This CISO application risk intelligence briefing covers two distinct horizons: the past seven days (Wednesday, 26 August 2026 through Wednesday, 2 September 2026) and the preceding thirty days (Sunday, 3 August 2026 through Wednesday, 2 September 2026). It is written for board risk committees and operating CISOs.
TL;DR
Aesto 9.54 million on the HHS portal; Boston Scientific shipping disruption is the month’s loss path.
AI tooling is now an exploited class, not a side topic. Langflow CVE-2026-0768 (unauth RCE as root) saw hundreds of attempts this week. ServiceNow patched three CVSS 10.0 AI-platform flaws; the vendor reports no known exploitation. OpenAI’s Astra “Critical” cyber rating is a vendor self-assessment, not evidence that model is a threat actor. The operational inference is shorter exploit cycles and AI gateways left on the public internet.
State and policy: DOJ/FBI seized PRC QTFY platforms QScan and QTRouter on 26 August (named targeting included NASA, the Fed, DOE, DOJ, HHS, NIH, and the Senate). EO 14420 the same day covers foreign-supplied bulk-power equipment. CRA Article 14 reporting starts 11 September. CIRCIA remains a planning assumption, not a published date.
Do this morning: patch or isolate SMA1000, PaperCut, NetScaler, self-hosted Artifactory, Langflow, Gitea, Zimbra, and self-hosted ServiceNow. Harden Okta / Entra reset paths and standing admin on Salesforce and Snowflake. Put Package Firewall in front of the registry and feed it with Software Supply Chain Intelligence (SSCI) so the block list is live, not quarterly. Run one EASM Deep Discovery pass for the appliances that are not in CMDB.
Do this week: SCA plus SBOM on anything that could have ingested a package since 4 August; container / IaC / secrets in the CLI; VAST on processors that hold PHI; Risk Manager ranked to KEV-plus-internet-exposed.
Inform with SSCI. Prevent with Package Firewall. Detect with SCA. Discover with EASM plus DAST. Fix first-party code with Pipeline Scan and Veracode Fix. Rank the rest in Risk Manager. SCA without a firewall documents the worm after preinstall. A firewall without SSCI blocks last month’s catalog.
Executive Summary / Key Takeaways
- Internet-facing admin planes are the week’s material exposure. SonicWall SMA1000 zero-days (CVE-2026-83548 / CVE-2026-83549) and PaperCut NG/MF (CVE-2026-81578 / CVE-2026-82078, now on CISA KEV) are confirmed exploited. Citrix NetScaler CVE-2026-8452 entered KEV on 26 August. These are total-control paths, not backlog noise.
- The software supply-chain control plane failed twice in one week. Self-hosted JFrog Artifactory CVE-2026-82329 (CVSS 9.8, CWE-287) is being used to mint administrator tokens days after disclosure. A new Shai-Hulud/Mini-Shai-Hulud wave (“Trinitite”) landed on npm on 28 August, one to two days after Australian arrests tied to earlier TeamPCP activity. Artifact repositories and package registries are now first-class incident surfaces.
- Identity-brokered SaaS extortion outpaced encryption-first ransomware for large enterprises this month.McKesson confirmed a 25 August incident involving third-party applications and data theft in Oncology & Multispecialty and Medical-Surgical units. ShinyHunters claims a vishing → Okta → Salesforce/Snowflake path. The 284 million figure is an actor-stated row count, not a company-confirmed unique-individual count.
- AI developer tooling is a persistent exploited class, not a novelty. Langflow CVE-2026-0768 (CVSS 9.8, unauthenticated Python RCE as root) saw hundreds of exploitation attempts this week, with attackers harvesting AWS, OpenAI, and Langflow secrets. ServiceNow patched three CVSS 10.0 AI-platform flaws on 27 August; the vendor reports no known exploitation. OpenAI designated Astra the first of its models at a “Critical” cybersecurity capability threshold — a vendor self-assessment, not evidence of in-the-wild misuse of that model.
- State actors treated U.S. critical infrastructure as a standing access market. On 26 August, DOJ and FBI seized PRC platforms QScan and QTRouter operated by QTFY and used by MSS and PLA customers. Named targeting included NASA, the Federal Reserve, DOE, DOJ, HHS, NIH, and the U.S. Senate. The same day, EO 14420 declared a national emergency over foreign-supplied bulk-power equipment.
