The Attestation Forged Itself
Big Picture
Four separate stories this week, and they do not share a tidy thesis. Malicious code shipped with valid SLSA attestations on 42 TanStack packages. Gaslight malware tried to sabotage the AI tools reverse engineers point at it. JFrog turned a 50KB file into RCE on two named platforms. And Mandiant watched an intruder create a rogue root account, then restore the old password to stay hidden. Read on.
TL;DR
The Attestation Forged Itself
The security industry spent two years selling provenance attestation as the answer to supply chain attacks. This week malicious npm packages arrived carrying valid ones.
On June 24, StepSecurity documented a self-spreading npm worm that hit the @tanstack namespace, publishing 84 malicious artifacts across 42 packages. Those packages carried valid SLSA Build Level 3 provenance attestations, the first documented case of an npm worm producing validly-attested provenance for malicious code. The same week, Aikido flagged a compromise of the codfish/semantic-release-action GitHub Action, with tags v2 through v5 repointed to the Miasma credential-stealing toolkit aimed at CI/CD secrets.
Sit with that. Anyone who verified provenance saw a green check. The signature was real. The build ran in the claimed environment. The attestation described the pipeline accurately, and the pipeline was owned. The control did exactly what it promised, which turned out to be the wrong promise.
The same class of flaw is not confined to one action. On the same day, Novee Security disclosed Cordyceps, a CI/CD workflow weakness that can grant "full attacker control of repositories at dozens of the largest organizations worldwide," naming Microsoft, Google, and Apache. Novee flagged 654 repositories and confirmed more than 300 as exploitable. The bug lives in how workflows trust their own automation, not in any single package.
Takeaways
A provenance attestation answers one question: did this artifact come from the build pipeline it claims? It never answered whether that pipeline was trustworthy at the moment it signed. Ask what your team does with a verified attestation, and whether any part of that response would have caught a valid signature wrapped around malicious code.
The Malware That Gaslights Your AI
Attackers usually point AI at finding bugs. This week they aimed at the AI doing the defending.
SentinelLABS detailed Gaslight, a previously undocumented Rust-based macOS implant and infostealer. The name comes from its trick. The sample carries a prompt injection payload the researchers describe as "a Markdown-fenced block containing 38 fabricated 'system' messages designed to trick a security agent into aborting, truncating, or refusing analysis." An analyst who drops the binary into an AI-assisted workflow may get told, in effect, that there is nothing here to see. The malware does not evade the human. It talks past the human's tooling.
The same week showed the other half of the AI attack surface. CSO Online covered an AIR experiment in which a malicious AI agent skill reached over 26,000 users. The skill, called brand-landingpage, carried no suspicious code. It instructed agents to install a fake SDK from stitch-design.ai, a lookalike domain that redirected to Google's real Stitch site, which made static review come back clean. AIR ran it against scanners from Cisco, Nvidia, and skills.sh. All three marked it safe. Some of the affected agents were tied to corporate accounts, and AIR noted a similar attack could have exposed private conversations and internal systems. Dark Reading reported OpenClaw pulling five packages from its ClawHub marketplace for slipping infostealers past security checks the same week.
Takeaways
The scanners that vet AI skills read the SKILL.md and bundled files with static heuristics and LLM agents. A redirect domain and an injected instruction sit outside that field of view. If your team trusts an AI layer inside its analysis or review loop, map every place it ingests untrusted input (malware samples, PRs, logs, tickets). Each one is an injection surface. Check whether anything sanitizes what reaches the model.
PixelSmash, One 50KB File, RCE on Jellyfin and Nextcloud
Most FFmpeg advisories stay abstract. This one shipped with two named victims and a working exploit.
JFrog researchers found CVE-2026-8461, a heap out-of-bounds write in FFmpeg's MagicYUV decoder, dubbed PixelSmash. They demonstrated the full exploit twice: remote code execution on a Jellyfin media server via automatic library scan, and on a Nextcloud instance via the video preview provider. In both cases the trigger was a crafted 50KB AVI file, uploaded and left alone. "All it takes is processing a single malicious media file," the researchers said.
