@blamejs/exceptd-skills 0.21.13 → 0.21.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (26) hide show
  1. package/CHANGELOG.md +6 -0
  2. package/data/_indexes/_meta.json +17 -17
  3. package/data/_indexes/activity-feed.json +98 -98
  4. package/data/_indexes/currency.json +28 -28
  5. package/data/_indexes/section-offsets.json +200 -200
  6. package/data/_indexes/summary-cards.json +14 -14
  7. package/data/_indexes/token-budget.json +99 -99
  8. package/manifest.json +81 -81
  9. package/package.json +1 -1
  10. package/sbom.cdx.json +58 -43
  11. package/scripts/check-skill-catalog-facts.js +304 -0
  12. package/scripts/predeploy.js +8 -0
  13. package/skills/ai-attack-surface/skill.md +2 -2
  14. package/skills/cloud-iam-incident/skill.md +6 -6
  15. package/skills/compliance-theater/skill.md +6 -6
  16. package/skills/container-runtime-security/skill.md +2 -2
  17. package/skills/exploit-scoring/skill.md +16 -14
  18. package/skills/framework-gap-analysis/skill.md +5 -5
  19. package/skills/idp-incident-response/skill.md +4 -4
  20. package/skills/kernel-lpe-triage/skill.md +15 -15
  21. package/skills/policy-exception-gen/skill.md +4 -4
  22. package/skills/sector-federal-government/skill.md +3 -3
  23. package/skills/security-maturity-tiers/skill.md +5 -5
  24. package/skills/supply-chain-integrity/skill.md +3 -3
  25. package/skills/threat-model-currency/skill.md +6 -6
  26. package/skills/zeroday-gap-learn/skill.md +8 -8
package/skills/cloud-iam-incident/skill.md CHANGED
@@ -73,7 +73,7 @@ forward_watch:
73
73
  - AU ISM update enumerating cloud non-human-principal credential hygiene with explicit bearer-token TTL ceilings
74
74
  - DORA TLPT (JC 2024/40 RTS) first-cycle aggregate findings on cloud-account-compromise scenarios
75
75
  - AWS, GCP, and Azure shared-fate / shared-responsibility recalibration for federated-trust hygiene
76
- last_threat_review: "2026-05-15"
76
+ last_threat_review: "2026-09-28"
77
77
  ---
78
78
 
79
79
  # Cloud IAM Incident Response (mid-2026)
@@ -164,11 +164,11 @@ The playbook `cloud-iam-incident` operationalises this skill into a seven-phase
164
164
 