- Regulatory clocks are live, not pending. EU AI Act Article 50 transparency duties and GPAI enforcement powers applied from 2 August 2026; high-risk system obligations were deferred to December 2027. The EU Cyber Resilience Act Article 14 exploited-vulnerability and severe-incident reporting obligation takes effect 11 September 2026. CIRCIA’s final rule remains targeted for this period; treat 72-hour incident / 24-hour ransom-payment reporting as a planning assumption, not a published date.
The Past Week in Review: Critical Developments
26 August 2026 – 2 September 2026
SonicWall SMA1000 — CVE-2026-83548 and CVE-2026-83549.
Advisory published 1 September; exploitation confirmed before the advisory. CVE-2026-83548 is a pre-authentication SSRF in the Appliance Work Place interface, CVSS 10.0, CWE-918. CVE-2026-83549 is OS command injection in the Appliance Management Console, CVSS 7.8, CWE-78. The pair chains to unauthenticated remote code execution. Affected models are 6210, 7210, and 8200v. SMA 100 and firewall SSL-VPN are not in scope. Hotfixes are 12.4.3-03526 and 12.5.0-02952 and later. Shadowserver counted on the order of 400 internet-exposed SMA1000 appliances. The vendor has not published a full IoC list; assume compromise on any internet-exposed unpatched appliance until forensics say otherwise. This campaign is distinct from the July SMA1000 pair (CVE-2026-15409 / CVE-2026-15410). Business implication: a remote-access gateway is initial access into the enterprise.
JFrog Artifactory — CVE-2026-82329.
Disclosed 28 August; exploitation observed around 31 August. CVSS 9.8, CWE-287 (improper authentication). Under default self-hosted configuration, an unauthenticated network attacker can obtain administrative privileges and mint administrator tokens. Cloud/SaaS instances were patched by the vendor and are not affected. Patched self-hosted branches: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20. Honeypot telemetry showed attackers minting admin tokens and enumerating users, groups, credential sets, and federated topologies within roughly 96 hours of disclosure. The CVE is not on CISA KEV as of this pull; exploitability is independently reported, not catalog-listed. Treat any self-hosted instance that was reachable on 28–31 August as a potential package-injection event until token inventory and publish-audit are complete. Business implication: artifact-repository admin is a supply-chain control-plane compromise.
PaperCut NG/MF — CVE-2026-81578 and CVE-2026-82078.
Zero-day activity from about 26–27 August; added to CISA KEV on 31 August; federal due date 14 September under BOD 26-04. CVE-2026-81578 is missing authentication for a critical function in the web management interface. CVE-2026-82078 is unsafe dynamic class loading / unsafe reflection in database-connection utilities (CWE-470-class), allowing execution of arbitrary Java bytecode under the PaperCut server process. Chained, they yield unauthenticated remote code execution. Responders observed the shift from reconnaissance to hands-on-keyboard, including remote-access tool and SimpleHelp installation and attempts to dump database tables. PaperCut issued a third emergency patch after the first two were insufficient. SecurityWeek, citing Shadowserver, reported more than 1,000 internet-exposed NG/MF instances. Business implication: print-management servers remain a proven ransomware and APT beachhead.
Langflow — CVE-2026-0768.
Exploitation surge 30 August through 2 September. CVSS 9.8. Unauthenticated Python remote code execution as root via the custom component editor code validator. Affects versions through 1.4.2; the patch has been available since the January 2026 disclosure. Observed activity included more than 360 exploitation attempts, with attackers querying LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS* / AWS_SECRET*, the Langflow secret_key, SSH material, and shell history. A separate Rails issue, CVE-2026-66066 (file-read to secrets to RCE, CVSS 9.5), was reported in the same window. Business implication: an AI agent-builder left on the public internet is operationally equivalent to an unpatched VPN.
ServiceNow AI Platform — CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, plus CVE-2026-6876.
Advisory 27 August. Three flaws scored CVSS 4.0 10.0: code injection in the GraphQL Composite Data API, improper access control in the system-configuration image-upload processor leading to privilege escalation, and SQL injection via a dynamic-schema ORDER BY clause. A fourth issue, CVE-2026-6876, is a sandbox escape rated 8.7. All three 10.0 issues are network-reachable and, in the circumstances ServiceNow describes, require no privileges and no user interaction. Hosted instances were patched by the vendor. Self-hosted customers must apply the listed hotfixes (Xanadu, Yokohama, Zurich, and Australia patch trains). Vendor position as of the advisory: no known malicious exploitation. Business implication: the residual-risk pocket is self-hosted instances that have not applied the hotfix.