The scope is a dependency problem. FFmpeg's libavcodec runs in desktop players like Kodi and mpv, in Linux file-manager thumbnail generators, in cloud transcoding pipelines such as AWS MediaConvert and Cloudflare Stream, and in self-hosted media servers. Any AVI, MKV, or MOV file works. A folder containing the app is enough, because the thumbnail generator triggers the bug on preview. JFrog's Yuval Moravchik said the flaw "can be escalated to remote code execution, meaning it should be taken seriously and prioritized by security teams and developers." There is one workaround: developers can disable the MagicYUV decoder at build time if it is not needed.
The takeaway is a software bill of materials problem. FFmpeg sits bundled inside a huge number of commercial and open source products where most teams never listed it.
Takeaways
Nobody installs FFmpeg on purpose, which is why nobody tracks it. A team that cannot answer "which of our services parse an uploaded media file, and does any of them call libavcodec" is not tracking its transitive dependencies at the depth PixelSmash requires.
Root Access, Then Cover the Tracks
In the Cisco SD-WAN intrusion, the cleanup is what stands out. The attacker worked to make the break-in look like it never happened.
Mandiant disclosed that attackers exploited CVE-2026-20245 in Cisco Catalyst SD-WAN, and that the exploitation started well before Cisco's public disclosure. The Register laid out the chain. The actor reached a service provider through an unauthorized peering connection, then authenticated to the SD-WAN Manager over SSH using the vmanage-admin account. They changed the admin password, logged into the web interface, and exfiltrated the SD-WAN fabric configurations. Then they set the password back to its original value before ending the session, so the account looked untouched.
Neither the vmanage-admin nor the admin account has root shell access, so the attacker used CVE-2026-20245 to get there. They uploaded a file named evil_tenant.csv carrying the exploit payload, which on execution created a new account called troot with full root privileges. Mandiant later watched the intruder switch into troot from the admin account using the substitute user command.
This is Cisco's sixth SD-WAN bug listed as under attack this year and the second zero-day in two months. Exploitation ran before Cisco's public disclosure, but the cleanup tradecraft stands out more than the timing. The intruder planted a rogue root account under an innocuous name and restored the original password to erase the entry point.
Takeaways
Cover-your-tracks discipline like restoring the original password defeats the "did anyone log in?" check but not the "does this account exist?" check. A troot account and an evil_tenant.csv upload are both artifacts an inventory notices even when the login trail looks clean. Ask whether your SD-WAN telemetry would surface a new root account created outside your provisioning process.
Vulnerabilities in the Wild
CVE-2026-20245, Cisco Catalyst SD-WAN privilege escalation (zero-day)
Post-authentication privilege escalation in Cisco Catalyst SD-WAN Manager that executes arbitrary commands as root via a crafted file upload; initial access came via unauthorized peering and SSH. Used to create a rogue troot root account at a service provider. Zero-day; exploited before Cisco public disclosure (Mandiant) · Exploited in the wild. Source
CVE-2026-20230, Cisco Unified Communications Manager SSRF
Improper input validation on specific HTTP requests allows an unauthenticated remote attacker to conduct SSRF, write files to the OS, and elevate to root; actively exploited to drop webshells via Tor three weeks after patch. CVSS 8.6 (High); actively exploited in the wild · Exploited in the wild. Source
CVE-2025-67038, Lantronix EDS5000 Series code injection
Code injection flaw in Lantronix EDS5000 Series devices that could result in remote code execution; CISA added it to KEV with a June 26 federal patch deadline. CVSS 9.8 (Critical); actively exploited in the wild · Exploited in the wild. Source
CVE-2026-8461, FFmpeg MagicYUV heap out-of-bounds write (PixelSmash)
