🛡️ CISO Intel — Monday, 20-04-2026

By Marcus Reed | 19-04-2026 08:00 IST → 20-04-2026 08:00 IST | Sources cross-referenced

Executive Summary

This Monday’s intel dump is a stark reminder that foundational security hygiene remains our Achilles’ heel, even as the threat landscape accelerates with AI-driven capabilities. We’re seeing active exploitation of five-year-old vulnerabilities alongside sophisticated supply chain attacks leveraging compromised third-party AI tools. The overall climate suggests an increasing velocity of attacks, a widening gap between vulnerability discovery and patch adoption, and a blurring line between cyber and physical crime, particularly in logistics. CISOs must prioritize robust patch management, stringent third-party risk assessments, and advanced identity controls to counter these evolving threats.

🔴 Critical Threats — Act Now

ShowDoc — CVE-2025-0520 (CVSS 9.4) — N-Day RCE

What happened: A critical unrestricted file upload vulnerability, identified as CVE-2025-0520 (also tracked as CNVD-2020-26585), is under active exploitation. This flaw, present in ShowDoc versions prior to 2.8.7, allows unauthenticated attackers to upload arbitrary PHP files, leading to remote code execution (RCE) on the server. The vulnerability was patched back in October 2020 with the release of ShowDoc version 2.8.7, meaning attackers are actively exploiting a five-year-old, N-day vulnerability.

Source verification: This incident is well-documented and confirmed across multiple security advisories and news outlets. GitHub Advisory Database, SentinelOne, Miggo, and Bleeping Computer all detail the vulnerability and its active exploitation. There are no conflicting reports; all sources agree on the nature of the vulnerability, its CVSS score, and the fact that it’s being actively exploited due to poor patch adoption.

Technical breakdown: The root cause of CVE-2025-0520 is insufficient file extension validation within ShowDoc’s upload handler, specifically in the ShowDoc\Home\Controller\PageController::uploadImg function. Instead of using a secure allowExts property for permitted file types, the vulnerable code used upload->exts and lacked proper authentication checks. This allows an attacker to bypass file type restrictions and upload a malicious PHP file (a web shell) to the server. Once uploaded, the web server processes this file as legitimate, enabling the attacker to execute arbitrary commands on the target system. The attack vector is network-based, requiring no administrative privileges, only network access to the ShowDoc instance. This aligns with MITRE ATT&CK T1566.001 (Phishing: Spearphishing Attachment) for initial delivery if an attacker needs to trick a user, but the core vulnerability is T1560.001 (Archive via Utility: Internal Archive) for the file upload, leading to T1059.001 (Command and Scripting Interpreter: PowerShell) or T1059.006 (Command and Scripting Interpreter: PHP) for execution.

Blast radius: The blast radius is significant for any organization still running unpatched ShowDoc instances, particularly those exposed to the internet. ShowDoc is a popular open-source documentation tool, especially in China, meaning many older, unmaintained instances could be vulnerable. The vulnerability allows for full remote code execution, giving attackers complete control over the compromised server, potentially leading to data exfiltration, lateral movement within the network, or further system compromise.

Marcus’s verdict:

This isn’t rocket science, folks. This is a five-year-old vulnerability being actively exploited because people aren’t patching. It’s the digital equivalent of leaving your front door wide open with a “Welcome, please steal my stuff” sign. A CVSS 9.4 means it’s critical, and the “unauthenticated” part means any script kiddie with a Shodan account can hit you. If you’re running ShowDoc, you need to check your version immediately. Patching isn’t enough if you haven’t done it. This is a fire drill.

What to do:

1. Immediate Scan & Inventory: Identify all ShowDoc instances within your environment. Prioritize internet-facing instances.
2. Version Check: Verify the version of every ShowDoc instance. Any version prior to 2.8.7 is vulnerable.
3. Patch or Isolate: Immediately apply the patch by upgrading to version 2.8.7 or newer. If immediate patching is not feasible, isolate vulnerable instances from the network and apply strict access controls.
4. Forensic Investigation: Assume compromise for any unpatched, internet-facing instance. Look for suspicious PHP files in upload directories, unusual network connections, or new user accounts. Implement IOCs from security advisories.
5. Review Access Logs: Check web server logs for suspicious file uploads or requests to newly uploaded PHP files.