165
165
  | Surface / CVE Class | CVSS | RWEP | CISA KEV | PoC Public | AI-Discovered | Active Exploitation | Patch / Mitigation Available | Sector-Aware Detection |
166
166
  |---|---|---|---|---|---|---|---|---|
167
- | CVE-2024-1709 ScreenConnect auth bypass (cloud-runtime adjacent) | 10.0 | 95 | Yes | Yes | n/a | Confirmed mass exploitation | Vendor patch | EDR + identity-protection |
168
- | CVE-2024-21626 runc container escape | 8.6 | 88 | Yes | Yes | n/a | Confirmed | Vendor patch | Container-runtime telemetry |
169
- | CVE-2024-3094 xz-utils supply-chain backdoor | 10.0 | 70 | Yes | Yes | No | Suspected | Vendor patch | SBOM-driven detection |
170
- | CVE-2026-20182 Cisco SD-WAN cloud-edge | 9.1 | 90 | Yes | Yes | Yes | Confirmed | Vendor patch | Network telemetry |
171
- | CVE-2026-30623 Anthropic MCP STDIO (cloud-hosted MCP servers) | 8.4 | 87 | Pending | Yes | Yes | Suspected | Vendor patch + config hardening | MCP-aware telemetry |
167
+ | CVE-2024-1709 ScreenConnect auth bypass (cloud-runtime adjacent) | 10.0 | 75 | Yes (2024-02-22) | Yes | No | Confirmed mass exploitation | Vendor patch | EDR + identity-protection |
168
+ | CVE-2024-21626 runc container escape | 8.6 | 35 | No | Yes | No | None recorded | Vendor patch | Container-runtime telemetry |
169
+ | CVE-2024-3094 xz-utils supply-chain backdoor | 10.0 | 45 | No | Yes | No | Suspected | Vendor patch | SBOM-driven detection |
170
+ | CVE-2026-20182 Cisco SD-WAN cloud-edge | 10.0 | 65 | Yes (2026-05-14) | No | No | Confirmed | Vendor patch | Network telemetry |
171
+ | CVE-2026-30623 Anthropic MCP STDIO (cloud-hosted MCP servers) | 8.8 | 30 | No | Yes | No | Suspected | Vendor patch + config hardening | MCP-aware telemetry |
172
172
  | Leaked access key in public repo (Snowflake-AA24-class) | n/a (config) | high (exploited within minutes) | n/a | Documented at scale | n/a | Confirmed mass exploitation | Configuration hardening + key rotation + scraper-bot countermeasures | GitGuardian / Trufflehog firehose; behavioural detection on CreateAccessKey + key-use anomaly |
173
173
  | IMDSv1 SSRF / metadata exfil | n/a (design class) | high | n/a | Documented at scale | n/a | Confirmed ongoing | IMDSv2 enforcement | VPC Flow Logs + CloudTrail Insights |
174
174
  | OIDC trust-policy wildcard subject claim (fork-PR-to-takeover) | n/a (config class) | high | n/a | Demonstrated 2024-2026 | n/a | Suspected ongoing | Trust-policy tightening + per-environment OIDC trust | Trust-policy static analysis + assume-role telemetry |
package/skills/compliance-theater/skill.md CHANGED
@@ -21,7 +21,7 @@ framework_gaps:
21
21
  - ALL-PROMPT-INJECTION-ACCESS-CONTROL
22
22
  - FedRAMP-Rev5-Moderate
23
23
  - CMMC-2.0-Level-2
24
- last_threat_review: "2026-09-18"
24
+ last_threat_review: "2026-09-28"
25
25
  ---
26
26
 
27
27
  # Compliance Theater Detection
@@ -102,16 +102,16 @@ The theater patterns most acutely under attack today are those backed by high-RW
102
102
 
103
103
  | Theater pattern | Evidence CVE | CVSS | RWEP tier | KEV | Public PoC | AI-accelerated | Live-patchable | Active exploitation |
104
104
  |---|---|---|---|---|---|---|---|---|
105
- | Patch Management Theater | CVE-2026-31431 (Copy Fail) | High | Critical | Yes | Yes (732 bytes, deterministic) | Yes (AI-discovered) | Yes (kpatch/livepatch) | Confirmed |
106
- | Vendor Management Theater (AI APIs / MCP) | CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 | 35 | No | Partial | No | Yes (IDE update) | Suspected |
105
+ | Patch Management Theater | CVE-2026-31431 (Copy Fail) | 7.8 | 90 | Yes (2026-05-01) | Yes (732 bytes, deterministic) | Yes (AI-discovered) | Yes (kpatch/livepatch) | Confirmed |
106
+ | Vendor Management Theater (AI APIs / MCP) | CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 | 35 | No | Yes | No | Yes (IDE update) | Suspected |
107
107
  | Access Control Theater (AI agents) | CVE-2025-53773 (Copilot YOLO-mode RCE) | 7.8 | 30 | No | Yes (demonstrated) | Yes (AI tooling enables) | Yes (SaaS push / IDE update) | Suspected |
108
- | Network Segmentation Theater (IPsec) | CVE-2026-43284 (Dirty Frag) | High | High | Pending | Partial | No | Limited (subsystem-dependent) | Suspected |
109
- | Patch Management Theater (Bug-Family Sequel) | CVE-2026-46300 (Fragnesia) | 7.8 | 20 (today) / 55+ on KEV | No (candidate) | Yes (one-liner vs /usr/bin/su) | No | Yes (kpatch / canonical-livepatch / KernelCare) | None observed |
108
+ | Network Segmentation Theater (IPsec) | CVE-2026-43284 (Dirty Frag) | 8.8 | 53 | No | Yes (chain component) | Yes (AI-assisted discovery) | Limited (kpatch RHEL-only) | Suspected |
109
+ | Patch Management Theater (Bug-Family Sequel) | CVE-2026-46300 (Fragnesia) | 7.8 | 35 (60 if KEV-listed) | No (candidate) | Yes (one-liner vs /usr/bin/su) | Yes (AI-assisted discovery) | Yes (kpatch / canonical-livepatch / KernelCare) | None observed |
110
110
  | Incident Response Theater (AI pipeline) | SesameOp campaign + AML.T0096 | N/A | High | N/A | ATLAS-documented | Yes | N/A | Confirmed campaign |
111
111
  | Change Management Theater (AI models) | Continuous provider updates | N/A | Medium | N/A | N/A | N/A | N/A | Ongoing (uncontrolled) |
112
112
  | Security Awareness Theater (AI phishing) | AI-generated phishing baseline (82.6%) | N/A | High | N/A | Operational | Yes | N/A | Confirmed (industry-wide) |
113
113
 
