Wednesday, June 3, 2026
Daily digest
The npm supply chain attack against Red Hat Cloud Services packages is the story of the day — it targets CI/CD pipelines directly and has broad implications for any shop using those packages in automated build environments.
Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign
A large-scale supply chain attack compromised over 90 versions of @redhat-cloud-services npm packages, injecting worm-like malware that steals credentials from GitHub, cloud platforms, and local machines before republishing itself to spread further. The attack silently targets CI/CD environments and developer systems, making it highly relevant to any pipeline consuming these packages. Orgs using Ansible or AWS GovCloud automation that pulls Red Hat-adjacent npm dependencies should audit immediately.
Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes
Huntress disclosed an unpatched flaw in Windows' search: URI handler that can expose NTLMv2 hashes to an attacker, similar to the recently patched CVE-2026-33829 in the Snipping Tool's ms-screensketch handler. No patch is currently available, making this an active exposure for all Windows environments including M365 GCC High users. NTLM hash theft enables relay attacks and credential cracking, so network-level mitigations like SMB signing enforcement are advisable in the interim.
New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare
Researchers discovered a remote denial-of-service vulnerability present in the default HTTP/2 configurations of NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora, dubbed the 'HTTP/2 Bomb.' The flaw was identified by OpenAI Codex through exploit chaining and requires no authentication to trigger. Any internet-facing web server or reverse proxy running default HTTP/2 settings should be reviewed and patched or reconfigured immediately.
VS Code zero-day lets hackers steal GitHub tokens in one click
A researcher published exploit code for an unpatched VS Code vulnerability that allows attackers to steal GitHub authentication tokens by tricking a user into clicking a single link. Given VS Code's ubiquity in developer and DevOps workflows — including Ansible and IaC authoring — this is a direct supply chain risk. Until a patch is available, developers should avoid clicking untrusted links while VS Code is open and consider revoking and rotating GitHub tokens as a precaution.
AI-built ransomware toolkit automates EDR evasion, AD discovery
A threat actor is deploying an AI-generated ransomware toolkit that automates Active Directory enumeration and is specifically designed to evade EDR solutions. This represents a meaningful escalation in attacker capability — AI is now being used to lower the skill bar for sophisticated, targeted ransomware operations. Organizations should validate that AD tiering, privileged access controls, and EDR telemetry are all tuned to detect lateral movement and AD reconnaissance.
Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation
CISA added CVE-2024-21182, a high-severity Oracle WebLogic flaw (CVSS 7.5) that allows unauthenticated remote attackers to take control of vulnerable servers, to the Known Exploited Vulnerabilities catalog. Active exploitation is confirmed, triggering the mandatory 3-week remediation window for federal agencies and contractors under BOD 22-01. Any WebLogic instances in your environment — including those supporting legacy enterprise apps — should be patched or isolated immediately.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added CVE-2022-0492 (Linux Kernel improper authentication) and CVE-2025-48595 (Android Framework integer overflow, actively exploited in the wild) to the KEV catalog. The Linux kernel flaw is particularly relevant to containerized and virtualized environments — including Nutanix AHV hosts — where kernel privilege escalation can undermine hypervisor isolation. Confirm patching status for both in your asset inventory and prioritize any Linux-based infrastructure nodes.
FBI-Flagged Phishing Kit Kali365 Expands Its Reach
The Kali365 phishing-as-a-service platform, previously focused on Microsoft 365 credential theft, has expanded to target AWS, Okta, and Russian platforms while adding device code phishing as a primary technique. Device code phishing is especially dangerous in M365 GCC High environments because it abuses legitimate OAuth flows and can bypass MFA. Ensure Conditional Access policies restrict device code flow where possible and that users are trained to recognize unsolicited authentication prompts.
Acer working to patch max severity zero-days in Wave 7 routers
Acer disclosed two maximum-severity zero-day vulnerabilities in its Wave 7 mesh routers and is actively developing patches. While Acer Wave 7 is consumer/SMB-grade hardware, the disclosure highlights ongoing risks in network edge devices — a persistent concern for any environment where BYOD or remote worker networking gear is not tightly controlled. Monitor for patch availability and consider compensating controls at the network perimeter if these devices are present.
AI executive order sets stage for new cybersecurity directives
Trump's newly signed AI executive order establishes a voluntary 30-day pre-release review process for advanced AI models and reinforces government-wide AI cybersecurity efforts, including potential new directives for critical infrastructure operators. This is directly relevant to CMMC-adjacent environments as it may influence future NIST guidance, FedRAMP AI service authorizations, and CUI handling requirements for AI tools. IT and compliance teams should track follow-on rulemaking from CISA and NIST as implementing guidance is developed.
EHR modernization effort lacks cyber performance measures, GAO finds
A GAO report found that the VA/DoD joint EHR modernization program has two years of missing cybersecurity performance measures and undefined fiscal 2026 goals for its interagency privacy and security protections. For CMMC practitioners, this is a cautionary example of how large federal IT programs can accumulate compliance gaps when security metrics aren't defined and enforced from the outset. The findings underscore the importance of continuous monitoring metrics as a required element — not an afterthought — in any DoD-adjacent system.
Identify unused AWS KMS keys and prevent accidental key deletions
AWS published guidance on auditing unused KMS keys across multi-account, multi-region environments to support compliance requirements, reduce risk posture, and control key management costs. For AWS GovCloud users, maintaining an accurate KMS key inventory is a direct NIST 800-171 requirement under the identification and protection of CUI at rest. The post covers tagging strategies, CloudTrail-based usage analysis, and deletion safeguards — practical steps for any shop running encrypted workloads at scale.