Vercel Data Breach — Supply Chain Attack via Context.ai 💥

What happened: Cloud development platform Vercel disclosed a security incident stemming from a sophisticated supply chain attack. Initial access was gained through the compromise of a Google Workspace account belonging to a Vercel employee. This compromise originated from a breach at Context.ai, a third-party AI platform used by the employee. Attackers leveraged this access to escalate privileges within Vercel’s internal environments, where they accessed unencrypted environment variables. A threat actor claiming to be affiliated with ShinyHunters is now reportedly selling access keys, source code, and database data on underground forums, demanding a $2 million ransom.

Source verification: The Vercel breach is confirmed by Vercel itself through a security bulletin and statements from CEO Guillermo Rauch. Multiple independent security news outlets like Bleeping Computer, iTnews, and Towards AI have corroborated the details. The role of Context.ai as the initial compromise vector via a Google Workspace OAuth application is explicitly stated by Vercel. While ShinyHunters’ claim of selling data is reported, BleepingComputer noted they could not independently confirm the authenticity of the data or screenshots shared by the threat actor. However, the overall breach details are solid.

Technical breakdown: This is a textbook multi-stage supply chain attack.

1. Initial Compromise (Context.ai): An unspecified breach occurred at Context.ai, a third-party enterprise AI platform. This compromise affected its Google Workspace OAuth application, which was used by a Vercel employee. Vercel noted that this broader compromise potentially affected hundreds of users across many organizations.
2. Credential Theft (Google Workspace OAuth): The attackers exploited the compromised Context.ai OAuth app to gain access to the Vercel employee’s Google Workspace account. OAuth tokens, unlike passwords, don’t trigger MFA challenges on their own, making them a prime target once compromised.
3. Lateral Movement & Escalation (Vercel Internal Environments): From the compromised Google Workspace account, the attackers performed a “series of maneuvers” to gain further access to Vercel’s internal environments. Vercel CEO Guillermo Rauch described the attackers as “highly sophisticated” with “surprising velocity and in-depth understanding of Vercel’s systems,” suggesting AI-accelerated reconnaissance or exploitation.
4. Data Exfiltration (Environment Variables): Within Vercel’s environments, the attackers enumerated and accessed “non-sensitive” environment variables. Vercel explicitly stated that variables marked as “sensitive” are encrypted at rest and were not accessed. However, even “non-sensitive” variables can contain critical information like API keys, database URIs, JWT secrets, or webhook tokens if not properly classified and protected.

MITRE ATT&CK mapping:

• Initial Access: T1195.002 (Supply Chain Compromise: Compromise of Third-Party Software) via Context.ai, leading to T1078.004 (Valid Accounts: Cloud Accounts) for the Google Workspace compromise.
• Persistence & Privilege Escalation: T1078.004 (Valid Accounts: Cloud Accounts) for maintaining access, potentially T1098 (Account Manipulation) if they created new accounts, and T1484 (Group Policy Modification) or similar for escalating within Vercel’s cloud environment.
• Discovery: T1083 (File and Directory Discovery) and T1057 (Process Discovery) for enumerating environment variables.
• Collection: T1539 (Steal Web Session Cookie) or T1538 (Steal Application Access Token) for API keys/tokens.
• Exfiltration: T1041 (Exfiltration Over C2 Channel) or T1567 (Exfiltration Over Web Service) for stolen data.

Blast radius: This is a significant supply chain event. Vercel powers over 4 million websites and processes 30 billion requests weekly, making it a critical piece of modern web infrastructure. While Vercel’s core platform infrastructure was not compromised, and services remained operational, a “limited subset” of Vercel customers had their credentials compromised. Customers who stored secrets in “non-sensitive” environment variables are at direct risk. The broader implications extend to any organization using third-party AI tools with Google Workspace OAuth access, as the Context.ai breach was part of a “broader compromise, potentially affecting hundreds of its users across many organizations.”

Marcus’s verdict:

This Vercel breach is a masterclass in modern supply chain risk. It wasn’t a zero-day in their core platform; it was a compromised third-party AI tool that led to a Google Workspace account takeover, then lateral movement. This is why I keep screaming about third-party risk management and identity hygiene. “Non-sensitive” environment variables are a security oxymoron if they can contain anything that grants access. The fact that an attacker could enumerate these variables and potentially steal API keys or database credentials is a fundamental failure in segmentation and least privilege. Assume your SaaS providers are your perimeter, and scrutinize every OAuth grant.