114
- The first three rows (Critical / Critical / High RWEP with public PoC or active exploitation) are the most dangerous theater patterns to leave un-remediated. Pull authoritative scoring from `data/exploit-availability.json` and `data/cve-catalog.json` before producing the output.
114
+ Rows with a high RWEP and a public PoC or confirmed exploitation, led by Copy Fail at RWEP 90, are the most dangerous theater patterns to leave un-remediated. Pull authoritative scoring from `data/exploit-availability.json` and `data/cve-catalog.json` before producing the output.
115
115
 
116
116
  ---
117
117
 
package/skills/container-runtime-security/skill.md CHANGED
@@ -57,7 +57,7 @@ d3fend_refs:
57
57
  - D3-IOPR
58
58
  forward_watch:
59
59
  - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo
60
- last_threat_review: "2026-09-18"
60
+ last_threat_review: "2026-09-28"
61
61
  ---
62
62
 
63
63
  # Container + Kubernetes Runtime Security (mid-2026)
@@ -145,7 +145,7 @@ CWE cross-walk (see `data/cwe-catalog.json`):
145
145
  | Class / CVE | CVSS | RWEP | CISA KEV | PoC Public | AI-Discovered | Active Exploitation | Patch / Mitigation | Admission-Detectable | Runtime-Detectable (Falco/Tetragon) |
146
146
  |---|---|---|---|---|---|---|---|---|---|
147
147
  | Host-kernel LPE as container escape — Copy Fail (CVE-2026-31431) | 7.8 | 90 (see `cve-catalog.json`) | Yes (2026-05-01, due 2026-05-15) | Yes — 732-byte script | Yes | Confirmed | Kernel patch + live-patch (kpatch/livepatch/kGraft) on supported distros; reboot rolling fleet on others | No (admission doesn't see kernel ops) | Yes — Falco/Tetragon catches the post-escape host operations; the in-kernel write itself is invisible to eBPF |
148
- | Container-runtime CVE class — runc CVE-2024-21626 ("LeakyVessels") family | 8.6 | varies (historical reference) | Yes (at time of disclosure) | Yes | No (manual disclosure) | Patched in modern fleets; brownfield self-managed clusters lag | runc / containerd / CRI-O upgrade | Partial — admission can require minimum runtime versions via node-feature labels | Yes — Tetragon can enforce SIGKILL on the abuse syscall sequence |
148
+ | Container-runtime CVE class — runc CVE-2024-21626 ("LeakyVessels") family | 8.6 | 35 (see `cve-catalog.json`) | No | Yes | No (manual disclosure) | Patched in modern fleets; brownfield self-managed clusters lag | runc / containerd / CRI-O upgrade | Partial — admission can require minimum runtime versions via node-feature labels | Yes — Tetragon can enforce SIGKILL on the abuse syscall sequence |
149
149
  | Misconfigured PSS — `pod-security.kubernetes.io/enforce: privileged` on a workload namespace | n/a (class) | n/a | n/a | Trivial — `kubectl run --privileged` | Operator misconfig + AI-coding-assistant template drift | Routinely observed in incident response 2024–2026 | Set namespace label to `restricted`; remediate the workload | Yes — Kyverno PolicyReport + Kubescape surface this; PSA itself enforces on admit if label set |
150
150
  | Misconfigured RBAC — ServiceAccount with `create/patch` on `pods` or `secrets` cluster-wide | n/a (class) | n/a | n/a | Trivial — `can-i --list --as=system:serviceaccount:...` | Operator misconfig | Routinely observed | Replace wildcard ClusterRoles with scoped Roles; deny `automountServiceAccountToken: true` by default | Yes — Kyverno + OPA policies; kube-bench check | Yes — Falco detects token use from unexpected ServiceAccount |
151
151
  | Exposed kubelet 10250 / 10255 | n/a (class) | n/a | n/a | Trivial — Shodan / Censys queries; Peirates | n/a | Confirmed in self-managed / CI / lab clusters | Network policy default-deny; kubelet authentication + authorization; firewall | No (network-layer control) | Yes — Cilium L7 policy + Falco network rule |
package/skills/exploit-scoring/skill.md CHANGED
@@ -21,7 +21,7 @@ attack_refs: []
21
21
  framework_gaps:
22
22
  - CWE-Top-25-2024-meta
23
23
  - CIS-Controls-v8-Control7
24
- last_threat_review: "2026-09-18"
24
+ last_threat_review: "2026-09-28"
25
25
  ---
26
26
 
