[Security News] npm Miasma Attack Hits Red Hat Package Scope (6.3)
Microsoft traced a broad npm supply-chain compromise to the @redhat-cloud-services scope, while CISA added an actively exploited Mirasvit flaw to KEV and…
npm Miasma Attack Hits Red Hat Package Scope (6.3)
Microsoft Traces npm Miasma to Red Hat Package Scope
Microsoft Threat Intelligence reported a large npm supply-chain compromise involving the @redhat-cloud-services namespace, where attackers modified 32 packages across more than 90 versions. The affected packages came through the upstream RedHatInsights/javascript-clients continuous integration and continuous delivery pipeline, according to microsoft.com.
The campaign matters because it used a trusted publishing path rather than a look-alike package name alone. Microsoft said the payload ran across Linux, macOS, and Windows by downloading the correct Bun runtime for each platform. Linux CI/CD runners appeared to be the main target, which placed build systems and developer automation in the risk path.
Microsoft also reported that the malware tried to spread by compromising additional maintainer packages. In some scenarios, it could destroy a maintainer’s home directory. Microsoft said it shared findings with the npm team, which removed affected repositories and added protections on the @redhat-cloud-services namespace to block unauthorized publishing.
For developers and security teams, the immediate response is package hygiene. Teams using affected @redhat-cloud-services packages should review dependency versions, rotate exposed credentials, inspect CI logs, and rebuild from known-good sources. The reporting did not identify a CVE, because this was a supply-chain compromise rather than a single product vulnerability.
▸ npm Miasma deep dive
This incident follows a pattern that has become familiar in JavaScript ecosystems: attackers look for the narrow point where code, credentials, and publishing authority meet. A package manager account, build pipeline, or automation token can become more valuable than a direct server exploit because it lets malicious code travel through normal update channels.
The use of preinstall-stage execution is especially sensitive in npm workflows. Install scripts run during dependency installation, often inside developer laptops or CI/CD runners that hold secrets. That does not require the attacker to break into every downstream organization. It requires the attacker to place code where downstream systems already expect code to run.
The cross-platform Bun download behavior also points to operational planning. A payload that adapts to Linux, macOS, and Windows increases the number of usable targets. Microsoft’s note that Linux CI/CD runners appeared to be the primary target narrows the defensive priority: build workers, release automation, and package publishing jobs deserve the fastest review.
The attempted propagation through maintainer packages adds a second layer of risk. If one maintainer account or pipeline can publish multiple packages, the attacker gains reach without changing tactics. That is why namespace-level protections, token rotation, and stronger publishing controls are more important than deleting only the known bad versions.
The destructive home-directory behavior changes the response calculus. Credential theft requires secret rotation and access review. Destructive capability also requires preserving logs quickly, isolating affected runners, and checking whether local build artifacts were altered before cleanup. Rebuilding from clean infrastructure is safer than trusting a runner that executed the payload.
The broader lesson is that dependency trust cannot rest only on publisher reputation. Trusted names can be abused when release automation is compromised. Practical mitigations include lockfile review, provenance checks, short-lived publish tokens, mandatory two-person review for release workflows, and separation between build credentials and production secrets.
Microsoft’s coordination with npm reduced the active distribution channel, but downstream exposure depends on who installed the modified versions before removal. That creates a lagging tail of risk. Organizations should treat the removal as containment at the registry level, not proof that every consuming environment is clean.
CISA Adds Mirasvit Deserialization Flaw to KEV
CISA added CVE-2026-45247 to its Known Exploited Vulnerabilities catalog on June 3 after evidence of active exploitation. The agency identified the issue as a Mirasvit Full Page Cache Warmer deserialization of untrusted data vulnerability.
The KEV listing is important because it marks the flaw as exploited in the wild, not merely disclosed. CISA’s alert also tied the action to Binding Operational Directive 22-01, which requires Federal Civilian Executive Branch agencies to remediate listed vulnerabilities by the due date.
The source data does not include a CVSS score, affected version range, or public PoC status for CVE-2026-45247. That gap matters for prioritization, but the KEV designation itself is a strong signal. Security teams that run Magento environments with Mirasvit cache-warming components should identify exposure, apply vendor fixes when available, and restrict access until remediation is complete.
Deserialization bugs can be dangerous because they involve application handling of structured data that may be attacker-controlled. The safe public guidance is to patch and reduce exposure; detailed payload construction is not appropriate for a defensive briefing.