What to do:

1. Rotate All Non-Sensitive Secrets: Immediately audit and rotate all environment variables in your Vercel projects that were not explicitly marked as “sensitive.” This includes API keys, database credentials, JWT secrets, webhook tokens, and any other access tokens.
2. Enable Sensitive Environment Variables: For all future secrets, ensure they are marked as “sensitive” in Vercel to leverage their encryption at rest.
3. Audit Google Workspace OAuth Apps: For all Google Workspace administrators, check for the OAuth App 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com. Revoke access if found and investigate any associated user activity.
4. Review Activity Logs: Scrutinize Vercel and Google Workspace activity logs for any suspicious logins, API calls, or configuration changes.
5. Enhance Third-Party Risk Assessment: Re-evaluate your risk posture for all third-party SaaS and AI tools, especially those integrated with core identity providers like Google Workspace. Demand transparency on their security postures and incident response plans.

🛡️ CVEs — Full Analysis

GHSA-xq3m-2v4x-88gg — protobuf.js

Summary: This is a critical Remote Code Execution (RCE) vulnerability in protobuf.js versions 8.0.0/7.5.4 and lower. It allows attackers to inject and execute arbitrary JavaScript code by providing a malicious protobuf schema, exploiting unsafe dynamic code generation. CVSS/Details: While not assigned an official CVE ID, it’s tracked as GHSA-xq3m-2v4x-88gg by GitHub and is considered critical, with a CVSS score of 9.8 by some analyses. Patches are available in versions 8.0.1 and 7.5.5. A Proof-of-Concept (PoC) exploit code has been published. Marcus take: This is a serious supply chain vulnerability. protobuf.js is a foundational library with nearly 50 million weekly npm downloads, meaning the blast radius is astronomical. If your Node.js application processes untrusted protobuf schemas, you’re exposed. This isn’t theoretical; the PoC is out there. Patching is non-negotiable.

⚡ TTPs & Attack Research — Deep Dives

Cyber-enabled Cargo Theft: Organized Crime’s New Playbook 🚚

What happened: Organized crime groups are increasingly engaging in “cyber-enabled cargo theft,” where digital intrusions directly facilitate the theft of physical goods. Proofpoint researchers have observed these groups targeting trucking and logistics firms since at least June 2025, using sophisticated remote access campaigns to hijack cargo and divert payments. Losses in North America reached $6.6 billion in 2025 due to this trend.

Technical breakdown: The attack chain typically begins with phishing (MITRE ATT&CK T1566.001, Spearphishing Attachment). Attackers compromise “load board” platforms – online marketplaces where freight brokers and shippers arrange cargo movement. When a carrier responds to a fraudulent posting, they receive an email containing a malicious VBS file. This VBS file drops and executes PowerShell scripts, which then install multiple Remote Monitoring and Management (RMM) tools like ScreenConnect, Pulseway, and SimpleHelp (MITRE ATT&CK T1021, Remote Services).

The use of multiple RMM tools (Proofpoint observed up to six, including four ScreenConnect instances) is a clear tactic for persistence and redundancy (MITRE ATT&CK T1574, Hijack Execution Flow). Attackers use these tools to maintain remote control, profile victims by collecting user data, browser history, and access details for banking, payments, logistics, and accounting platforms. A notable development is the use of “signing-as-a-service” tools to sign installed RMM components with trusted certificates, bypassing Windows security warnings – a direct response to vendor efforts to revoke certificates.

Once persistent access is established, the criminals use their insider knowledge to bid on real shipments, steal the cargo, and potentially divert payments. This isn’t just data theft; it’s a direct link to real-world physical crime, often involving high-value goods like food, beverages, and electronics.

Detection opportunities:

• Email Gateway Logs: Look for VBS file attachments or suspicious links in emails targeting logistics personnel.
• Endpoint Detection and Response (EDR): Monitor for VBS script execution, PowerShell activity, and the installation of known RMM tools (ScreenConnect, Pulseway, SimpleHelp) in unexpected locations or by unusual users.
• Network Traffic Analysis: Detect outbound connections to known RMM infrastructure or unusual C2 activity.
• Logistics Platform Monitoring: Anomalous bidding patterns, sudden changes in shipment details, or new, unrecognized carrier accounts.
• Certificate Monitoring: Alert on newly observed or suspicious certificates used to sign executables, especially those related to RMM tools.