27
27
  # Real-World Exploit Priority (RWEP) Scoring
@@ -91,11 +91,11 @@ How each RWEP factor maps to a real CVE in `data/cve-catalog.json`:
91
91
  | CVE | KEV | PoC | AI-Discovered | Active Exploitation | Blast Radius | Patch | Live Patch | RWEP | CVSS |
92
92
  |---|---|---|---|---|---|---|---|---|---|
93
93
  | CVE-2026-31431 (Copy Fail) | Yes | Yes (732-byte) | Yes | Confirmed | All Linux ≥ 4.14 (30) | Yes | Yes (kpatch/livepatch/kGraft) | 90 | 7.8 |
94
- | CVE-2026-43284 (Dirty Frag ESP/IPsec) | No | Yes (chain) | No | Suspected | IPsec-using systems (18) | Yes | RHEL-only kpatch | 38 | 7.8 |
95
- | CVE-2026-43500 (Dirty Frag RxRPC) | No | Yes (chain) | No | Suspected | RxRPC-loaded systems | Yes | Partial | 32 | 7.6 |
96
- | CVE-2026-46300 (Fragnesia) | No (likely candidate) | Yes (one-liner vs /usr/bin/su) | No | None observed | Linux >= 5.10 with esp4/esp6/rxrpc loaded (25) | Yes | Yes (kpatch / canonical-livepatch / KernelCare) | 20 | 7.8 |
97
- | CVE-2025-53773 (Copilot YOLO-mode RCE) | No | Yes (demonstrated) | Yes (AI tooling enables) | Suspected | GitHub Copilot users (15) | Yes (SaaS) | Yes (SaaS push) | 30 | 7.8 |
98
- | CVE-2026-30615 (Windsurf MCP local-vector RCE) | No | Partial | No | Suspected (supply-chain) | 150M+ downloads, local-vector + supply-chain prereq | Yes | Yes (IDE update) | 35 | 8.0 |
94
+ | CVE-2026-43284 (Dirty Frag ESP/IPsec) | No | Yes (chain) | Yes (AI-assisted) | Suspected | IPsec-using systems (18) | Yes | RHEL-only kpatch | 53 | 8.8 |
95
+ | CVE-2026-43500 (Dirty Frag RxRPC) | No | Yes (chain) | Yes (AI-assisted) | Suspected | RxRPC-loaded systems (12) | Yes | No | 47 | 7.6 |
96
+ | CVE-2026-46300 (Fragnesia) | No (likely candidate) | Yes (one-liner vs /usr/bin/su) | Yes (AI-assisted) | None observed | Linux >= 5.10 with esp4/esp6/rxrpc loaded (25) | Yes | Yes (kpatch / canonical-livepatch / KernelCare) | 35 | 7.8 |
97
+ | CVE-2025-53773 (Copilot YOLO-mode RCE) | No | Yes (demonstrated) | No (AI-assisted weaponization) | Suspected | GitHub Copilot users (10) | Yes (SaaS) | Yes (SaaS push) | 30 | 7.8 |
98
+ | CVE-2026-30615 (Windsurf MCP local-vector RCE) | No | Yes | No | Suspected (supply-chain) | 150M+ downloads, local-vector + supply-chain prereq (30) | Yes | Yes (IDE update) | 35 | 8.0 |
99
99
 
