ClarityBeta

Security & Threat Intelligence

The Watch

6 min read · 1,184 words · 3 moves to watch
The Signal

CVE-2026-20245 in Cisco Catalyst SD-WAN Manager is being exploited in the wild.

No patch yet. The Miasma worm has hit 73 Microsoft-owned GitHub repos and 50-plus npm packages in the last 14 days, dropping a Rust infostealer; self-replicating npm worms are now an annual genre.

In Play

  1. Unpatched Cisco Zero-Day + SolarWinds KEV Under Active Exploitation

    Cisco CVE-2026-20245 (CVSS 7.8) in Catalyst SD-WAN Manager is actively exploited with no patch available — defenders are in compensating-controls-only posture on an internet-adjacent management plane. SolarWinds Serv-U DoS also added to CISA KEV. Both require immediate action today.

    Ask Clarity

  2. Self-Replicating Supply-Chain Worms Hit Microsoft GitHub + 50+ npm Packages

    Miasma is a self-replicating worm — not manual package poisoning — that hit 73 Microsoft GitHub repos across 4 orgs. A parallel variant plus IronWorm contaminated 50+ npm packages with a Rust-based infostealer harvesting CI tokens, SSH keys, and .npmrc credentials. Every compromised install becomes a new propagation node.

    Ask Clarity

  3. AI Platform Trust Boundaries Collapsing: HuggingFace RCE, Meta Chatbot Hijack, Anthropic Leak

    Five concurrent AI platform security events: HuggingFace Transformers RCE (2.2B installs) via model configs, Meta's AI chatbot social-engineered into account takeover, Claude Code MCP vulnerabilities, suspected Anthropic cross-tenant data leak, and OpenAI shipping Lockdown Mode as an admission that prompt-injection exfiltration is a live attack chain.

    Ask Clarity

  4. Structural Defense Model Breaking: AI Discovery Rate, NVD Collapse, 17M Agent PRs

    AI vulnerability discovery has structurally outpaced patch capacity (21 FFmpeg zero-days from one AI agent in one cycle). The NVD backlog is officially called a 'strategic-planning failure' by the Commerce IG. Meanwhile, 17M agent-authored PRs/month on GitHub overwhelm human code review. Patch-cycle thinking is obsolete.

    Ask Clarity

  5. IBM Breach Cover-Up Allegations + Vendor Governance Shifts

    IBM whistleblower alleges multiple undisclosed data breaches — a vendor-risk event for any org with IBM in the supply chain (Cloud, Watson, Red Hat, Maximo, mainframe). Simultaneously, OpenAI merges Codex into ChatGPT, collapsing two threat models into one auth boundary, and Copilot's June 1 usage-based billing creates a financial attack surface tied to stolen developer credentials.

    Ask Clarity

Deep Dives

Incident Sprint: Cisco Zero-Day Without a Patch + Self-Replicating Worms Inside Microsoft's GitHub

Two Concurrent Critical Events — Same Week, Different Kill Chains

Two active-exploitation stories landed in the same window and both demand response now. Cisco confirmed in-the-wild exploitation of CVE-2026-20245 (CVSS 7.8) in Catalyst SD-WAN Manager. No patch. Defenders get compensating controls and prayer against an internet-adjacent management plane whose compromise hands an attacker WAN-wide reach into every branch. We have flagged exactly this class of management-plane bug before. The pattern is not new. The absence of a fix is the part worth staring at. No vendor patch available is doing a lot of work in that sentence.

Running concurrently: the Miasma worm, which is self-replicating supply-chain code, not the usual hand-rolled package poisoning. It hit 73 GitHub repositories across four of Microsoft's own organizations. A related strain plus IronWorm reached more than 50 legitimate npm packages carrying a Rust-based info-stealer. The payload pulls CI tokens, .npmrc credentials, SSH keys, and developer environment secrets. Those are the exact credentials required to publish the next poisoned version.

Every install or CI run that pulls a contaminated package becomes a new propagation node. This is compounding, not linear. The worm has arrived in package ecosystems.