Mitigations:

• Advanced Email Security: Block malicious attachments and links, implement DMARC, DKIM, and SPF.
• Endpoint Hardening: Implement application whitelisting to prevent unauthorized script execution and RMM tool installation.
• User Training: Educate employees, especially those involved in logistics and finance, about spearphishing, social engineering, and the risks of opening suspicious attachments.
• Supply Chain Verification: Implement rigorous verification processes for new carriers and partners on load boards.
• Network Segmentation: Limit RMM tool access to only necessary systems and segments.
• Threat Intelligence: Subscribe to and integrate threat intelligence feeds on cargo theft TTPs and IOCs.

AI-Accelerated Exploitation: The Mythos Preview & GPT-5.4-Cyber Effect 🤖

What happened: Anthropic’s “Claude Mythos Preview” and OpenAI’s “GPT-5.4-Cyber” are purpose-built or have demonstrated capabilities for advanced offensive and defensive cyber operations. Anthropic’s Mythos Preview, a general-purpose frontier AI model, was found to possess “striking cybersecurity capabilities,” identifying thousands of previously unknown zero-day vulnerabilities across major operating systems and web browsers. It could reproduce vulnerabilities and develop working exploits on the first attempt in over 83% of cases, even finding a 27-year-old flaw in OpenBSD. OpenAI’s GPT-5.4-Cyber is also noted for similar capabilities. The core concern is that AI will discover vulnerabilities (including chained zero-days) faster than the ecosystem can patch them, significantly widening the “exposure window.”

Technical breakdown: These frontier AI models represent a paradigm shift in vulnerability discovery and exploitation.

• Automated Zero-Day Discovery: Mythos Preview can autonomously identify thousands of previously unknown vulnerabilities with limited human input, even in highly hardened systems. This goes beyond simple static analysis; it involves advanced reasoning and code comprehension.
• Exploit Generation: The models can develop working exploits for discovered vulnerabilities, often on the first attempt, and even chain multiple vulnerabilities into complex exploit paths. This significantly lowers the skill floor for attackers.
• Speed and Scale: The velocity and scale at which these AI models can operate far outpace human capabilities, creating an “asymmetry” where defenders operate at human speed while attackers leverage AI augmentation.
• Impact on Exposure Window: The traditional security model relies on a discovery-patch-deploy cycle. If AI can discover flaws at an unprecedented rate, the time between a vulnerability being known (to AI) and a fix being widely deployed will expand, leaving systems exposed for longer periods. This is particularly problematic for open-source projects, whose maintainers may struggle to keep up.

This changes the game for TTPs by accelerating almost every stage of the attack lifecycle, from reconnaissance and initial access to persistence and privilege escalation. It makes the “known fix” vs. “deployed fix” gap a critical risk factor.

Detection opportunities:

• AI-powered Threat Intelligence: Leveraging AI to analyze newly discovered vulnerabilities and predict exploitation trends.
• Automated Vulnerability Management: Rapid ingestion and prioritization of vulnerability data, coupled with automated patching where feasible.
• Continuous Security Testing: Employing AI-augmented tools for continuous vulnerability scanning and penetration testing in your own environments to find flaws before attackers do.

Mitigations:

• Shift-Left Security: Integrate security earlier and more deeply into the development lifecycle, using AI-powered static and dynamic analysis tools to catch vulnerabilities during coding.
• Automated Patching & Remediation: Invest heavily in automation for vulnerability management, patching, and configuration management to shrink the exposure window.
• Software Bill of Materials (SBOMs): Maintain accurate SBOMs to quickly identify affected components when new vulnerabilities (especially in open-source dependencies) are disclosed.
• Project Glasswing & Collaboration: Participate in or monitor initiatives like Anthropic’s Project Glasswing, which aims to give defenders early access to AI-discovered flaws to patch critical infrastructure.
• AI Governance: Establish clear policies for the responsible use of AI in both offensive and defensive security contexts.

AI for Red Teaming: promptfoo and Automated Adversarial Input 🚩

What happened: New tooling like promptfoo is emerging to automate red team test generation, including adversarial input and prompt injection strategies against AI models. This signifies that red teams are getting smarter and faster at finding vulnerabilities in AI systems.

