Saturday, June 6, 2026
Daily digest
Supply chain attacks are dominating today — the Miasma worm has now hit 73 Microsoft GitHub repositories across Azure and other key orgs, and a separate npm campaign compounds the risk for any team pulling open-source dependencies into pipelines.
Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack
The self-replicating Miasma worm compromised 73 repositories across Microsoft's Azure, Azure-Samples, Microsoft, and MicrosoftDocs GitHub organizations, prompting GitHub to disable access to affected repos. This is a direct threat to any team using Microsoft-published code samples or Azure reference architectures in CI/CD pipelines. Organizations should audit recent pulls from these repos and review pipeline integrity immediately.
IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks
A Rust-based information stealer dubbed IronWorm and a new Miasma variant have poisoned more than 50 legitimate npm packages; the stealer exfiltrates secrets from developer machines and hides behind an eBPF kernel rootkit. Any Ansible, container build, or Node-based automation workflow that pulls from npm is potentially at risk. Teams should lock dependency versions and audit recent installs against the JFrog advisory.
Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available
A high-severity (CVSS 7.8) zero-day in Cisco Catalyst SD-WAN Manager is under active exploitation with no patch currently available, affecting on-premises, Cloud-Pro, Cisco-managed cloud, and the FedRAMP SD-WAN for Government deployments. The FedRAMP variant being in scope makes this directly relevant to GovCloud and government-adjacent network infrastructure. Cisco has issued a security advisory; apply any available workarounds and monitor for indicators of compromise while awaiting a patch.
CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog
CISA added CVE-2026-28318 (CVSS 7.5), an uncontrolled resource consumption bug in SolarWinds Serv-U multi-protocol file transfer server, to the KEV catalog after confirming active exploitation that crashes the service. Federal agencies under BOD 22-01 must remediate by the KEV deadline, and any CMMC environment running Serv-U for managed file transfer should treat this as urgent. A patch is available from SolarWinds; apply it immediately.
Chinese APT Deploys New Malware to Keep Access to Hacked Networks
Chinese espionage group UNC5221 is using the Brickstorm backdoor alongside two newly documented malware families — Plenet and AgentPSD — to maintain persistent access inside Microsoft 365 environments. This is directly relevant to M365 GCC High tenants, as the tradecraft targets cloud-hosted identities and collaboration platforms. Review Microsoft 365 audit logs for anomalous OAuth activity and lateral movement indicators tied to this cluster.
Securing CI/CD in an Agentic World: Claude Code GitHub Action Case
Microsoft Threat Intelligence found a prompt injection pathway in the Claude Code GitHub Action that could expose workflow secrets under certain conditions, and worked with Anthropic on a fix. This is a concrete example of how AI-powered CI/CD integrations introduce new attack surfaces that traditional secrets-scanning won't catch. Teams using AI coding assistants in GitHub Actions pipelines should review workflow permissions, pin action versions, and audit secret scoping.
CMMC Has Moved from Planning to Enforcement and Contractors Are Feeling It
Defense contractors are now encountering active CMMC enforcement rather than the years-long planning phase, with assessments and compliance requirements becoming real contract conditions. Organizations that deferred remediation of NIST 800-171 gaps are now at risk of losing or failing to win DoD contracts. This is a timely signal to accelerate any outstanding POA&M items and confirm C3PAO assessment scheduling.
Warner Unveils Bill to Restore Cyber Information-Sharing Program Funding
Senator Warner introduced legislation to restore funding for cyber threat information-sharing programs that were cut, while also writing DHS and all governors urging continued investment in state and local cyberdefense. For CMMC-environment operators, these programs are a key source of threat intelligence relevant to CUI protection obligations. Watch whether this advances, as funding restoration would affect the quality of actionable indicators available to contractors.
AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
An autonomous AI security agent discovered 21 previously unknown vulnerabilities in FFmpeg, the media library embedded in a vast range of software including browsers, containers, and collaboration tools. Simultaneously, Google shipped Chrome 149 patching a record 429 bugs. FFmpeg is widely present in server-side video processing and containerized workloads, so patch cycles need to account for transitive dependencies carrying the vulnerable library.
New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework
A China-linked espionage group designated OP-512 is deploying a bespoke web shell framework against Microsoft IIS servers, assessed with moderate-to-high confidence by ReliaQuest as focused on long-term access and data collection. IIS remains common in government and defense contractor environments running legacy .NET applications. Audit IIS installations for web shell indicators and ensure they are not internet-facing without current patching and WAF coverage.
Over 900 US Gas Station Tank Gauge Systems Exposed to Attacks
More than 900 automatic tank gauge (ATG) systems at US fuel facilities are directly internet-exposed and actively being attacked, with threat actors able to manipulate readings or cause physical disruption to fuel storage. This represents a critical infrastructure OT/ICS exposure with real-world consequences beyond data theft. The issue underscores the need for network segmentation and firewall controls on any OT or building management system reachable from IT networks.
Microsoft Allows BYOL for Amazon RDS — SQL Server Licenses Now Usable in AWS
Microsoft has reversed course and will now allow customers to bring their own SQL Server licenses (BYOL) for use on Amazon RDS, a significant licensing policy change that directly affects hybrid and multi-cloud database strategies. For teams running SQL Server workloads split between on-premises, AWS GovCloud, and Azure, this removes a major cost and compliance friction point. Evaluate existing EA and licensing agreements to determine whether this creates a cost optimization opportunity.