Why the Worm Pattern Is a Category Shift

Hand-poisoned packages produce a linear victim count. One package, one blast. A self-replicating worm compounds. The Microsoft repos detail matters: if platform owners cannot keep their internal repositories clean of registry-level contagion, smaller shops should not pretend they can. SolarWinds Serv-U is back on CISA KEV under active exploitation in the same week, which makes three concurrent patching obligations on the desk.

Defensive Priority Matrix

IncidentPatch StatusYour ExposureAction Window
Cisco SD-WAN CVE-2026-20245None availableAny branch using Catalyst SD-WAN; management plane = WAN-wideToday
Miasma worm (GitHub)Cleanup in progress; self-replicatingAnyone consuming affected MS-owned repos or transitive depsThis week
IronWorm + Miasma (npm)Per-package; pin/audit requiredAny CI run pulling fresh deps in last 14 daysThis week
SolarWinds Serv-U DoSPatch availableAny Serv-U instance; BOD 22-01 appliesImmediate

What to do

  1. Restrict Cisco Catalyst SD-WAN Manager admin/API access to jump-host-only via ACL today; enable enhanced logging and deploy hunt queries for anomalous session creation and config push events

  2. Run emergency npm/GitHub dependency audit: identify any packages installed or updated in the last 14 days matching Miasma/IronWorm IOC lists; rotate all CI tokens, npm tokens, GitHub PATs, and cloud credentials touched by suspect builds

  3. Enforce npm ci with locked versions and enable provenance verification at the proxy registry layer; quarantine suspect packages

  4. Patch all SolarWinds Serv-U instances and document against BOD 22-01 timelines; restrict ingress to known partner IP ranges

AI Platform Trust Boundaries Are Failing — Five Events, One Pattern

The AI Stack Is Now a Tier-1 Attack Surface

Six independent sources this cycle converge on one finding: every major AI platform has had a material security event, and detection tooling has not caught up. Different vendors, different vectors, different blast radii. The shared architecture is the point. Trust boundaries that used to be implicit are now exploitable.

The Five Events

  1. HuggingFace Transformers RCE — triggered by crafted model config files. The vector weaponizes the assumption that downloading a model is inert. The package has 2.2 billion installs. GPU inference hosts have historically been the worst-instrumented boxes in the enterprise.
  2. Meta AI Chatbot Account Takeover — the chatbot was social-engineered into changing the email address on high-profile Instagram accounts. The model handled a credential-reset path as a support conversation. Call this prompt-as-privilege-escalation. The attacker convinced the AI to perform the breach.
  3. Claude Code MCP Vulnerabilities — the protocol used to grant LLMs tools, files, and credentials has known weaknesses. A vulnerability in the MCP client is a vulnerability in everything the client was trusted to touch.
  4. Anthropic Suspected Cross-Tenant Leak — unconfirmed. Consistent with multi-tenant isolation failure. If it confirms, every major AI platform vendor has had at least one credible cross-tenant or prompt-injection incident in the last twelve months.
  5. OpenAI Lockdown Mode — shipped globally. The shipping itself is the admission that prompt-injection-driven exfiltration is a live attack chain. The mitigation works by amputating capabilities. Deep Research, Agent Mode, image fetch, and file downloads are disabled, not hardened.
The model config was not supposed to be executable. The MCP server was not supposed to read ~/.aws/credentials. The chatbot was not supposed to change account emails. Each violates a developer mental-model assumption. That is why they work.

Cross-Source Tension

Sources disagree on severity. One treats the Anthropic leak as unverified rumor. Another treats it as consistent with the isolation bug class seen against Copilot and Gemini earlier this year. Honest answer: scope is unknown. The pattern is sustained whether or not this specific incident confirms.

On the HuggingFace RCE, the 2.2 billion installs figure is the ceiling, not the exposure. The relevant question is how many installs are reachable by an attacker staging a malicious artifact, versus pinned or air-gapped. For most defenders the distinction is academic. The exposure is still large enough to act on.

