Supply Chain · Watch Friday · 18 September 2026 End-of-day synthesis 4 watches · 15 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — CISA catalogs a third actively-exploited Linux kernel bug in one day as three unrelated npm stealer campaigns and a five-advisory wave of MCP-tooling disclosures round out a packed Friday.

Three Linux kernel bugs landed on CISA's KEV list today — an AF_ALG race condition, an ebtables SNAT out-of-bounds write, and now a TLS receive-path zero-length-record bug — all cataloged as actively exploited with the same September 21 due date.

The rest of the day kept the “abuse a trusted platform” theme running: three unrelated npm/GitHub credential-stealing campaigns (PhantomRaven, WeaselBiscuit, Rapuncel) surfaced within hours of each other, and five separate MCP-tooling advisories — spanning Obot, ToolHive, and Process Compose — disclosed SSRF, host-escape, and DNS-rebinding bugs in the gateways teams are standing up around agentic AI. Add an unauthenticated pickle-deserialization RCE in LMDeploy and an eight-advisory Grav CMS batch disclosure, and it's a day defined by mass coordinated disclosures rather than a single active campaign. Socket's one-year Shai-Hulud retrospective is a fitting bookend: the npm worm that started this cycle is now old enough for anniversary content, and its techniques are still the template.

→ Operational priority for the night patch kernels on internet-facing and multi-tenant hosts before the September 21 KEV due date, and if you run Obot, ToolHive, or Process Compose as an MCP gateway, update and egress-filter metadata endpoints tonight.

18:00 ET · First Watch

Critical · CISA KEV ·added 18:00 ET

CISA adds a third Linux kernel bug to KEV today — TLS receive-path zero-length record handling

A zero-length record retrieved from rx_list can bypass recvmsg()'s intended record-type handling in the kernel's TLS receive path, letting later records get processed under the wrong zero-copy and queuing assumptions; CISA catalogs it as actively exploited, due September 21. Paired with today's AF_ALG race condition and ebtables out-of-bounds write, that's three actively-exploited kernel paths — TLS, crypto sockets, netfilter — added to KEV in a single day. Prioritize kernel patching this week, starting with hosts terminating TLS at the kernel layer (kTLS).

Critical · GHSA ·added 18:00 ET

LMDeploy — unauthenticated RCE via pickle deserialization in handle_zmq_recv

LMDeploy's handle_zmq_recv deserializes incoming ZMQ messages with pickle before any validation, so anyone who can reach the distributed-inference socket gets remote code execution with no authentication. It shipped in the same disclosure batch as an SSRF bypass and a separate eval()-based RCE via untrusted quant_dtype — three RCE-class bugs in one LLM-serving framework on one day, and LMDeploy sits underneath a lot of self-hosted LLM inference right now. Patch immediately and firewall the ZMQ port from anything but trusted inference-cluster peers.

High · GHSA ·added 18:00 ET

Obot — SSRF via remote MCP server URL, one of five MCP-gateway advisories disclosed today

Obot fetches a registered remote MCP server's URL server-side with no destination validation — no loopback, RFC1918, or cloud-metadata guard — so a Power User registering a malicious MCP endpoint can pivot Obot into hitting internal services or 169.254.169.254. It landed alongside two more Obot MCP-registry bugs plus separate same-day disclosures in ToolHive (containerized MCP servers reaching host services via host.docker.internal) and Process Compose (browser DNS rebinding controlling local MCP tooling) — five MCP-platform advisories in one afternoon says the ecosystem standing up around agentic AI is still hardening its trust boundaries. If you run any of these as an MCP gateway, patch now and egress-filter metadata endpoints from anything that proxies user-supplied URLs.

High · GHSA ·added 18:00 ET

Grav CMS — RCE via .zip upload, one of eight advisories in a coordinated disclosure

Grav CMS extracts an authenticated user's uploaded .zip file without validating destination paths, so a crafted archive lands arbitrary — including executable — files outside the intended directory for remote code execution. It's one of eight Grav advisories published together, also covering an admin-privilege escalation via a missing super-admin guard, two separate detectXss() filter bypasses, and a path-traversal file-deletion bug — treat this as one mass-patch event, not eight separate fires. Update Grav now and check admin-panel upload logs for zip entries with path-traversal sequences in their names.

Context · Socket ·added 18:00 ET

Socket marks one year since Shai-Hulud's first npm appearance

Socket's retrospective marks a year since Shai-Hulud, the self-propagating npm worm that opened the current era of registry supply-chain attacks. Its playbook — credential harvesting, GitHub-repo-as-C2, automated propagation — is still the template showing up in this week's PhantomRaven and WeaselBiscuit campaigns; worth the read as a reminder that a year hasn't made the techniques stale, just more refined.

12:00 ET · Forenoon Watch

Critical · CISA KEV ·added 12:00 ET

CISA adds a Linux kernel AF_ALG race-condition bug to KEV

Linux kernel's AF_ALG socket handling has a race condition that lets concurrent writes to the same socket interleave unpredictably and corrupt its internal state, and CISA has catalogued it as actively exploited with a September 21 due date. This affects an open-source, widely-embedded component, not a single vendor product — patch kernels on internet-facing and multi-tenant hosts first.

