Supply Chain · Watch Thursday · 16 July 2026 End-of-day synthesis 4 watches · 13 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A trojanized-installer campaign, a self-propagating npm worm, and two same-day CISA KEV adds converged today — each one weaponizing a channel defenders trust by default.

CISA added Microsoft SharePoint's deserialization bug and two FortiSandbox command-injection CVEs to KEV within hours of each other today. Separately, Socket confirmed the Shai-Hulud npm worm resurfaced to breach AI-music startup Suno, exposing source that shows the company stream-ripped tracks to train its models.

The pattern underneath is trust in the channel, not the code: UAT-11795 is trojanizing WebEx and Zoom installers to drop Starland RAT — the same TTP shape as this week's AsyncAPI and Laravel-Lang campaigns, just aimed at commercial software instead of a registry. ClickLock does the low-tech version, a copy-pasted Terminal one-liner that locks macOS users out of their own apps until they hand over a password, while PhantomEnigma turned 20+ hijacked Brazilian government sites into a malware channel and Daxin's kernel rootkit resurfaced in Taiwan after four years — both riding on infrastructure defenders don't expect to blocklist. On the disclosure side, Envoy Gateway and the MCP Python SDK maintainers each shipped same-day patched releases for their respective advisory batches, proof that fast turnaround from disclosure to fix still happens on infrastructure-tier software, even as ArcadeDB's own privilege-escalation fix got bypassed within the same release cycle it shipped in.

→ Operational priority for the night patch on-prem SharePoint and FortiSandbox ahead of the 2026-07-19 BOD 26-04 deadline, and rotate any CI/registry tokens that touch Suno-adjacent repos before assuming Shai-Hulud stopped at the leak.

18:00 ET · First Watch

Critical · CISA KEV · added 2026-07-16 · Microsoft SharePoint ·added 18:00 ET

CISA adds CVE-2026-58644 to KEV: SharePoint deserialization vulnerability

CISA catalogued CVE-2026-58644 today — a SharePoint deserialization-of-untrusted-data bug (CWE-502) that gives an unauthenticated attacker code execution over the network. It's the same vulnerability class as the ToolShell chain that got hammered last year; a KEV add on this pattern usually means opportunistic scanning starts within days, not weeks. Patch on-prem SharePoint now — BOD 26-04 sets 2026-07-19 as the deadline, and that's a reasonable target even if you're not a federal agency.

Critical · CISA KEV · added 2026-07-16 · Fortinet FortiSandbox ·added 18:00 ET

CISA adds two FortiSandbox OS command injection CVEs to KEV the same day

CISA catalogued CVE-2026-25089 and its twin CVE-2026-39808 together today: unauthenticated OS command injection in FortiSandbox via crafted HTTP requests. A malware-detonation appliance that's itself remotely exploitable is the worst-case shape for a security product — it typically has broad network visibility precisely because it's trusted to inspect everything. Patch FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS before 2026-07-19; don't let its 'already isolated' reputation buy it extra time.

Critical · Socket · Shai-Hulud worm · Suno breach ·added 18:00 ET

Suno breached via the Shai-Hulud npm worm; leaked code shows AI-music scraping at scale

Shai-Hulud, the self-propagating npm credential-stealing worm, resurfaced to breach AI music startup Suno — and the exposed source shows Suno stream-ripped tracks to train its models, a second story riding inside the first. The worm mechanic is what matters operationally: Shai-Hulud spreads by stealing CI/CD and registry tokens, then republishing trojanized versions of the victim's own packages, so a breach like this usually means token compromise, not just a data leak. If your CI shares runners, secrets, or dependencies with Suno's toolchain, rotate npm/registry tokens and check your own published package versions for anything you didn't push.

Critical · GHSA · critical · go · envoyproxy/gateway ·added 18:00 ET

Envoy Gateway: Lua-based auth bypass discloses secrets; paired xDS info-disclosure bug in the same release

Envoy Gateway's EnvoyExtensionPolicy Lua integration has an authentication bypass (CVSS 9.1) that discloses secrets via crafted input, and a second bug (GHSA-22xc-xg2r-9j7v) leaks xDS control-plane data when running in GatewayNamespaceMode — both fixed in 1.8.1 (or 1.7.4 on the older branch). Envoy Gateway sits in front of production traffic to enforce exactly this kind of policy, so a bypass here is a control-plane compromise, not a routine data leak. Upgrade now and rotate any secret reachable through an affected EnvoyExtensionPolicy Lua filter.

High · GHSA · high · pip · mcp ·added 18:00 ET

MCP Python SDK: three disclosures land together — Host/Origin bypass, session hijack, cross-client task access

The official MCP Python SDK picked up three advisories in one batch: the WebSocket server transport skips Host/Origin validation (this one), HTTP transports serve session requests without verifying the authenticated principal (GHSA-jpw9-pfvf-9f58), and experimental task handlers let any client read or cancel another client's tasks (GHSA-hvrp-rf83-w775, mcp >=1.23.0). Together it's cross-client session and task confusion on any MCP server exposed past localhost — exactly the failure mode that starts mattering as MCP servers move from local dev tools to shared, multi-tenant deployments. Pin mcp to 1.28.1+, and if you can't patch immediately, enforce Host/Origin checks at the reverse proxy in front of any MCP server you run.