▸ Mirasvit KEV deep dive
CISA’s KEV catalog exists to separate theoretical vulnerability management from confirmed exploitation. Many organizations track thousands of CVEs, but KEV entries deserve a shorter response path because someone has already used the weakness against real systems. That does not mean every exposed system is compromised, but it changes the probability model.
CVE-2026-45247 affects Mirasvit Full Page Cache Warmer, a Magento extension used to improve storefront performance by preparing cached pages before customers request them. Extensions of this kind often sit close to public web traffic and application logic. That combination can raise risk when a flaw involves deserialization of untrusted data.
Deserialization vulnerabilities occur when software reconstructs data objects from input without adequate validation. In the worst cases, an attacker can influence how an application processes those objects. The provided CISA evidence does not specify the exploit mechanics, so the responsible conclusion is limited: exploitation has been observed, and exposed installations should be treated as urgent.
For federal civilian agencies, BOD 22-01 turns the KEV entry into an operational deadline. For private organizations, the catalog is still useful because it gives vulnerability teams a defensible way to move a flaw above lower-risk backlog items. A KEV entry usually justifies accelerated change windows, emergency asset discovery, and focused compensating controls.
The Magento context also widens the operational concern. E-commerce platforms hold customer data, payment-adjacent workflows, order histories, administrator accounts, and integration tokens. Even when payment processing is delegated to third parties, compromise of the application tier can create data-theft, fraud, or persistence risk.
The right mitigation sequence starts with asset inventory. Teams should confirm whether the extension is installed, determine whether affected versions are reachable from the internet, and check whether vendor patches or fixed builds are available. If patching cannot happen immediately, administrators should reduce exposure, monitor application logs, and review privileged accounts.
Because the supplied evidence does not include CVSS or version boundaries, defenders should avoid assuming that only a narrow configuration is affected. That information should come from the vendor advisory or CISA catalog updates. Until then, KEV status is enough to justify treating the flaw as a live operational risk.
Microsoft 365 Android Token Exposure Puts App Trust in Focus
feeds.feedburner.com reported that several Microsoft 365 Android apps shipped with a development flag left enabled in production builds. The report said the flag disabled a control that normally limited account-token sharing to trusted Microsoft apps.
The reported impact was direct: another app on the same phone could request the signed-in user’s token and receive it. With that token, the app could read email, open files, browse the calendar, and send messages as the user, according to the report.
The evidence supplied for this briefing does not include a CVE number, CVSS score, affected app list, fixed version list, or Microsoft advisory text. That limits firm conclusions about scope. Still, the reported behavior describes a serious mobile identity-control failure because it bypassed passwords, login prompts, and permission prompts.
Organizations managing Android fleets should check mobile application management policies, confirm Microsoft 365 app update status, and review conditional access rules. Users should keep Microsoft 365 Android apps updated through official app stores and avoid installing untrusted apps that could run on the same device.
▸ Microsoft 365 Android tokens deep dive
Mobile account tokens are attractive because they can bridge the gap between device compromise and cloud access. A password can be protected by multifactor authentication, but a valid token may already represent an authenticated session. If another app can obtain that token, the attacker can operate inside the user’s cloud workspace without triggering a normal login flow.
The reported cause, a debug flag left enabled in production, is also a governance problem. Debug settings are useful during development because they speed testing and reduce friction. They become dangerous when release controls fail to prove that test-only behavior is disabled before production distribution.
The Android context adds complexity. Mobile operating systems isolate apps, but enterprise productivity suites often need controlled ways to share identity state among trusted apps. That design can improve user experience when Word, Outlook, Teams, and OneDrive cooperate. It also creates a sensitive trust boundary: the system must reliably distinguish approved apps from everything else on the phone.
The report said that boundary was weakened, allowing any other app on the same device to ask for the token. If accurate, the practical risk depends on whether a malicious app was already installed. That makes endpoint hygiene, app allowlisting, and managed-device policy more relevant than password resets alone.
For enterprise defenders, the first question is device population. Bring-your-own-device environments may have more unknown apps and weaker enforcement. Fully managed devices can respond through app update enforcement, compliance checks, and block rules for untrusted software. Conditional access policies can also reduce the usefulness of stolen tokens by requiring device health and managed-app context.
This case also shows why mobile security cannot be treated as separate from identity security. A cloud account can be exposed through a local app-to-app trust error. Incident response teams should therefore connect mobile telemetry, identity logs, and cloud audit records when investigating suspicious mailbox, calendar, or file activity.
The absence of vendor-supplied CVE and version data in the provided material is a real constraint. A measured response should avoid claiming confirmed exploitation or exact app coverage beyond the report. The defensible action is to update, enforce managed app policies, and monitor for unusual Microsoft 365 access patterns from mobile sessions.