Technical breakdown: promptfoo is a platform designed for AI red teaming, simulating real users to uncover application-specific vulnerabilities in Large Language Model (LLM) applications and Retrieval-Augmented Generation (RAG) systems.

• Automated Attack Generation: Instead of static jailbreaks, promptfoo uses machine learning techniques to generate dynamic, tailored attacks against specific AI applications.
• Comprehensive Vulnerability Types: It tests for over 50 vulnerability types, including direct and indirect prompt injections, jailbreaks, data and PII leaks, business rule violations, insecure tool use in agents, toxic content generation, RAG document exfiltration, and system prompt overrides.
• Scalability and Continuous Testing: promptfoo is designed for enterprise scale, allowing continuous monitoring and integration into existing DevSecOps workflows. This addresses the probabilistic nature of LLMs, where manual testing is cumbersome.
• Modular Architecture: It uses a modular architecture with plugins (producing malicious payloads for specific vulnerabilities) and strategies (determining how inputs are delivered to maximize attack success).

This tooling significantly enhances red team capabilities, allowing for more thorough and rapid testing of AI systems, uncovering weaknesses that are hard to catch manually.

Detection opportunities:

• LLM Observability: Implement robust logging and monitoring for LLM inputs and outputs to detect suspicious prompt patterns or unexpected model behavior.
• Guardrails & Filters: Deploy and continuously refine input/output filters and safety guardrails for LLM applications.
• Anomaly Detection: Use behavioral analytics to identify unusual interactions with AI models that might indicate prompt injection or jailbreaking attempts.

Mitigations:

• Proactive Red Teaming: Regularly use tools like promptfoo to red team your own AI applications, identifying and remediating vulnerabilities before attackers do.
• Robust Input Validation: Implement strict validation and sanitization of user inputs to LLMs, even for “natural language” interfaces.
• Least Privilege for AI Agents: Ensure AI agents and models operate with the absolute minimum necessary permissions and access to external tools or data.
• Contextual Guardrails: Develop business-logic-aware guardrails that prevent AI models from violating specific rules or accessing unauthorized information.
• Continuous Integration/Continuous Delivery (CI/CD) Security: Integrate AI red teaming into your CI/CD pipelines to catch vulnerabilities early in the development process.

🏗️ DevSecOps & Cloud

The recent Vercel breach (via Context.ai) is a textbook example of cloud supply chain risk. A third-party AI platform’s compromise led to a Google Workspace account takeover, enabling lateral movement into Vercel’s cloud environment and exposing unencrypted environment variables. This highlights that your SaaS providers are an extension of your perimeter. Organizations must treat third-party integrations, especially those with broad OAuth scopes to core identity providers, with the same scrutiny as internal systems. Implement strict OAuth consent policies, regularly audit connected applications, and enforce least privilege for all service accounts and integrations. The lesson here is clear: trust, but verify, and then assume compromise.

The protobuf.js GHSA-xq3m-2v4x-88gg RCE is a significant supply chain vulnerability for any Node.js application. Its pervasive use (nearly 50M weekly npm downloads) means a single malicious protobuf schema could compromise inter-service communication and cloud environments globally. For DevSecOps teams, this underscores the critical importance of:

• Software Composition Analysis (SCA): Continuously scan your codebase for vulnerable dependencies and ensure protobuf.js is updated to versions 8.0.1 or 7.5.5.
• Input Validation: Rigorously validate all external inputs, including protobuf schemas, to prevent dynamic code injection. Treat all external data as untrusted.
• Runtime Application Self-Protection (RASP): Consider RASP solutions to detect and block exploitation attempts at runtime, especially in critical microservices that handle inter-service communication.

The AI-driven vulnerability surge, exemplified by Anthropic’s Mythos Preview, is creating an “exposure window” problem for open-source projects. Maintainers simply cannot keep up with the pace of AI-discovered flaws, leading to a growing backlog of unpatched, but known, vulnerabilities. This is a ticking time bomb for anyone relying on open-source components. DevSecOps teams must:

• Automate Vulnerability Management: Implement highly automated vulnerability scanning, prioritization, and patching workflows.
• Focus on Critical Dependencies: Prioritize security reviews and proactive patching for widely used, critical open-source libraries.
• Contribute to Open Source Security: Support open-source security initiatives