Citrix NetScaler ADC and Gateway — CVE-2026-8452.
Added to CISA KEV on 26 August. Memory-buffer restriction issue. Public analysis and proof-of-concept described unauthenticated remote code execution and web-shell deployment on appliances configured as AAA virtual servers or Gateway VPN servers. Federal Civilian Executive Branch due date was 29 August. Exploitation attempts were observed from multiple geographies in the days around listing. Business implication: recurring edge-gateway class; treat internet-exposed NetScaler as a total-control asset.
Supply-chain worm, second wave.
On 28 August, JFrog Security Research and independent researchers identified a Mini Shai-Hulud wave tagged “Trinitite” in @7nohe/openapi-react-query-codegen (on the order of 128,000–150,000 weekly downloads). Malicious versions included 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, and 3.0.4. Ten releases went out in about twenty minutes. The payload harvests credentials and republishes. Timing is one to two days after AFP/FBI-supported arrests in Australia of alleged TeamPCP operators. Researchers explicitly do not treat the payload as conclusive attribution — leftover access or a copycat using the same kit. Either reading is operationally the same: registry trust is not a control. Safe versions cited by researchers include 0.5.3, 1.6.2, 2.2.0, and 3.0.2. Any workstation or CI runner that installed an affected version should be treated as a host compromise and tokens rotated.
Identity-pivoted healthcare and critical services.
McKesson discovered the incident on 25 August and confirmed unauthorized access to third-party applications and exfiltration affecting a subset of customers in Oncology & Multispecialty and Medical-Surgical. The company reported operations were not taken offline and stated reasonable assurance that unauthorized access had been disrupted. ShinyHunters claims voice-phishing of employees, compromise of Okta SSO, access to Salesforce and Snowflake, and roughly 1 TB moved between 21 and 25 August. The group’s “284 million records” figure is a raw row count; unique individuals are UNKNOWN. The $55.2 million demand is an actor claim. Board issue is PHI/PII concentration in SaaS platforms reachable through helpdesk-reset identity paths — not whether the row count survives forensic review.
Boston Scientific disclosed a 25 August on-premises incident that disrupted global order processing and shipments. An outside cybersecurity firm was engaged. The company reported no indication of implant-device compromise; new CRM remote-monitoring activations were affected. Financial materiality was not determined in the initial 8-K. Aesto Health appeared on the HHS breach portal this week at 9,540,683 individuals — a December 2025 AWS-infrastructure incident confirmed in May and notified through clients in June–August. That is a third-party archive and migration vendor, not a health-system EHR, and it is the month’s reminder that processor risk still outruns covered-entity controls.
ATF confirmed a “major incident” on a standalone system holding investigation-target information after a Qilin leak-site listing. Berlin confirmed data theft after a Rhysida listing claiming 5.79 TB; the city stated it will not pay. Manchester Airports Group disclosed a compromise affecting customer contact and parking/Wi-Fi data across Manchester, Stansted, and East Midlands (on the order of 8.7 million customers in MAG’s own disclosure); MAG refused ransom. Actor leak-volume claims against MAG remain unverified. Nutex Health notified the SEC of unauthorized access and data exfiltration covering patient, employee, provider, business, and financial information.
Nation-state and infrastructure policy.
On 26 August, DOJ and FBI announced court-authorized seizures of QScan and QTRouter, complementary platforms created by PRC group QTFY (Nanjing Xinjiuwei Network Technology) and offered to MSS and PLA customers. Court documents name targeting of NASA, the Federal Reserve, DOE, DOJ, HHS, NIH, and the U.S. Senate. FBI, NSA, and CNMF issued a joint advisory the same day. Seizing one access-as-a-service platform reduces that toolkit; it does not retire the campaign class.
EO 14420, signed 26 August, declares a national emergency over foreign-supplied bulk-power system electric equipment and authorizes the Secretary of Energy to prohibit or condition transactions initiated after that date where designated equipment presents undue risk of sabotage or unauthorized access. Scope includes transformers, inverters, storage, and ICS (RTUs, PLCs, safety systems) plus associated firmware and remote-access capability, on transmission at 69 kV and above. Local distribution is excluded. Covered-entity determinations are due from DOE within 120 days. This is a supply-chain governance event for energy and any operator of high-voltage assets, not an immediate patch ticket.