Google Patches Exploited Android Framework Flaw
Google’s June 2026 Android security update addressed 124 vulnerabilities, feeds.feedburner.com reported. The patch set included one high-severity Framework flaw that had come under active exploitation.
The exploited vulnerability is CVE-2025-48595, with a CVSS score of 8.4. The report described it as a privilege-escalation issue that does not require user interaction. Privilege escalation means code that already runs on a device can gain more access than it should have.
For Android users, the practical response is straightforward: install the June 2026 security update when it becomes available for the device. For enterprise administrators, the priority is to check patch levels across managed devices and enforce minimum security patch requirements through mobile device management.
The source evidence does not provide exploit details, affected Android version boundaries, or device-maker rollout schedules. That matters because Android patch delivery depends on handset vendors and carriers. The risk remains highest for devices that cannot receive the June security patch promptly.
▸ Android June patch deep dive
A monthly Android security bulletin often contains many fixes, but active exploitation changes the order of response. CVE-2025-48595 carries a CVSS 8.4 score, placing it in the high-severity range. The reported lack of user interaction lowers the bar for exploitation once an attacker has a viable path to run code or chain the flaw with another weakness.
Framework vulnerabilities are especially relevant because the Android Framework mediates core operating-system behavior and app interactions. A privilege-escalation bug there can help an attacker move from a constrained app context toward more sensitive data or system capabilities. That does not automatically mean remote compromise from a web page, but it can be powerful as part of a chain.
The patch count, 124 flaws, also shows why mobile update management is a recurring operational problem. Security teams cannot manually reason through every monthly Android issue at the same depth. They need a policy that treats current patch level as a baseline control, with exploited vulnerabilities driving exception handling and accelerated deadlines.
Consumer risk depends heavily on device support. Pixel devices usually receive updates quickly, while other Android devices depend on manufacturer and carrier schedules. Older devices outside support windows may never receive the fix. That creates a structural exposure that cannot be solved by user caution alone.
Enterprise environments have more tools but also more complexity. Administrators can enforce minimum patch dates, block access from stale devices, and use compliance rules to steer users toward updates. They should also watch for devices that repeatedly fail update checks, because those may represent unsupported hardware or broken management enrollment.
The report does not include PoC status or exploitation scale, so it would be wrong to describe broad compromise. The more precise reading is that at least one high-severity Android Framework bug has moved from patch management into active threat response. That is enough to justify treating the June update as urgent for managed fleets.
CVE naming also matters here because Android updates are often summarized in large batches. Tracking CVE-2025-48595 separately gives security teams a way to confirm whether scanners, mobile device management dashboards, and risk registers recognize the exploited item rather than only the broader June patch bundle.
HTTP/2 Bomb Raises Denial-of-Service Concerns Across Web Servers
feeds.feedburner.com reported a remote denial-of-service issue called HTTP/2 Bomb that affects major web servers. The named products included NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora.
The report said the vulnerable behavior exists in each server’s default HTTP/2 configuration. It attributed the finding to Calif and said the issue was discovered by OpenAI Codex through chained behavior. The supplied material does not include a CVE number, CVSS score, patch matrix, or PoC status.
Remote denial of service is different from remote code execution(RCE). The reported risk is service disruption, not direct attacker control of the server. That distinction matters because response priorities should focus on availability, rate controls, HTTP/2 exposure, and vendor patch tracking.
Operators of public web services should identify where HTTP/2 is enabled, check vendor advisories, and apply updates or mitigations as they become available. Edge services, reverse proxies, and API gateways deserve attention because a default protocol setting can affect many applications behind them.
▸ HTTP/2 Bomb deep dive
HTTP/2 improved web performance by allowing multiplexed streams and more efficient connection use. Those same features create state-management complexity for servers. Denial-of-service flaws often appear when a protocol lets a client force disproportionate work, memory use, or queue pressure on the server side.
The cross-server scope is the key operational issue. A bug that appears in NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora does not necessarily mean one shared code defect. It may mean similar default behavior across separate implementations. That can make mitigation harder because organizations may need to track several vendor responses at once.
Default HTTP/2 configuration is also important. Many production services enable HTTP/2 through common web-server profiles, cloud load balancers, reverse proxies, or service meshes. Application owners may not know which layer terminates HTTP/2 or whether the vulnerable behavior exists at the edge, inside the cluster, or both.
