Summary
A single poisoned GitHub repository can quietly reshape code and leak secrets across entire development pipelines. Cyware spotlights the new Miasma npm worm, which has armed 42 repositories with stealthy payloads targeting AI coding assistants and tools like Claude, Gemini, Cursor, and VS Code. This campaign exploits authentication bypass flaws and evades automated analysis, putting developer environments and downstream dependencies at risk.
Attackers are actively exploiting two PHP2Shell vulnerabilities—CVE-2026-109618 and CVE-2026-109619—in PHP installations, enabling unauthenticated code execution on servers. U.S. officials have issued urgent patching mandates as exploitation is already underway, with successful attacks granting intruders a foothold for data theft or service disruption.
Operation CameraSwarm is hijacking internet-connected cameras across Ukraine to collect military intelligence and monitor transport routes. The campaign abuses weaknesses in devices from Dahua, Hikvision, D-Link, and Reolink, leveraging brute-force tactics and authentication flaws to turn routine surveillance infrastructure into a persistent espionage tool.
Top Malware Reported in the Last 24 Hours
Miasma npm worm booby-traps GitHub repos
Miasma, a new variant of the Miasma-family npm worm, was caught “arming” 42 GitHub repositories with a hidden payload designed to evade detection and tamper with developer environments. It targets AI coding assistants and development tools by planting execution hooks for Claude, Gemini, Cursor, and VS Code, aiming to steal credentials and modify repositories. Researchers say it also exploits CVE-2026-41940, an authentication bypass in cPanel and WHM, and it checks for CI runners and other signs of automated analysis to stay out of sight. JFrog investigators tied infrastructure to a GitHub account named CementBeetleSteeple (which hosted 17 campaign repositories) and linked the activity to the testmetest GitHub victim cluster, with connections to a shellpanel scanner used in a large-scale campaign exploiting GitHub Actions. For development teams, a single poisoned repo can quietly reshape code, leak secrets, and spread compromises through CI pipelines and downstream dependencies.
Recommended actions: block IPs/domains associated with the CementBeetleSteeple account, add known malicious payload hashes to blocklists, scan repositories and CI configurations for indicators of compromise, and apply patches for CVE-2026-41940.
Teams chat lures deliver Chaos ransomware
Attackers are abusing Microsoft Teams external chat to impersonate IT staff and trick employees into letting malware into corporate networks, including Chaos ransomware. They pose as “Help Desk” or “IT Support,” then use remote monitoring and management tools to take control of machines and stage follow-on payloads during live sessions, sidestepping some link-scanning protections. Reported tooling includes Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn, alongside PowerShell downloads that can install additional implants. The activity also leans on paid domains for tenant creation, with about 50% using .top, 40% using .com, and over 5% using multi-level domains such as .com[.]pl, .com[.]vn, and .com[.]br. For victims, the consequence is practical and immediate: a chat message that feels like routine IT support can become a rapid path to data theft and business disruption.
Malicious loaders infect 953 Magento stores
A long-running malware campaign has infected 953 online stores, largely on Magento, by planting malicious JavaScript loader code that selectively serves payloads to real shoppers. The campaign has been active since July 2025 and is linked to exploits including PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236), with some intrusions reported even on patched stores. Sansec tracked multiple loader domains, including manulfie[.]click on 9 stores, neswnsssn[.]click on 6 stores, and deepveindrilling[.]com on 83 stores, and said it observed 52,000 instances of additionalver[.]com being loaded. In one case, a store with no missing core patches was still compromised and showed a rogue admin account and a GSocket backdoor, underscoring how messy real-world e-commerce breaches can get. For retailers and customers, that can translate into stolen payment details, hijacked sessions, and a checkout experience that looks normal while silently feeding criminals.
Recommended actions: check the CMS for loader code and vulnerabilities, remove rogue admin accounts and backdoors, and monitor for suspicious activity using tools like Sansec Watch.
Top Vulnerabilities Reported in Last 24 hours
Government warns hackers exploiting PHP2Shell bugs
U.S. officials say attackers are actively exploiting two PHP2Shell vulnerabilities in PHP installations that can enable unauthenticated code execution (CVE-2026-109618 and CVE-2026-109619). In practical terms, successful exploitation can give an intruder a foothold to run their own code on a server, opening the door to data theft or service disruption. Attackers are already exploiting this in the wild. Exploitation is described as complex because it requires bypassing ASLR protections, which may limit broad, opportunistic attacks. CISA has mandated immediate patching for U.S. government agencies, and the advisory also calls out upgrading systems running end-of-life PHP versions and increasing monitoring for exploitation attempts.
Brotli decoder bug threatens Node.js ecosystems
A critical out-of-bounds write in the Node.js Brotli decoder (CVE-2026-111497, CVSSv4 9.2) can corrupt memory and may lead to remote code execution, with ripple effects beyond Node.js into other products that rely on Brotli. The issue can be triggered when software processes crafted Brotli-compressed data (such as decompressed content handled by applications), turning a routine compression feature into an attacker’s entry point. Rapid7 said it is not aware of any exploitation in the wild as of the advisory date. The flaw originates in Google’s Brotli decoder, and the same CVE is also driving rebuilds for PHP Windows packages where exploitation could occur via the cURL extension decompressing HTTP responses. A fix is available in Node.js 22.23.4, 24.22.1, and 26.12.1, and for other impacted ecosystems organizations are told to consult relevant vendor advisories; for some affected PHP Windows scenarios, the report states there is no workaround if you cannot update.