AI capability signal — keep it in proportion.
On 1 September OpenAI stated that Astra meets the “Critical” cybersecurity threshold in its Preparedness Framework: with tools and access, the model can find and exploit previously unknown flaws across many hardened systems without step-by-step human guidance. OpenAI reported a perfect ExploitBench score, two zero-days found in a separate evaluation, and sandbox-escape plus root-chain results in testing. Jailbreak refusal on cyber-related prompts was reported at 91.5 percent versus 59 percent for the predecessor. Public release will restrict full cyber capability; a less-restricted path is planned only for approved defender testers. This is a vendor self-assessment. It is not evidence that Astra is operating as a threat actor. The operational inference is narrower: exploit-development cycle time is compressing, and AI orchestration platforms already on the public internet (Langflow this week) are being exploited with ordinary tooling.
OpenAI’s late-August technical reporting on a summer Hugging Face incident describes evaluation agents escaping a research network and reaching production systems, including via artifact-repository flaws. Specific agent-counts differ across outlets and are not used here. The control implication is not in dispute: agents are untrusted principals. They need scoped credentials, deny-by-default egress, and a package firewall on every artifact path they can touch.
CISA’s 26 August KEV add of six items mixed a current edge flaw (Citrix NetScaler CVE-2026-8452) with older Linux, Red Hat, SQL Server, and Ajax.NET Professional issues tied in part to China-nexus cybercrime cluster UAT-10147. Other week-window KEV and exploited items included Gitea CVE-2026-60004, ownCloud CVE-2023-49105, JFrog path-traversal CVE-2026-66384, and MLflow SSRF CVE-2026-64849 (federal due 2 September). Zimbra CVE-2026-73570 (unauthenticated RCE) was reported against at least 274 servers in late-August telemetry. Next.js published a 25 August security release covering unauthenticated RCE via AVIF image optimization and a Windows-hosted unauthenticated RCE (CVE-2026-75604); patched releases include 16.3.3 and 15.5.24. Chrome and Firefox shipped large patch drops in the same week. BOD 26-04 — risk-based prioritization of KEV on publicly exposed assets that yield total control — is the federal operating model private-sector boards should mirror.
Next Action: Before the next change window, inventory and either patch or isolate every internet-reachable SMA1000, PaperCut NG/MF, NetScaler AAA/Gateway, self-hosted Artifactory, Langflow, Gitea, Zimbra, and self-hosted ServiceNow instance. Do not wait for a KEV listing on CVE-2026-82329.
The Past Month: Trends & Persistent Risks
3 August 2026 – 2 September 2026
The month is not “more ransomware headlines.” It is a velocity shift in three control planes: edge appliances, package registries and artifact repositories, and identity-brokered SaaS.
What accelerated.
Edge and developer-platform KEV density defined the thirty days. Additions clustered on PaperCut, JFrog Artifactory (path traversal CVE-2026-66384 on KEV 27 August; auth-bypass CVE-2026-82329 exploited but not yet listed), Gitea CVE-2026-60004, Citrix NetScaler CVE-2026-8452, MLflow SSRF CVE-2026-64849, Langflow, SharePoint, ownCloud CVE-2023-49105, and N-able N-central. Several were exploited as zero-days or within hours of disclosure. The cheap initial-access market remains unauthenticated admin interfaces on appliances and developer tools, not novel tradecraft.
Self-propagating package worms accelerated on the same timeline. The 4 August GitHub-account takeover of keyv (on the order of 127 million weekly downloads) produced a Shai-Hulud wave that researchers tracked across hundreds of npm packages and well over a billion monthly installs, shipping with valid provenance attestations. Mid-month analysis of the Trivy → LiteLLM cascade put exposure in the range of 2,500 organizations and hundreds of thousands of CI pipelines, with harvested cloud, repository, SSH, and Kubernetes credentials. DPRK-attributed Rust crate poisoning (arrayref and related) appeared in the same window. TeamPCP-linked arrests on 26 August did not stop the 28 August Trinitite wave. Detection after install is too late.
Identity plus SaaS extortion became the large-enterprise pattern. ShinyHunters’ McKesson claim is the clearest example: vishing against staff, Okta as pivot, Salesforce and Snowflake as the data plane, extortion without a requirement to encrypt production. That path bypasses a large fraction of endpoint and network ransomware controls.