The practical response starts with mapping exposure. Teams should inventory public endpoints, identify which component handles HTTP/2, and confirm whether traffic passes through a managed provider that can absorb or filter abusive patterns. Availability monitoring should distinguish application errors from protocol-layer saturation.
Mitigation may involve vendor patches, configuration limits, request-rate controls, stream limits, or temporary protocol changes. Disabling HTTP/2 can reduce exposure in some environments, but it may also affect performance and client behavior. That choice should be made with traffic data, not as a reflex.
The report’s mention of discovery through OpenAI Codex is a reminder that automated code and behavior analysis can find protocol interactions that manual review misses. It also suggests defenders should expect more findings that chain ordinary implementation details into operationally significant outcomes.
Because the provided source data lacks CVE and CVSS details, this briefing should not rank HTTP/2 Bomb above confirmed exploited flaws. Its importance lies in breadth and availability risk. The right stance is watchful and practical: track vendor advisories, test mitigations, and make sure edge protection can handle abnormal HTTP/2 traffic patterns.
Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign
Reported by microsoft.com. In this article Attack chain overview Mitigation and protection guidance Learn more Microsoft Threat Intelligence identified a large-scale…
Beyond the Zero-Day: See Your Network Like an Attacker
Reported by feeds.feedburner.com. Zero-days keep shipping, AI is writing exploits faster than anyone patches, and "patch everything in time" stopped working years ago.
Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag
Reported by feeds.feedburner.com. A development flag left switched on in production builds of several Microsoft 365 Android apps disabled the check that limits account-token…
Shrinking the IAM Attack Surface through Identity Visibility and Intelligence Platforms (IVIP)
Reported by feeds.feedburner.com. The Fragmented State of Modern Enterprise Identity Enterprise IAM is approaching a breaking point.
Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes
Reported by feeds.feedburner.com. Cybersecurity researchers have disclosed details of an unpatched issue that could be exploited to disclose a user's NTLMv2 hash to the atta…
New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare
Reported by feeds.feedburner.com. Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD…
Reported by feeds.feedburner.com. Cybersecurity researchers have flagged a new campaign targeting Minecraft players via YouTube to spread malware capable of gaining control…
Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited
Reported by feeds.feedburner.com. Google on Monday released patches for 124 security vulnerabilities impacting its Android operating system for the month of June 2026, inclu…
Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine
Reported by feeds.feedburner.com. The Russian hacking group known as Gamaredon has been attributed to the continued exploitation of a WinRAR vulnerability to deliver multipl…
At a glance
Fact
Publisher
Source
32 modified packages across more than 90 versions used the @redhat-cloud-services scope
Q1. What made the npm Miasma campaign different from ordinary package typosquatting?
A. Microsoft said the compromise affected 32 packages across more than 90 versions under the legitimate @redhat-cloud-services scope. That points to abuse of a trusted publishing path, not only deception through a similar-looking package name.
Q2. Why does a CISA KEV entry change patch priority for CVE-2026-45247?
A. CISA adds flaws to KEV based on evidence of active exploitation. Even without a CVSS score in the supplied data, that status gives security teams a concrete reason to move Mirasvit exposure ahead of unexploited backlog items.
Q3. What is the main risk from the reported Microsoft 365 Android token issue?
A. feeds.feedburner.com reported that another app on the same phone could obtain a signed-in user’s token. The concern is cloud-account access through a local mobile trust failure, without a password prompt or normal login event.
Q4. How should Android administrators read CVE-2025-48595 in the June update?
A. The reported CVSS 8.4 score and active exploitation make CVE-2025-48595 the priority item inside Google’s 124-fix June patch set. Managed fleets should enforce current patch levels rather than waiting for routine update cycles.
Q5. What should teams watch next on HTTP/2 Bomb?
A. The key follow-up is vendor-specific guidance for NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. feeds.feedburner.com reported broad default-configuration exposure, but the supplied data did not include CVE, CVSS, or patch details.