Critical · CISA KEV ·added 12:00 ET

CISA adds a Linux kernel ebtables out-of-bounds write bug to KEV

The ebtables SNAT target has an out-of-bounds write reachable by rewriting an ARP sender hardware address into a spliced socket-buffer fragment, now catalogued as actively exploited with a September 21 due date; CISA's notes flag possible EoL/EoS exposure, so confirm your kernel line is still supported before assuming a straightforward patch path. Paired with today's other Linux KEV add (the AF_ALG race condition), that's two actively-exploited kernel bugs landing the same day — prioritize kernel patching across the fleet this week.

Critical · GHSA ·added 12:00 ET

XWiki — rendering-xml escaping gap allows profile-edit-to-RCE via macro injection

XWiki's rendering-xml module includes rendering output inside HTML macros without escaping it, so any user who can edit their own profile can close the HTML macro early and inject Groovy or Python script macros that execute with full programming rights — unrestricted read/write across the entire wiki. The bar for exploitation is a self-service profile edit, not an admin account or plugin upload. Patch to the fixed release now and audit recent profile edits and UIExtensionClass objects for injected macro syntax.

High · GHSA ·added 12:00 ET

Semantic MediaWiki — stored XSS via wikitext data-subtab attribute

Semantic MediaWiki's ext.smw.js parses the data-subtab attribute as JSON and writes the result straight into innerHTML, so any editor can plant stored XSS through ordinary wikitext without needing raw-HTML rights. That's a low-bar persistence primitive on a platform that's often an internal knowledge base with elevated trust. Patch the extension and grep recent wikitext revisions for data-subtab attributes carrying quote-encoded payloads.

High · GHSA ·added 12:00 ET

Opencast — stored XSS in Paella player via caption cue text

Opencast's Paella player appends WebVTT/DFXP caption cue text directly into innerHTML, so a non-admin who can upload a subtitle track gets stored JS that runs in every viewer's session the moment they enable captions — anonymous viewers included. The vulnerable caption plugins and the public /search/episode.json endpoint are both on by default, so this is exploitable out of the box on the 18.x-20.x lines. Patch, and audit recently uploaded caption tracks for embedded markup.

High · The Hacker News ·added 12:00 ET

WeaselBiscuit — new JS stealer spreads via 13 npm packages, harvests Chrome extension storage

OpenSourceMalware researchers found 13 npm packages delivering a previously undocumented stealer, WeaselBiscuit, built specifically to harvest Chrome extension storage — the same target surface as BeaverTail and OtterCookie, both tied to North Korea's Contagious Interview campaign. The functional overlap suggests either the same operators iterating or a close copycat reusing their playbook. Pull the package list from the writeup, grep node_modules across the fleet for the named packages, and flag any postinstall script touching Chrome extension storage paths.

High · BleepingComputer ·added 12:00 ET

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

An ongoing campaign publishes SEO-optimized GitHub repos impersonating well-known software vendors — this wave spoofs LastPass Authenticator — to distribute a new infostealer, Rapuncel. It's the GitHub-repo-as-distribution-channel pattern again: search-rank manipulation substitutes for typosquatting, and the trust signal is the vendor name in the repo title rather than a registry listing. Flag installs sourced from GitHub repos claiming to be vendor tools where the org doesn't match the real vendor, and watch for Rapuncel IOCs once they're published.

Medium · GHSA ·added 12:00 ET

Caddy — rewrite placeholder double-expansion, body-buffer DoS, and fileHidden bypass

Caddy 2.11.3 bundles three placeholder-layer bugs: a double-expansion in the rewrite handler that can leak env vars or file contents when an operator's rewrite URI ends in a bare '?' (CWE-94, the same bug class as CVE-2026-30852), an unbounded body-buffer DoS, and a case-sensitivity bypass in fileHidden matchers. Exploiting the first needs a specific rewrite config shape, which keeps this at medium rather than critical. If you patched CVE-2026-30852 already, check whether this variant slipped past that review, and audit Caddyfiles for rewrite directives ending in a bare query mark.

Context · The Hacker News ·added 12:00 ET

Transparent Tribe (APT36) runs C2 for new Rust backdoors through private GitHub repos

Zscaler ThreatLabz attributes a fresh campaign against government and defense targets in India and Afghanistan to Transparent Tribe (APT36), using four new tools — RUSTYSHADE, RUSTYMOVE, PSNATCH, BASHNATCH — with C2 run through private GitHub repositories instead of dedicated infrastructure. Not a package-registry attack, but it's the same 'abuse a trusted developer platform as C2/dropper infra' pattern showing up across both espionage and financially-motivated campaigns this year. If you haven't already, alert on outbound traffic to github.com and raw.githubusercontent.com from hosts with no legitimate reason to reach either.

06:00 ET · Morning Watch

High · The Hacker News ·added 06:00 ET

PhantomRaven — LLM-authored npm info-stealer published by a self-described bug-bounty hunter to force disclosures

CrowdStrike attributes npm packages disguised as ordinary devtools (transform-jsbi-to-bigint, sort-imports-es6-autofix, published under the jpdhellonpm1 / jpd15 accounts) to a financially motivated operator active since November 2022, and assesses with high confidence that the stealer itself — verbose comments, placeholder code, statistical token patterns — was written by an LLM. The operator harvests credentials and session data from installs, then uses that stolen data as unauthorized "proof of impact" to extort bounty payouts through legitimate platforms (Bugcrowd, Intigriti, YesWeHack, HackenProof, HackerOne), claiming hits against at least nine hospitality, retail, and tech targets. Grep your dependency tree for both named packages and anything else published by jpdhellonpm1 or jpd15, and flag any bug-bounty submission that cites data a researcher couldn't have obtained through authorized testing.