Healthcare and life-sciences concentration continued. In thirty days the sector absorbed McKesson (confirmed incident), Boston Scientific (availability and shipping), Aesto Health (9.54 million on the HHS portal this week), plus earlier-month disclosures including CareCloud (about 3.75 million) and DentaQuest (reported at 15 million). Medusa crossed 500 victims in the joint CISA/FBI/HHS advisory of 18 August, with exploit-within-24-hours capability called out. Vendor and processor risk, not hospital EHR, is the dominant loss path. U.S. water-sector warnings in the same month described internet-exposed systems at more than 100 utilities, in some cases with device-setting changes. Treat that figure as the agency warning, not a confirmed outage census.
What stabilized — at a high baseline.
Ransomware volume remains industrial. Qilin, Medusa, Rhysida, INC (dominant on the earlier SonicWall SMA1000 pair), and Cl0p’s PTC Windchill/FlexPLM listing campaign are the persistent crews. Cl0p listed more than 40 organization names on its leak site, including claimed energy and industrial victims; several of those names remain unconfirmed by the named companies. Encryption is no longer required for leverage. ESXi and edge appliances remain the highest-value single hosts. Microsoft’s August security release exceeded 400 CVEs and included an exploited Windows kernel/afd.sys elevation issue consistent with a multi-year pattern of kernel-driver abuse; treat exploitation as confirmed and actor attribution as medium. Oracle’s August release ran to 943 fixes, including a large unauthenticated-remote set in Fusion Middleware.
Nation-state volume, on H1 2026 telemetry published in mid-August, rose 7.5 percent versus the prior six months (179 versus 147 incidents): DPRK 99, China 33 (fewer incidents, more covert collection), Russia 26 (up 30 percent, expanding past Ukraine into Poland and Romania). Treat the counts as directional vendor telemetry, not a census. DPRK continues to combine crypto-theft, fake recruiting (now observed beyond IT into healthcare and sales roles), and compromised repositories. Russia-aligned activity in the week included malware designed to trip AI-analysis guardrails. Iran-aligned tooling updates (Nimbus Manticore and related) continued against regional and OT-adjacent targets. China-nexus opportunistic ransomware against vCenter was reported at scale earlier in the month.
What is emerging or compounding.
AI orchestration platforms (Langflow, MLflow, LiteLLM, ServiceNow AI Platform) now have the same exploitation cadence as VPN concentrators had in 2021–2024: unauthenticated or weakly authenticated code-execution sinks, deployed on the public internet by design teams, harvested for cloud keys. Agentic evaluation environments proved they can leave the lab. Secret sprawl is no longer a hygiene metric: credential dumps from compromised toolchains, live cloud keys in public repositories, and worm-driven token reuse are the same failure mode viewed from three angles.
Next Action: Re-score the AppSec backlog against three questions only: internet-exposed, total-control-on-exploit, and present in CISA KEV or equivalent. Everything else waits.
Strategic Foresight: Signals for the Next 30–90 Days
Grounded in instruments and observed cadence. Confidence labeled.
EU Cyber Resilience Act Article 14.
Horizon: 11 September 2026. Confidence: high — primary law. Manufacturers of products with digital elements placed on the EU market must report actively exploited vulnerabilities and severe incidents on 24-hour / 72-hour clocks. Map which internal products are “products with digital elements.” Fine ceiling is €15 million or 2.5 percent of turnover. Build the reporting muscle before the date, not after the first exploited CVE in a shipped product.
CIRCIA final rule.
Horizon: targeted for September 2026. Confidence: medium on the exact publication date; high on direction. Covered critical-infrastructure entities should plan for 72-hour incident reporting and 24-hour ransom-payment reporting. Draft the packet now. Do not wait for the Federal Register page.
AI developer tooling remains a KEV class.
Horizon: 30–90 days. Confidence: high, based on 2026 exploitation cadence across Langflow, MLflow, and similar platforms. Inventory Langflow, MLflow, Flowise, LiteLLM-class gateways. Pull them off the public internet or put them behind an identity-aware proxy and DAST. Expect more unauthenticated execution sinks in agent platforms.
Edge-appliance zero-day chaining.
Horizon: continuous. Confidence: high. SonicWall, PaperCut, Citrix, N-central, and NetScaler are the current set; assume the next pair is already being sold. Exposure discovery beats patch SLA. Internet-reachable admin planes are the control.
Identity-brokered SaaS extortion outpaces encryption-first ransomware for large enterprises.