OpenAI와 Anthropic은 5월 23일 기준 각각 제품·연구·회사 발표와 모델·안전·제품 발표를 공식 뉴스 흐름으로 제시했다. Stanford HAI의 AI Index는 연례 지표와 분석을 통해 이 흐름을 산업 전반의 장기 변화와 함께 읽게 했다. 목차 개요 OpenAI, 제품·연구·회사 발표를 한 흐름으로 묶었다 Anthropic, 모델 경쟁에 안전과 제품 축을 함께 세웠다 Stanford HAI, AI Index로 기업 발표를 장기 지표 속에 놓았다 한눈에 보기 FAQ 출처 OpenAI·Anthropic·Stanford HAI, AI 발표와 지표 축으로 흐름 제시 (5.23) 개요 OpenAI는 제품·연구·회사 발표를 공식 뉴스면에 모아 AI 서비스와 연구 방향을 함께 제시했다. Anthropic은 모델·안전·제품 발표를 전면에 두며 AI 경쟁의 기준이 성능뿐 아니라 안전 체계로 이동하고 있음을 보여줬다. Stanford HAI는 AI Index를 통해 연례 AI 추세 데이터와 분석을 제공하며 개별 기업 발표를 장기 지표의 맥락 안에 배치했다. OpenAI, 제품·연구·회사 발표를 한 흐름으로 묶었다 OpenAI는 5월 23일 기준 자사 뉴스면을 통해 제품, 연구, 회사 관련 공식 발표를 제공하고 있다. 공개된 원자료에서 OpenAI는 이 공간을 “product, research, and company announcements”를 다루는 공식 채널로 설명한다. 단일 기능 출시만을 앞세우기보다 제품과 연구, 기업 운영의 변화를 같은 발표 체계 안에 놓는 방식이다. 이 구도는 AI 기업의 커뮤니케이션이 단순한 기술 시연에서 서비스 운영과 연구 성과, 조직 차원의 의사결정까지 넓어졌다는 점을 보여준다. 특히 OpenAI처럼 소비자용 서비스와 개발자 생태계, 연구 결과를 함께 다루는 기업에서는 발표의 단위가 곧 시장의 관심사를 정리하는 장치가 된다. 다만 이번 원자료는 개별 제품명이나 신규 수치보다 공식 발표면의 성격을 ...
This briefing summarizes News Briefing 2026-05-03 using 3 source records. Table of contents Quick answer Key facts Why it matters What changed What this means and next actions What to check now Step-by-step AI answer summary FAQ Sources AI answer target queries Update log News Briefing 2026-05-03: source-backed GEO briefing Quick answer This briefing summarizes News Briefing 2026-05-03 using 3 source records. Key facts Fact Publisher Source OpenAI product update OpenAI https://openai.com/news/ Google AI update Google https://blog.google/technology/ai/ Anthropic news Anthropic https://www.anthropic.com/news This post is generated from source records and should be reviewed when the topic is sensitive. Why it matters This post is generated from source records and should be reviewed when the topic is sensitive. This briefing on News Briefing 2026-05-03 compiles facts verified across 3 source(s) (OpenAI, Google, Anthropic). Each source is annotated with p...
이 브리핑은 3개의 출처 기록을 바탕으로 최신 AI 트렌드 2026-05-03 주제를 정리합니다. 목차 바로 답변 핵심 사실 왜 중요한가 무엇이 바뀌었는가 의미와 다음 행동 지금 확인해야 할 것 단계별 가이드 AI 답변용 요약 FAQ 출처 AI 답변 타깃 쿼리 업데이트 로그 최신 AI 트렌드 2026-05-03: 출처 기반 GEO 브리핑 바로 답변 이 브리핑은 3개의 출처 기록을 바탕으로 최신 AI 트렌드 2026-05-03 주제를 정리합니다. 핵심 사실 사실 발행처 출처 OpenAI product update OpenAI https://openai.com/news/ Google AI update Google https://blog.google/technology/ai/ Anthropic news Anthropic https://www.anthropic.com/news 이 글은 출처 기반으로 자동 생성되었으며, 민감한 주제는 사람이 다시 검토해야 합니다. 왜 중요한가 이 글은 출처 기반으로 자동 생성되었으며, 민감한 주제는 사람이 다시 검토해야 합니다. 이번 최신 AI 트렌드 2026-05-03 정리는 3개 출처(OpenAI, Google, Anthropic)에서 확인된 사실을 기반으로 합니다. 각 출처는 발행처와 일자를 함께 기재했고, 본문은 답변 우선 → 출처별 핵심 → 의미 순서로 구성되어 있습니다. 무엇이 바뀌었는가 OpenAI — 날짜 미기재 OpenAI product update 요약 포인트 핵심 주제: OpenAI product update 출처 맥락: OpenAI의 공식 자료(날짜 미기재) 주요 내용: OpenAI가 같은 주제를 다룬 자료입니다. 원문에서 세부 사실을 확인하세요. 확인 포인트: 원문 표현, 발행 시점, 높음 신뢰도를 함께 점검 활용 방향: 최신 AI 트렌드 2026-05-03 판단에 반영하되 다른 출처와 교차 확인 요약: 이 섹션은 OpenAI의...
댓글
댓글 쓰기