Detection Maturity Is the Gap

SurfaceDetection MaturityWhy
HF Transformers / ML inference hostsLowMost GPU hosts lack EDR or egress inspection
MCP traffic (Claude Code)Very lowMCP traffic rarely logged anywhere
LLM-fronted identity flowsLowNo standard for monitoring AI-mediated account changes
Multi-tenant LLM inferenceLowNo public attestation comparable to SOC 2 CC6 for LLM inference isolation

What to do

  1. Inventory all hosts running HuggingFace Transformers (GPU inference, Jupyter, MLOps runners) and pin to patched version; block loading of untrusted model configs from the Hub at egress proxy

  2. Audit every LLM-fronted support, helpdesk, and IAM flow for ability to mutate identity state; require human-in-the-loop or out-of-band verification for any account recovery action initiated via AI agent

  3. Mandate OpenAI Lockdown Mode for high-sensitivity users (execs, legal, M&A, IR) and require MCP servers to be allowlisted, signed, and run with least-privilege scopes

  4. Open vendor incident review with Anthropic: request RCA, scope, and tenant-list confirmation for the suspected cross-tenant exposure; preserve all Claude API call logs from the affected window

The Patch-Cycle Model Is Structurally Broken — Plan Around It

Three Forces Converging on One Conclusion

The premise of vulnerability management was that a patch exists when a CVE drops. That premise is degrading. Three forces, independent, all pointing the same direction.

1. AI-Powered Discovery Is Outrunning Vendor Capacity

One security startup's AI agent found 21 zero-days in FFmpeg in a single research cycle. Anthropic's Project Glasswing just expanded to 150 critical-infrastructure companies, alongside parallel programs at OpenAI and the 'son of Mythos' frontier-model wave. Discovery scales at machine speed. Remediation scales at human speed.

2. The NVD Is Failing

The Commerce Inspector General was blunt: "NIST's lack of strategic planning and decisive action have allowed the backlog of unprocessed vulnerabilities to continue growing." Scanners that depend on NVD for CVSS, CPE matching, or CWE classification now ship silent coverage gaps on recent CVEs. Most teams will learn this in a post-incident review.

3. Agent-Authored Code Overwhelms Human Review

GitHub processed 17 million agent-generated pull requests in March 2026. Code review was built on the assumption that the author was human. AppSec gates that assume a human on one end of the diff are now a headcount problem, not a policy one.

Patch SLAs are no longer the right defensive metric. AI-driven discovery has structurally outpaced vendor remediation. Your security architecture needs to assume the patch may never arrive on time.

Compensating Strategy

The move is from patch-cycle thinking to compensating-control thinking. Virtual patching via WAF, RASP, IPS. Exploit-prevention runtime controls. Tabletops that assume an unpatched, AI-discovered RCE sitting in a tier-1 vendor for 30+ days.

For vulnerability intelligence: diversify off NVD now. CISA KEV for exploitation-driven prioritization. EPSS for probabilistic scoring. GitHub Security Advisories, which routinely beat NVD on open-source, plus direct vendor PSIRT feeds. NVD is one feed of several. It is not canonical.

For agent-authored code: branch protection that requires SAST, secret-scan, SCA, and dependency-confusion checks on any PR from a Copilot or agent identity. Measure vulnerability density of agent versus human PRs across a 60-day window. The dataset exists either way. Decide who owns it.

What to do

  1. Audit virtual-patching coverage (WAF, RASP, IPS) across all internet-facing assets and tier-1 vendor software this quarter; identify gaps where no compensating control exists if a zero-day drops

  2. Diversify VM intelligence feeds: add CISA KEV, EPSS, GitHub Security Advisories, and vendor PSIRTs as primary sources; flag CVEs with stale or missing NVD enrichment for manual triage

  3. Run a tabletop exercise: 'Critical RCE disclosed in tier-1 vendor, no patch for 30 days, PoC public within 48 hours' — pre-bake decisions on isolation, customer comms, and regulator notification

  4. Implement mandatory SAST + SCA + secret-scan gates on all agent-tagged PRs; sample 10% for human audit and track vulnerability density vs. human-authored code

The bottom line

An unpatched Cisco SD-WAN zero-day is actively exploited while a self-replicating worm lives inside Microsoft's own GitHub repos and 50+ npm packages — and across the industry, AI is discovering vulnerabilities faster than vendors can ship patches while the NVD degrades, meaning the patch-cycle model that underpins most security programs is structurally breaking in real time.