100
100
  Key reads: Copy Fail (RWEP 90, CVSS 7.8) and Windsurf MCP (RWEP 35, CVSS 8.0) sit at opposite ends of the exploitation-evidence axis — Copy Fail is the canonical case of CVSS under-prioritization (KEV + deterministic public PoC + AI-discovered + broad blast-radius dominate); Windsurf MCP is the canonical case of CVSS-vector blindness (the AV:L local-attack vector plus the supply-chain prerequisite throttle real exploitation rate even after CVSS was corrected from 9.8 to 8.0).
101
101
 
@@ -184,15 +184,15 @@ RWEP = min(100, max(0,
184
184
  |---|---|---|
185
185
  | CISA KEV | No | 0 |
186
186
  | PoC Public | Yes (chain component) | +20 |
187
- | AI-Assisted | No | 0 |
187
+ | AI-Assisted | Yes (discovered with AI assistance, per Sysdig) | +15 |
188
188
  | Active Exploitation | Suspected | +10 (partial) |
189
189
  | Blast Radius | IPsec-using systems, kernel 5.x | +18 |
190
190
  | Patch Available | Yes | -15 |
191
191
  | Live Patch Available | No (kpatch RHEL-only — not broadly available) | 0 |
192
192
  | Reboot Required | Yes | +5 |
193
- | **RWEP** | | **38** |
193
+ | **RWEP** | | **53** |
194
194
 
195
- **Interpretation:** No CISA KEV, suspected (not confirmed) exploitation, and no broad live-patch availability. RWEP 38 vs. CVSS-equivalent 78 — RWEP shows this is less urgent than CVSS suggests absent confirmed exploitation at scale. Critical contextual risk: any host using IPsec for compliance controls (SC-8/SC-28) cannot claim those controls as compensating controls while this CVE is unpatched — the exploit runs through the IPsec implementation.
195
+ **Interpretation:** No CISA KEV, suspected (not confirmed) exploitation, and no broad live-patch availability. RWEP 53 vs. CVSS-equivalent 88 — RWEP shows this is less urgent than CVSS suggests absent confirmed exploitation at scale. Critical contextual risk: any host using IPsec for compliance controls (SC-8/SC-28) cannot claim those controls as compensating controls while this CVE is unpatched — the exploit runs through the IPsec implementation.
196
196
 
197
197
  ---
198
198
 
@@ -202,15 +202,17 @@ RWEP = min(100, max(0,
202
202
  |---|---|---|
203
203
  | CISA KEV | No (likely candidate within days of disclosure) | 0 |
204
204
  | PoC Public | Yes (one-line root shell vs /usr/bin/su) | +20 |
205
- | AI-Assisted | No (human-discovered by V12 security team) | 0 |
205
+ | AI-Assisted | Yes (found by William Bowling of Zellic with the company's AI-agentic auditing tool) | +15 |
206
206
  | Active Exploitation | None observed | 0 |
207
207
  | Blast Radius | Linux >= 5.10 with esp4/esp6/rxrpc loaded | +25 |
208
208
  | Patch Available | Yes (testing on AlmaLinux / CloudLinux; upstream on netdev) | -15 |
209
209
  | Live Patch Available | Yes (kpatch / canonical-livepatch / KernelCare) | -10 |
210
210
  | Reboot Required | No (module-unload mitigation is non-reboot) | 0 |
211
- | **RWEP** | | **20** |
211
+ | **RWEP** | | **35** |
212
+
213
+ **Interpretation:** RWEP 35 today places Fragnesia in the standard-30-day patch band. Two factors will move this fast: (a) a CISA KEV listing adds +25 (RWEP 60 → 72-hour band), and (b) confirmed active exploitation adds another +20 (RWEP 80 → 24-hour band). Operators tracking RWEP should pre-stage the response now while the score is low so the KEV-listing event triggers an already-rehearsed playbook rather than a from-scratch decision. RWEP 35 vs. RWEP 90 for Copy Fail is the canonical "same CVSS band, different urgency" pair for 2026.
212
214
 