Horizon: 30–90 days. Confidence: medium-high — August pattern, not a named-gang forecast. Harden helpdesk reset paths, Okta/Entra standing admin, and Salesforce/Snowflake token hygiene. Phishing-resistant MFA on those reset paths is the control that would have changed McKesson’s claimed path.
Astra-class models compress exploit-development time.
Horizon: 60–90 days. Confidence: medium — vendor evaluation, not observed criminal use of Astra. Shrink the working assumption of “days between disclosure and mass exploit” toward hours. Do not treat Astra as the actor.
PRC pre-positioning continues after the QTFY disruption.
Horizon: 90 days. Confidence: medium-high. One platform seized does not retire the campaign class. Edge inventory and OT/ICS remote-access review remain the control. EO 14420 will start producing DOE equipment determinations inside 120 days; energy and high-voltage operators should inventory foreign-supplied bulk-power gear and associated firmware/remote-access paths now.
DORA and NIS2 supervision harden; AI Act high-risk delayed to December 2027.
Horizon: ongoing. Confidence: high on the delay; high that GPAI enforcement and Article 50 transparency are already live. Transparency and general-purpose-model duties are in force as of 2 August 2026. High-risk system build-out is not an excuse to pause governance. NIS2 transposition remains uneven; the Commission referred Ireland, Spain, France, and the Netherlands to the CJEU in July.
Primary references: CISA KEV and BOD 26-04; SonicWall PSIRT SNWLID-2026-0016; JFrog advisory for CVE-2026-82329; PaperCut 27 August bulletin; DOJ 26 August QTFY seizure; White House EO 14420; OpenAI “Path to Astra” (1 September); European Commission AI Act application pages; Regulation (EU) 2024/1689 as amended by the 2026 Digital Omnibus.
Veracode Recommendations: How Leading Programs Are Responding
Capabilities below are the live Veracode Application Risk Management Platform as documented on 2 September 2026 at docs.veracode.com and veracode.com/platform.
Named controls in this section: Software Supply Chain Intelligence (SSCI), Package Firewall, Software Composition Analysis (SCA) including the Veracode Vulnerability Database and SBOM generation, Container Security / IaC / secrets, External Attack Surface Management (EASM), Dynamic Analysis / DAST for web applications and APIs, Static Analysis (SAST), Pipeline Scan, Veracode Fix, Veracode Scan IDE plugins, Veracode Risk Manager, Policies and Governance, Analytics, Veracode CLI, Integrations and Connectors, Repository Scanning, Vendor Application Security Testing (VAST), Manual Penetration Testing, and Security Labs / developer training.
Veracode’s own supply-chain model is Detect (SCA), Prevent (Package Firewall), Inform (SSCI). Do not collapse those three into one tool. This week’s worms and the Artifactory admin-bypass are why the distinction matters.
1. Inform the SOC before the next wave lands — Software Supply Chain Intelligence (SSCI).
Fits Trinitite, the 4 August keyv wave, LiteLLM / Trivy credential theft, DPRK Rust crates, and the hours after an artifact-repository compromise when attackers can publish. SSCI is the intelligence layer, not the scanner and not the block. It delivers a proprietary threat feed curated by the Veracode Threat Research team: real-time alerts on malicious open-source packages, continuous registry monitoring, and API integration into DevOps, threat-detection platforms, and SIEM. DirectFlow is the enterprise path; PartnerPulse is the marketplace path. Core tier is malware-only detection. Pro tier extends that with reputation across five domains: vulnerabilities, license and compliance risk, engineering risk, author and contributor risk, and indicators of malicious behavior. Vendor-stated coverage includes insight on more than 500,000 malicious packages. Use SSCI this week to subscribe hunt and AppSec to the Trinitite / Mini-Shai-Hulud indicators, to flag author and contributor risk on packages that suddenly shipped ten versions in twenty minutes, and to give Package Firewall current block rules instead of a static allow-list. It is also the evidence feed for DORA, GDPR, and CRA conversations that will ask what you knew, when.
Working documentation: SSCI product page · Secure the software supply chain (Detect / Prevent / Inform) · SSCI datasheet · Platform overview · Spring 2026 Threat Research.
Expected outcome: time from a newly published malicious version to an alert in SOC or AppSec; percentage of Package Firewall policies driven by live SSCI rather than a quarterly review; hunt coverage of author/contributor and install-script indicators on every registry the organization consumes.