Heap OOB write in the FFmpeg MagicYUV decoder that crashes any app using libavcodec and can escalate to RCE; JFrog demonstrated RCE on Jellyfin and Nextcloud with a single crafted 50KB AVI file. RCE demonstrated (no CVSS assigned); no in-wild exploitation reported yet. Source
CVE-2026-20971, Samsung Android kernel use-after-free
Use-after-free in the Samsung Android kernel affecting Galaxy S9 through S25 devices, disclosed with technical analysis of how defensive code became attack surface. Severity not assessed. Source
CVE-2026-47729, Squid FTP directory-listing parser heap overread (Squidbleed)
29-year-old Heartbleed-style heap overread in the Squid FTP listing parser (injected via a 1997 NetWare commit) that leaks internal memory, including plaintext HTTP requests, credentials, and session tokens; found with help from the Anthropic Claude Mythos Preview. Fixed in Squid v7.6. Memory-disclosure; no CVSS assigned. Source
CVE-2026-55200, libssh2 memory-safety flaw
A memory-safety vulnerability in libssh2 caused by unsafe C code, cited as another recurring example of C memory-safety failures. Severity not assessed. Source
Cordyceps CI/CD workflow vulnerability class
A new class of GitHub Actions/CI-CD workflow weakness (named by Novee Security) granting full attacker control across 300+ repositories at dozens of major organizations including Microsoft, Google, and Apache. Critical exploitable pattern; no active exploitation reported. Source
TanStack npm supply-chain worm (valid SLSA provenance)
A self-spreading npm worm hit the @tanstack namespace, publishing 84 malicious artifacts across 42 packages that carried valid SLSA Build Level 3 provenance attestations, the first documented case of validly-attested malicious packages. A related compromise of the codfish/semantic-release-action GitHub Action (Miasma credential-stealer, v2-v5 tags) targeted CI/CD secrets the same week. Supply-chain compromise; actively abused · Exploited in the wild. Source
LangGraph checkpointer SQLi to RCE chain
Three flaws in the LangGraph persistence layer; a SQL injection in the SQLite (and Redis) checkpointer lets attackers plant rows that trigger unsafe msgpack deserialization, importing and calling attacker-controlled Python functions for RCE on self-hosted deployments exposing get_state_history() with a user-controlled filter. RCE on self-hosted deployments; no in-wild exploitation reported. Source
Adblock for YouTube Chrome extension dormant script injection
A Featured, 10M+ install Chrome ad-block extension (named Adblock for YouTube, ID cmedhionkhpnakcndndgjdbohmhepckk) found by Island to contain the dormant ability to execute arbitrary JavaScript. Not scored; dormant capability, no confirmed exploitation. Source
Curated Reading List
Thought-Provoking
• From SQLi to RCE: Exploiting LangGraph's Checkpointer (Check Point Research) Why it's worth your time: a concrete SQL-injection to unsafe-deserialization to RCE chain inside a mainstream LLM-agent framework, the AI-infrastructure attack surface teams are shipping without review.
• Java's SSLContext protocol name is a footgun (Neil Madden) Why it's worth your time: SSLContext.getInstance for TLSv1.3 quietly does not do what most Java developers assume, worth a five-minute audit of your own TLS setup.
• Package Manager CWEs: 20 recurring vulnerability patterns (Andrew Nesbitt) Why it's worth your time: a taxonomy of 20 recurring package-manager bugs drawn from roughly 200 CVEs, a working checklist for anyone hardening a registry or build pipeline.
Current Events
• Inside StegoAd: How We Disrupted a Massive Malicious Extension Campaign (Microsoft Edge VR team) Why it's worth your time: 119 browser extensions with 2.6M installs hid payloads in image and font files via steganography, the browser-ecosystem analog to this week's registry attacks.
• You have got to be KDDI-ng: Japanese telco exposes 14.2M managed email credentials (The Register) Why it's worth your time: 14.2M credentials exposed through a third-party email platform KDDI resold to five other ISPs, a clean case study in inherited supply-chain blast radius.
• Securing the Nation Against Advanced Cryptographic Attacks (EO 14412) (The White House) Why it's worth your time: the actual executive order, federal post-quantum deadlines now reach contractors, turning quantum-resistant crypto into a code-level remediation program AppSec teams will inherit.