213
- **Interpretation:** RWEP 20 today places Fragnesia in the standard-30-day patch band. Two factors will move this fast: (a) a CISA KEV listing adds +25 (RWEP 45 → 7-day band), and (b) confirmed active exploitation adds another +20 (RWEP 65 → 72-hour band). Operators tracking RWEP should pre-stage the response now while the score is low so the KEV-listing event triggers an already-rehearsed playbook rather than a from-scratch decision. Critical operational insight: Fragnesia is the sibling bug introduced by the Dirty Frag patch, and the module-unload mitigation set (`blacklist esp4 / esp6 / rxrpc`) is identical to Dirty Frag's — operators already mitigated for CVE-2026-43284 / CVE-2026-43500 are already mitigated for Fragnesia at zero additional operational cost. RWEP 20 vs. RWEP 90 for Copy Fail is the canonical "same CVSS band, different urgency" pair for 2026.
215
+ Critical operational insight: Fragnesia is the sibling bug introduced by the Dirty Frag patch, and the module-unload mitigation set (`blacklist esp4 / esp6 / rxrpc`) is identical to Dirty Frag's — operators already mitigated for CVE-2026-43284 / CVE-2026-43500 are already mitigated for Fragnesia at zero additional operational cost.
214
216
 
215
217
  ---
216
218
 
@@ -237,10 +239,10 @@ RWEP = min(100, max(0,
237
239
  | Factor | Value | Points |
238
240
  |---|---|---|
239
241
  | CISA KEV | No | 0 |
240
- | PoC Public | Partial | +10 |
242
+ | PoC Public | Yes | +20 |
241
243
  | AI-Assisted | No | 0 |
242
244
  | Active Exploitation | Suspected (supply chain targeting) | +10 |
243
- | Blast Radius | 150M+ MCP-capable assistant downloads, local-vector + supply-chain prerequisite | +20 |
245
+ | Blast Radius | 150M+ MCP-capable assistant downloads, local-vector + supply-chain prerequisite | +30 |
244
246
  | Patch Available | Yes | -15 |
245
247
  | Live Patch Available | Yes (IDE update) | -10 |
246
248
  | Reboot Required | No | 0 |
package/skills/framework-gap-analysis/skill.md CHANGED
@@ -20,7 +20,7 @@ data_deps:
20
20
  atlas_refs: []
21
21
  attack_refs: []
22
22
  framework_gaps: []
23
- last_threat_review: "2026-09-18"
23
+ last_threat_review: "2026-09-28"
24
24
  ---
25
25
 
26
26
  # Framework Gap Analysis
@@ -96,11 +96,11 @@ This skill consumes the matrix produced upstream by the exploit-scoring skill. T
96
96
 
97
97
  | CVE | CVSS | RWEP | KEV | Public PoC | AI-accelerated | Live-patchable | Active exploitation |
98
98
  |---|---|---|---|---|---|---|---|
99
- | CVE-2026-31431 (Copy Fail) | High | Critical | Yes | Yes (732 bytes, deterministic) | Yes (AI-discovered) | Yes (kpatch/livepatch) | Confirmed |
100
- | CVE-2026-43284 (Dirty Frag) | High | High | Pending | Partial | No | Limited (subsystem-dependent) | Suspected |
101
- | CVE-2026-46300 (Fragnesia) | 7.8 | 20 (today) / 55+ on KEV | No (candidate) | Yes (one-liner vs /usr/bin/su) | No | Yes (kpatch / canonical-livepatch / KernelCare) | None observed |
99
+ | CVE-2026-31431 (Copy Fail) | 7.8 | 90 | Yes (2026-05-01) | Yes (732 bytes, deterministic) | Yes (AI-discovered) | Yes (kpatch/livepatch) | Confirmed |
100
+ | CVE-2026-43284 (Dirty Frag) | 8.8 | 53 | No | Yes (chain component) | Yes (AI-assisted discovery) | Limited (kpatch RHEL-only) | Suspected |
101
+ | CVE-2026-46300 (Fragnesia) | 7.8 | 35 (60 if KEV-listed) | No (candidate) | Yes (one-liner vs /usr/bin/su) | Yes (AI-assisted discovery) | Yes (kpatch / canonical-livepatch / KernelCare) | None observed |
102
102
  | CVE-2025-53773 (Copilot YOLO-mode RCE) | 7.8 | 30 | No | Yes (demonstrated) | Yes (AI tooling enables) | Yes (SaaS push / IDE update) | Suspected |
103
- | CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 | 35 | No | Partial | No | Yes (IDE update) | Suspected |
103
+ | CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 | 35 | No | Yes | No | Yes (IDE update) | Suspected |
104
104
 