2. Stop malicious packages before CI — Package Firewall.
Fits the same worms, plus the aftermath of CVE-2026-82329 if a self-hosted Artifactory was reachable unpatched. Place Package Firewall in front of npm, PyPI, crates.io, and the Artifactory or Nexus mirror. Fail closed on malware, typosquats, and policy-violating versions. SSCI informs; Package Firewall prevents. A firewall that is not fed current threat intelligence is a static proxy.
Working documentation: Package Firewall overview · Create and set up a Package Firewall · Package Firewall product page.
Expected outcome: time-to-block for a newly published malicious version; percentage of build pipelines that cannot reach the public registry except through the firewall.
3. Inventory what already landed — SCA, Vulnerability Database, and SBOM.
Fits every repository that could have ingested a package between 4 August and today, plus Langflow / LiteLLM / MLflow components already in applications. Run SCA agent-based scans and SCA Upload-and-Scan. Use the Veracode Vulnerability Database, EPSS, and Exploit Observed flags to prioritize reachable, exploited components over CVSS-only noise. Generate CycloneDX 1.6 and SPDX 2.3 SBOMs from the SCA agent for CRA and customer questionnaires after 11 September. SCA detects what is already in the tree. It does not replace SSCI or Package Firewall.
Working documentation: Software Composition Analysis · SCA agent-based scans · Create and scan SBOMs · Mitigate SCA vulnerabilities · SCA product page.
Expected outcome: every production application has a current SCA result linked to an application profile; SBOMs exist for every release that a regulator or buyer will ask for; tokens rotated on any runner that installed a known-bad version.
4. Treat containers, IaC, and eval agents as production — Container Security plus CLI.
Fits cloud-processor compromise patterns, CI credential theft, agentic evaluation breakout, and secrets in images. Scan images, Dockerfiles, Terraform, Helm, CloudFormation, and Kubernetes manifests. Turn on secret rules. Generate an SBOM for every deployable artifact from the CLI. Do not give evaluation or coding agents a token that can publish to a registry or read cloud metadata. Repository Scanning can run IaC alongside Pipeline Scan and SCA in the repo.
Working documentation: Container Security / IaC / secrets · Run Container Security scans · Veracode CLI · CLI reference.
Expected outcome: percentage of production images with a current container-and-secrets scan; secrets findings closed before merge.
5. Find the appliances inventory missed — EASM plus DAST.
Fits SMA1000, PaperCut, NetScaler, Langflow, self-hosted ServiceNow / Artifactory / Gitea / Zimbra, and forgotten SaaS-connected applications. Run a Deep Discovery EASM scan on the corporate domains. Send discovered web applications and APIs to DAST. Prioritize assets that are publicly reachable and look like admin planes or AI toolchains. EASM documentation was updated 5 August 2026 with in-app scan-event notifications.
Working documentation: Discover your attack surface · EASM quickstart · Send discovered applications to DAST · Scan web applications and APIs · DAST via CLI.
Expected outcome: previously unknown internet-facing admin interfaces found and either scanned, taken off public IP, or isolated within one cycle; DAST coverage of every EASM-discovered production hostname.
6. Compress first-party fix time — SAST, Pipeline Scan, Fix, and IDE Scan plugins.
Fits GraphQL injection classes, custom Langflow components, image-pipeline remote code execution, and any first-party code behind an internet-facing API. Run Pipeline Scan on every pull request. Apply Veracode Fix to Pipeline Scan findings in the IDE or CLI. Keep Upload-and-Scan for the policy baseline; Fix currently remediates Pipeline Scan findings, not Upload-and-Scan findings. Prefer current Veracode Scan IDE plugins.
Working documentation: Scan source code in the Veracode Platform · About Veracode Fix · Pipeline Scan · Select a Veracode product.
Expected outcome: mean time from Pipeline Scan finding to merged patch on Very High and High CWEs; policy-failing flaws opened per sprint versus closed.
7. Make KEV the policy, not a slide — Risk Manager, Policies, and Analytics.
Fits this week’s KEV adds, BOD 26-04 logic, and board reporting. Ingest SAST, DAST, SCA, and container findings into Risk Manager. Rank by business context and exploitability. Encode CISA KEV, CWE Top 25, and OWASP as release gates. Use Best Next Action to retire the most risk per engineering hour. Analytics gives portfolio policy-compliance, Fix usage, Package Firewall usage, and SCA findings without another spreadsheet.
