The Watch

Situation

Two critical-severity events landed concurrently. Cisco CVE-2026-20245 (CVSS 7.8) in Catalyst SD-WAN Manager is under active exploitation with no vendor patch available. Separately, the Miasma worm, a self-replicating supply-chain attack, compromised 73 GitHub repositories across four of Microsoft's own organizations. A parallel variant, IronWorm, poisoned more than 50 legitimate npm packages with a Rust-based information stealer.

Worm propagation vs. manual poisoning

Manual package poisoning has a linear blast radius. A worm has a compounding one. Every install or CI run that pulls a contaminated package becomes a new propagation node. The Rust payload harvests CI tokens, .npmrc credentials, SSH keys, and developer environment secrets. Those are the exact credentials needed to push poisoned versions further downstream.

Microsoft's own GitHub organizations being compromised signals that even platform owners cannot assume their internal repos are isolated from registry-level contagion.

The Cisco problem

CVE-2026-20245 targets the management plane of Catalyst SD-WAN. A successful exploit gives WAN-wide blast radius across every branch connected to that manager. No patch timeline has been announced. Defenders are operating in pure compensating-controls mode against an internet-adjacent administrative surface.

Cross-incident amplification

These are not independent problems. A developer workstation compromised by the Miasma npm payload that also holds VPN credentials to an SD-WAN management interface creates a chained exploitation path from supply chain to network infrastructure. The first hunt set is any overlap between Miasma-exposed CI environments and SD-WAN administrative access.

SolarWinds Serv-U

CISA added a SolarWinds Serv-U DoS flaw to KEV under active exploitation. A patch is available. The BOD 22-01 clock is running for federal contractors.

Three AI Platforms, Three Different Failure Modes, One Pattern

This week produced the first clean public demonstration of LLM-mediated privilege escalation against a named platform. Actor: unattributed. Target: high-profile Instagram accounts. Mechanism: social-engineer Meta's AI chatbot into changing the account email. Scope: bypassed human review, rate-limit logic, and the traditional account-recovery threat model. The chatbot performed a privileged identity action a human agent would have flagged.

In parallel, Hugging Face Transformers disclosed an RCE exploitable via crafted model configuration files. Most pipelines treat that file as inert metadata. The package has 2.2 billion installs. Successful exploitation lands silently on GPU-accelerated inference hosts, historically the worst-instrumented boxes in the enterprise.

Claude Code's MCP integration layer has known weaknesses in the connector that ties model clients to tools and data. A vulnerability in the MCP client is a vulnerability in everything the client was trusted to touch: source code, secrets, local filesystem, cloud credentials.

Anthropic Cross-Tenant Exposure

Publicly: nothing. Not publicly: a suspected cross-tenant output exposure at Anthropic is under investigation, which would mean prompts, RAG context, and tool outputs on shared inference infrastructure leaked between customers. No CVE, no advisory, no named victim yet. Treat as a live vendor-incident review and preserve all Claude API call logs from the suspected window.

OpenAI Lockdown Mode: Amputation, Not a Cure

OpenAI shipped Lockdown Mode globally. It is the first vendor-shipped, user-toggleable mitigation against prompt injection, and it works by removing capabilities. Disabled: Deep Research, Agent Mode, internet image fetch, file downloads. Read it as an admission that prompt injection has no clean technical fix. Available on personal accounts. Enterprise/Team tenants not explicitly covered in rollout.

Every LLM connected to a tool that mutates identity, money, or data is now a Tier-1 attack surface. The Meta/Instagram hijack is the proof of concept the board will hear about next.

The Convergence

Four sources flag the same structural pattern: trust boundaries that used to be implicit are now exploitable. The model config was not supposed to be executable. The MCP server was not supposed to read ~/.aws/credentials. The AI support chatbot was not supposed to bypass identity-proofing. Each violates a developer mental-model assumption. That is why they work.

The Discovery-to-Patch Gap Has Become a Market Structure

An AI agent at a security startup autonomously surfaced 21 zero-day vulnerabilities in FFmpeg in one research cycle. Anthropic's Project Glasswing now covers 150 critical-infrastructure companies. Weaponized AI tooling has moved off research blogs and onto ransomware forums as a commodity SKU with vendor-style support. The assumption underneath every patch SLA — that a fix exists when the bug becomes public — is no longer reliable.

Scale of the FFmpeg Problem

FFmpeg is not niche. It ships inside every video processing pipeline in practical use: Slack, browser-side wasm builds, ML preprocessing, container base images, desktop clients. Most asset inventories cannot tell you where it runs. Twenty-one zero-days is twenty-one head starts for exploit development before any patch lands.

The Offensive Ceiling Moved

Publicly: Anthropic is paying $1.25B/month for compute at Colossus 1. Reported by multiple sources, not officially confirmed: roughly 6 Anthropic engineers embedded at the NSA, deploying the Mythos model for offensive operations. The same model family in Claude production integrations is being pointed at nation-state targets. Trickle-down to financially motivated actors historically takes 12 to 24 months.

Patch SLAs are no longer the right defensive metric. AI-driven discovery has structurally outpaced vendor remediation, and security architecture needs to assume the patch may never arrive on time.

What the Commerce IG Adds

The Commerce Inspector General has formally labeled NIST's NVD backlog a strategic-planning failure. The canonical source of vulnerability metadata is running behind the disclosure curve at the moment discovery is accelerating. Scanners that depend on NVD for CVSS, CPE matching, or CWE classification have silent coverage gaps on recent CVEs. Not a future risk. A current one.

The Defensive Pivot

This is not another CVE to chase. The control hierarchy has to move. Virtual patching — WAF, RASP, IPS, runtime exploit prevention — graduates from compensating control to primary control. Run the tabletop now: "Critical RCE disclosed in a tier-1 vendor. No patch for 30 days. PoC public within 48 hours." Isolation, customer comms, regulator notification — decide those before the clock starts, not during.