105
105
  When a gap analysis cites a CVE not in this matrix, the analyst must populate the row from `data/cve-catalog.json` before producing the declaration. A declaration without an evidence row is incomplete.
106
106
 
package/skills/idp-incident-response/skill.md CHANGED
@@ -76,7 +76,7 @@ forward_watch:
76
76
  - NIS2 implementing-act revision enumerating federated-identity control-plane indicators
77
77
  - Cross-tenant access settings evolution at Entra ID — partner-tenant attestation cadence and revocation latency
78
78
  - PSD3 / PSR final text on agent-initiated payments and the IdP-mediated agent-attestation surface
79
- last_threat_review: "2026-05-15"
79
+ last_threat_review: "2026-09-28"
80
80
  ---
81
81
 
82
82
  # Identity-Provider Incident Response (mid-2026)
@@ -149,9 +149,9 @@ Agentic AI is the emerging structural problem on top. AI agents operating on beh
149
149
  | Help-desk social engineering (Scattered Spider) | n/a (social engineering) | high (MGM USD 100M, Caesars USD 15M as public reference) | n/a | Demonstrated at scale | n/a (AI-augmented reconnaissance) | Confirmed ongoing 2022-2026 | Mitigation only — out-of-band identity verification, video-callback to previously-registered number, knowledge-based + government-ID verification, never phone-only | n/a | Help-desk-system audit; vendor-fragmented |
150
150
  | SAML token forgery (Golden SAML / NobleSAML class) | n/a (design class) | high (state-actor priority) | n/a | Public research + active campaigns | n/a | Suspected ongoing against hybrid-identity tenants | Mitigation — signing-key rotation + signing-state attestation + audit-log alerting on signing-cert modification | n/a | Tenant audit log if signing-state modification alerts configured |
151
151
  | ScreenConnect identity-class CVE | 7.5 (CVSS) | high (CISA KEV) | Yes (2024-02) | Yes — public PoC | No | Confirmed exploitation against IdP-adjacent MSP surface | Yes — vendor patch | Patch-class | EDR + tenant audit if integration logged |
152
- | CVE-2024-1709 ScreenConnect authentication bypass | 10.0 | 95 | Yes | Yes | No | Confirmed exploitation 2024 | Yes | Limited — appliance reboot window | Vendor-side patching + IdP-side conditional-access tightening |
153
- | CVE-2023-3519 Citrix NetScaler RCE | 9.8 | 92 | Yes | Yes | No | Confirmed exploitation 2023-2024 (financial-sector and federal targets) | Yes | Limited — appliance reboot | Network telemetry + IdP-tenant access-pattern alerting |
154
- | CVE-2026-30615 Windsurf MCP — adjacent identity surface | 8.6 | 88 | Forward-watched | Yes | Yes | Suspected | Mitigation + vendor patch | n/a | MCP-tool-trust telemetry |
152
+ | CVE-2024-1709 ScreenConnect authentication bypass | 10.0 | 75 | Yes (2024-02-22) | Yes | No | Confirmed exploitation 2024 | Yes | No | Vendor-side patching + IdP-side conditional-access tightening |
153
+ | CVE-2023-3519 Citrix NetScaler RCE | 9.8 | 80 | Yes (2023-07-19) | Yes | No | Confirmed exploitation 2023-2024 (financial-sector and federal targets) | Yes | No | Network telemetry + IdP-tenant access-pattern alerting |
154
+ | CVE-2026-30615 Windsurf MCP — adjacent identity surface | 8.0 | 35 | No | Yes | No | Suspected | Mitigation + vendor patch | Yes (IDE update) | MCP-tool-trust telemetry |
155
155
 
