MCP (Model Context Protocol) gives Claude Code filesystem, shell, and cloud credentials. Most MCP servers ship default-allow with wildcard access. The threat model is unsettled. A flaw in the client is a flaw in everything the client was trusted to touch. That is a different shape of problem than a bad deserializer.

4. Claude Code bypassPermissions Mode

The mode disables per-action confirmation prompts. The agent reads and writes the filesystem and runs shell commands without human approval. On a host with production credentials, that is an unmonitored insider with shell access. No CVE. The configuration itself is the risk.

Detection Maturity Is the Common Gap

The pattern is consistent. Trust boundaries that used to be implicit are now exploitable. The model config was not supposed to be executable. The MCP server was not supposed to read ~/.aws/credentials. The chatbot was not supposed to change email addresses. All three happened this cycle.

The Structural Shift

A single AI agent autonomously discovered 21 zero-days in FFmpeg in one research cycle. Anthropic's Project Glasswing expanded to 150 critical-infrastructure companies. Weaponized AI tooling has graduated from research curiosity to commodity SKU on ransomware forums with vendor-like business models. And NIST's NVD — the canonical source of vulnerability metadata — was publicly indicted by the Commerce Inspector General as a "strategic-planning failure" with a growing backlog of unprocessed vulnerabilities.

Patch SLAs are no longer the right defensive metric. AI-driven discovery has structurally outpaced vendor remediation, and your security architecture needs to assume the patch may never arrive on time.

The Math Has Changed

The discovery-to-remediation gap is no longer an occasional event (a vendor is slow) — it is a market structure. On the discovery side: AI agents scanning at scale, Glasswing covering 150+ critical-infra firms, and frontier models available to offensive researchers. On the remediation side: same human-paced engineering teams, same QA cycles, same release trains. The gap widens every quarter.

NVD Degradation Compounds the Problem

The Commerce IG's language is direct: NIST's lack of strategic planning has allowed the backlog to grow. If your vulnerability management program depends on NVD for CVSS scoring, CPE matching, or CWE classification, you have silent coverage gaps on recent CVEs. Most teams will discover this in a post-incident review, not on a dashboard.

Compensating intelligence feeds to promote to primary:

• CISA KEV — exploitation-driven prioritization
• EPSS — probabilistic scoring
• GitHub Security Advisories — often beats NVD on OSS
• Direct vendor PSIRTs — source of truth

FFmpeg: Broader Than You Think

21 zero-days in a single ubiquitous library. FFmpeg lives in video conferencing, Slack, browser tabs (ffmpeg-wasm), ML preprocessing pipelines, container base images, and media transcoding services. Most teams cannot produce an authoritative list of where FFmpeg runs in their environment. That inventory gap is the prerequisite for any response.

What This Means for Architecture

If the patch may not arrive for 30+ days after disclosure — and PoC goes public in 48 hours — the primary control must shift from patching to virtual patching. WAF, RASP, IPS, and runtime exploit prevention become the first line, not the compensating control. This is not a temporary posture. It is the new default for any team operating against AI-scale discovery.