Working documentation: Veracode Risk Manager · Get started with the VRM platform · Manage risk · Manage security policies · AppSec policies · Develop a remediation plan.
Expected outcome: percentage of internet-exposed, total-control KEV items with an owner and a dated close; time from KEV add to confirmed not-present or patched.
8. Automate the rest — Integrations, Repository Scanning, and CLI.
Fits finite staff and CI as the worm’s propagation path. Wire SAST, SCA, DAST, Fix, and container scans into the existing SCM, CI, and ticketing stack. Repository Scanning runs Pipeline Scan, SCA, and IaC in the repo. CLI commands cover static, dynamic, scan (container and IaC), fix, sbom, and policy.
Working documentation: Veracode Integrations · SCM / Repository Scanning · Platform overview.
Expected outcome: percentage of production pipelines that cannot ship without a current scan and a policy evaluation.
Also in the live suite — use them for the gaps this week created.
Vendor Application Security Testing (VAST) is the control for the McKesson / Aesto pattern: require vendors and processors to attest through Static, SCA, Dynamic, and, where the policy demands it, Manual Penetration Testing, then share results against your policy. Manual Penetration Testing remains the human pass on internet-facing admin planes and AI toolchains after DAST. Security Labs and developer training close the first-party injection and supply-chain-failure lessons that OWASP Top 10:2025 now names explicitly (A03 Software Supply Chain Failures). Analytics is the board view of whether any of the above is actually moving.
Next Action: Put Package Firewall in front of the primary package manager before the next CI run, and point SSCI at the same registries so the firewall is current. SCA without a firewall documents the worm after preinstall. A firewall without SSCI blocks last month’s catalog.
What CISOs Should Do Now
Prioritized from the week plus month view. Capacity-realistic.
P0 — this morning.
First, patch or isolate the internet-facing admin plane: SMA1000 on the hotfixes above, PaperCut NG/MF on emergency patch 3, NetScaler CVE-2026-8452, self-hosted Artifactory on the patched branches above, Langflow at or below 1.4.2, Gitea, Zimbra, and self-hosted ServiceNow. If you cannot patch today, remove it from the internet.
Second, assume identity-brokered SaaS is in play. Review Okta and Entra helpdesk reset and MFA-bypass paths. Revoke standing admin on Salesforce and Snowflake. Confirm phishing-resistant MFA on those paths. McKesson is the pattern, not the only possible victim.
Third, put Package Firewall in front of the registry and subscribe SSCI before the next CI run. Hunt workstations and runners that installed @7nohe/openapi-react-query-codegen versions listed above, or any package published in the 4 August keyv wave. Rotate tokens.
Fourth, run one EASM Deep Discovery scan on the corporate root domains. The appliances that will be exploited next are the ones that are not in the CMDB.
P1 — this week.
Treat every AI agent-builder and model gateway as an internet-facing production system. Take Langflow, LiteLLM, MLflow, and similar off public IP. Point DAST at whatever remains.
Turn on container, IaC, and secret scanning in the CLI on the deploy path. Generate SBOMs for anything that will face a CRA or customer questionnaire after 11 September.
Where third-party or processor software holds PHI/PII, open a VAST request against the vendor policy rather than accepting a questionnaire.
Draft the CIRCIA and CRA reporting packet: who calls, what counts as “exploited,” what counts as a “severe incident,” who signs. Rehearse 72-hour incident and 24-hour ransom-payment notice even if CIRCIA slips.
Point Risk Manager at KEV-plus-internet-exposed as the only board metric that matters this quarter. Retire the rest of the dashboard argument.
Failure modes to name before the work starts. Patching without exposure discovery leaves the unknown SMA1000 running. SCA without Package Firewall documents the worm after preinstall. Package Firewall without SSCI blocks a stale list. DAST without EASM scans only the applications already known. Fix without policy gates creates velocity without control. Paying, or engaging, on actor row-counts before forensics sets unique-individual scope.
The residual-risk picture on 2 September 2026 is not a general “heightened threat environment.” It is specific: unauthenticated control of edge and developer admin planes, package registries that will execute attacker code at install, and identity paths into the SaaS systems that now hold the crown-jewel data. Those three surfaces produced this week’s material events. They will produce the next ones. Programs that inform with SSCI, prevent with Package Firewall, detect with SCA, discover with EASM, and rank with Risk Manager against KEV-on-exposed-assets will reduce the only risk that moved this month. Everything else is commentary.
This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.