High · GHSA · high · maven · com.arcadedb:arcadedb-engine ·added 18:00 ET

ArcadeDB: six advisories, and the privilege-escalation fixes keep getting bypassed within the same release cycle

ArcadeDB shipped six advisories together, and they chain: trigger scripts still allow java.lang.* for OS command execution (this one), the scripting authorization gate meant to close that same door was itself bypassed via DEFINE FUNCTION ... LANGUAGE js (GHSA-vwjc-v7x7-cm6g) — and that gate (GHSA-48qw-824m-86pr) was already a fix for an earlier privilege-escalation bug. Round out the batch with a reader-role schema-mutation bug, an IMPORT DATABASE SSRF/file-read, and a cross-database IDOR on /ts/* and /batch/*. If you run ArcadeDB, upgrade to 26.7.2 and don't treat the reader role as a security boundary until a release goes by without a bypass.

High · GHSA · high · go · nuclio/nuclio ·added 18:00 ET

Nuclio injects unsanitized repository URLs into a generated Gradle build file — RCE before the function ever runs

Nuclio, the serverless function platform, drops runtimeAttributes.repositories unsanitized into a generated build.gradle, so a malicious function spec gets code execution during the Gradle build itself, via plugin/repository resolution — before any runtime sandboxing applies. Build-time RCE is a supply-chain vector by construction: it runs upstream of the artifact and can poison it before deployment. Upgrade past 1.16.5, and treat any build pipeline that accepts user-supplied repository URLs with the same suspicion as a webhook payload.

High · GHSA · critical (GHSA rating) · composer · pheditor/pheditor ·added 18:00 ET

Pheditor: hardcoded 'admin' password, plus two ways around its terminal command whitelist

Pheditor ships a hardcoded default password of 'admin' with no forced change (CVSS 9.8, unauthenticated full compromise), and separately, an authenticated terminal feature can be reached around its command whitelist two different ways — GHSA-9643-6xjp-vx57 bypasses the whitelist directly, GHSA-wg4w-wr5q-6vjc escapes it via pipe/backtick/newline injection. Low-adoption composer package, but the hardcoded credential alone means full compromise on first boot for anyone running it unmodified. Patch to 2.0.6+, and don't treat the terminal whitelist as a security boundary even after patching.

12:00 ET · Forenoon Watch

High · BleepingComputer · UAT-11795 · Starland RAT ·added 12:00 ET

UAT-11795 trojanizes WebEx and Zoom installers to push a new Starland RAT for credential and crypto theft

A financially motivated Russian threat actor tracked as UAT-11795 is distributing trojanized WebEx and Zoom installers that drop a new backdoor, Starland RAT, built for credential and cryptocurrency theft. It's the same trojanized-installer shape as this week's AsyncAPI and Laravel-Lang campaigns, just aimed at commercial conferencing software instead of a package registry — verify installer hashes against vendor-published checksums before pushing WebEx/Zoom updates fleet-wide, especially to machines with browser-stored credentials or crypto wallets.

Context · The Hacker News · macOS · ClickLock Stealer ·added 12:00 ET

ClickLock: new macOS infostealer coerces the password out of victims by killing their apps every 210ms until they comply

ClickLock arrives as a copy-pasted Terminal one-liner — the same delivery vector as the 'fix your build' social-engineering lures showing up against npm/PyPI users — and when a victim declines its fake system-update password prompt, it kills Finder, Dock, Spotlight, Terminal, and Activity Monitor on a 210ms loop until they type it in. Two LaunchAgents persist past the next login, so anyone who ran an unfamiliar paste-and-run command recently should check ~/Library/LaunchAgents for unrecognized entries rather than trust a clean reboot.

Context · The Hacker News · Brazil · PhantomEnigma ·added 12:00 ET

PhantomEnigma campaign turns 20+ hijacked Brazilian government sites into a malware delivery channel

ANY.RUN traced more than 20 compromised Brazilian government domains back to a single PhantomEnigma operation, surfacing a previously undocumented backdoor and shared infrastructure tying the sites together. Government TLDs carry inherited trust that makes them effective droppers precisely because defenders don't expect to blocklist them — if you allowlist .gov.br or similar by policy, treat that allowlist as compromised until the campaign's full domain list is published.

Context · The Hacker News · Taiwan · Daxin / Stupig ·added 12:00 ET

Daxin kernel-mode rootkit resurfaces in a Taiwan manufacturing firm after four years, alongside a new pre-login SYSTEM backdoor dubbed Stupig

Daxin (srt64.sys), the China-linked kernel rootkit Symantec first documented in 2022, has turned up active again inside a Taiwan manufacturing target — this time paired with Stupig, a previously unreported backdoor that gets SYSTEM-level access before Windows login completes. Manufacturing-sector IR teams should treat any unexplained kernel driver on a Windows host as a Daxin candidate and prioritize pre-boot/pre-login authentication telemetry, since that's exactly the window Stupig operates in.

06:00 ET · Morning Watch

High · GHSA · critical (GHSA rating) · composer · mantisbt/mantisbt ·added 06:00 ET

MantisBT: printf-based half of the admin/install.php reflected-XSS disclosure

The printf-based twin to last night's print_test_result() disclosure (GHSA-77x8-3v3h-hrhv): six more unauthenticated reflected-XSS injection points in admin/install.php, this time via an unescaped printf format string instead of a missing output-encoding call. Same CSP gap drives the real exploit path — script-src 'self' blocks inline JS but there's no form-action directive, so a crafted URL renders a fake admin login form or open-redirects the victim rather than running classic inline-script XSS. If you haven't already pulled /admin per MantisBT's post-install guidance for the companion advisory, this closes the other half of the same exposure — do it now.