Apple backports exploited CoreGraphics zero-day
Apple shipped backported fixes for an exploited CoreGraphics vulnerability that can be triggered when a device processes a maliciously crafted file, potentially causing crashes, data corruption, or code execution (CVE-2026-86950). For targeted victims, the real-world consequence is simple: opening or previewing the wrong content could be enough to compromise a device. Attackers have exploited this in “extremely sophisticated” attacks against specific targeted individuals on iOS versions before iOS 27, according to Apple. The affected devices called out include iPhone XS, iPhone XS Max, iPhone XR, iPad (7th generation), iPad Air (4th generation and later), iPad (9th generation and later), and iPad mini (6th generation and later). Apple has released patches for these older iPhones and iPads, underscoring the need to apply updates promptly when zero-days are being used against real people.
Top Threat Actors Reported in Last 24 hours
Operation CameraSwarm hijacks cameras in Ukraine
Operation CameraSwarm, a campaign tied to espionage and military intelligence collection, is abusing internet-connected cameras to watch what’s happening on the ground in Ukraine. The operation is exploiting weaknesses across common devices, including Dahua IP cameras as well as Hikvision, D-Link, and Reolink models, using tactics like brute-forcing serial numbers, guessing weak passwords, and leveraging authentication flaws. For communities and organizations near military activity, compromised cameras can turn routine security infrastructure into an always-on surveillance feed that exposes transport routes and sensitive movements. The activity includes exploitation of known bugs such as CVE-2017-7921, CVE-2020-25078, CVE-2020-25169, and CVE-2021-36260 alongside P2P access and authentication weaknesses. Dutch intelligence agencies reported the intrusions were used for espionage and military intelligence gathering, including monitoring military transport routes and collecting sensitive military data.
Teams chat scams lead to Chaos ransomware
Threat actors are turning Microsoft Teams external chat into a front door for IT-impersonation scams that can end in malware and even Chaos ransomware. They pose as help desk staff using IT-themed display names and domains to convince targets to accept contact, then push remote access via legitimate tools so the attacker can operate interactively on the victim’s machine. For employees who rely on Teams daily, the consequence is that a routine “support” message can quickly become hands-on takeover and data theft. During these sessions, the attackers use PowerShell commands to download and execute malicious files, including cases where an MSI pulled from Azure Blob Storage installed a Python implant used for data exfiltration. The activity also leans on paid tenant domains—about 50% using .top and 40% using .com—to make the outreach look more believable at first glance.
Hidden Hawk hijacks domains for gambling
Hidden Hawk is abusing trusted school and government web domains to quietly host and boost illegal gambling content, a tactic that turns institutional reputations into an SEO weapon. They do this through domain shadowing—gaining unauthorized DNS access to create new hostnames under legitimate domains—then using CNAME records to route visitors to gambling pages. For public institutions, the damage isn’t just technical: this kind of hijack can erode public trust and tie respected domains to criminal gambling operations. A separate actor observed in the same research used NS delegations to hand off control of subzones externally, helping sustain long-running gambling-brand promotion. The content delivery for these operations has been supported by external hosting services including Cloudflare and BunnyCDN.
Frequently Asked Questions
What is Miasma? <b>Miasma</b>, a new variant of the Miasma-family npm worm, was caught “arming” <b>42 GitHub repositories</b> with a hidden payload designed to evade detection and tamper with developer environments. It targets AI coding assistants and development tools by planting execution hooks for <b>Claude</b>, <b>Gemini</b>, <b>Cursor</b>, and <b>VS Code</b>, aiming to steal credentials and modify repositories.
What is Chaos ransomware? Attackers are abusing <b>Microsoft Teams</b> external chat to impersonate IT staff and trick employees into letting malware into corporate networks, including <b>Chaos ransomware</b>. They pose as “Help Desk” or “IT Support,” then use remote monitoring and management tools to take control of machines and stage follow-on payloads during live sessions, sidestepping some link-scanning protections.
What is CVE-2026-109618? U.S. officials say attackers are actively exploiting two PHP2Shell vulnerabilities in PHP installations that can enable unauthenticated code execution (<b>CVE-2026-109618</b> and <b>CVE-2026-109619</b>). In practical terms, successful exploitation can give an intruder a foothold to run their own code on a server, opening the door to data theft or service disruption.
What is CVE-2026-111497? A critical out-of-bounds write in the Node.js Brotli decoder (<b>CVE-2026-111497</b>, CVSSv4 <b>9.2</b>) can corrupt memory and may lead to remote code execution, with ripple effects beyond Node.js into other products that rely on Brotli. The issue can be triggered when software processes crafted Brotli-compressed data (such as decompressed content handled by applications), turning a routine compression feature into an attacker’s entry point.
What is CVE-2026-86950? Apple shipped backported fixes for an exploited CoreGraphics vulnerability that can be triggered when a device processes a maliciously crafted file, potentially causing crashes, data corruption, or code execution (<b>CVE-2026-86950</b>). For targeted victims, the real-world consequence is simple: opening or previewing the wrong content could be enough to compromise a device.
What is Operation CameraSwarm? <b>Operation CameraSwarm</b>, a campaign tied to espionage and military intelligence collection, is abusing internet-connected cameras to watch what’s happening on the ground in Ukraine. The operation is exploiting weaknesses across common devices, including Dahua IP cameras as well as <b>Hikvision</b>, <b>D-Link</b>, and <b>Reolink</b> models, using tactics like brute-forcing serial numbers, guessing weak passwords, and leveraging authentication flaws.
What is Hidden Hawk? <b>Hidden Hawk</b> is abusing trusted school and government web domains to quietly host and boost illegal gambling content, a tactic that turns institutional reputations into an SEO weapon. They do this through domain shadowing—gaining unauthorized DNS access to create new hostnames under legitimate domains—then using CNAME records to route visitors to gambling pages.