156
156
  **Honest gap statement.** IdP-specific CVEs (Okta Auth0 Workforce CVEs, Entra ID Graph CVEs, Auth0 platform CVEs, Ping platform CVEs, OneLogin platform CVEs) are not exhaustively inventoried in `data/cve-catalog.json`. Authoritative sources: vendor advisories (Okta Security, Microsoft MSRC + Security Update Guide, Auth0 Security Advisories, Ping Identity Security Notices, One Identity Customer Advisory), CISA KEV for cross-sector exposure, CISA AA24 series for federal-targeting advisories, and sector intel feeds. Forward-watched.
157
157
 
package/skills/kernel-lpe-triage/skill.md CHANGED
@@ -52,7 +52,7 @@ forward_watch:
52
52
  - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12 or sooner via Patch Tuesday) — Windows 11 LPE heap buffer overflow by Marcin Wiązowski; track MSRC advisory and KEV add
53
53
  - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12 or sooner via Patch Tuesday) — Windows 11 LPE 2x use-after-free by Kentaro Kawane (GMO); track MSRC advisory and KEV add
54
54
  - Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — RHEL race-condition LPE by chompie / IBM X-Force XOR; track Red Hat advisory and KEV add
55
- last_threat_review: "2026-05-15"
55
+ last_threat_review: "2026-09-28"
56
56
  ---
57
57
 
58
58
  # Kernel LPE Triage
@@ -83,9 +83,9 @@ The attack abuses a write primitive in the copy-on-write path of the page cache.
83
83
  ### Dirty Frag — CVE-2026-43284 + CVE-2026-43500
84
84
 
85
85
  **Classification:** Local Privilege Escalation Chain | Breaks IPsec Mitigations
86
- **CVSS:** 7.8 (High) | **RWEP:** 38/100
86
+ **CVSS / RWEP:** CVE-2026-43284 (CVSS 8.8 High, RWEP 53/100), CVE-2026-43500 (CVSS 7.6 High, RWEP 47/100)
87
87
 
88
- Discovered by Hyunwoo Kim. A two-CVE chain exploiting page-cache write primitives in:
88
+ Discovered by Hyunwoo Kim with AI assistance, per Sysdig's write-up. A two-CVE chain exploiting page-cache write primitives in:
89
89
  - ESP/IPsec subsystem (CVE-2026-43284)
90
90
  - RxRPC subsystem (CVE-2026-43500)
91
91
 
@@ -104,18 +104,18 @@ The IPsec dimension is critical: organizations with network segmentation control
104
104
 
105
105
  ### Fragnesia — CVE-2026-46300
106
106
 
107
- **Classification:** Local Privilege Escalation | Dirty Frag family sequel | Human-Discovered
108
- **CVSS:** 7.8 (High) | **RWEP:** 20/100 (will jump to 55+ on CISA KEV listing)
107
+ **Classification:** Local Privilege Escalation | Dirty Frag family sequel | AI-Assisted Discovery
108
+ **CVSS:** 7.8 (High) | **RWEP:** 35/100 (60 on a CISA KEV listing)
109
109
 
110
- Disclosed 2026-05-13 by William Bowling (V12 security team). Same primitive class as Dirty Frag — Fragnesia is the sibling bug introduced by the patch for CVE-2026-43284 / CVE-2026-43500. The defect is in `skb_try_coalesce()`: when transferring paged fragments between socket buffers, the kernel fails to propagate the `SKBFL_SHARED_FRAG` marker, losing track of externally-backed fragments (page-cache pages spliced from a file). An unprivileged local user can deterministically overwrite read-only file data in the kernel page cache without modifying the on-disk file. Public PoC targets `/usr/bin/su` for a one-line root shell.
110
+ Disclosed 2026-05-13 by William Bowling (V12 security team). The Hacker News and Help Net Security attribute the discovery to William Bowling of Zellic working with Zellic's AI-agentic software auditing tool. Same primitive class as Dirty Frag — Fragnesia is the sibling bug introduced by the patch for CVE-2026-43284 / CVE-2026-43500. The defect is in `skb_try_coalesce()`: when transferring paged fragments between socket buffers, the kernel fails to propagate the `SKBFL_SHARED_FRAG` marker, losing track of externally-backed fragments (page-cache pages spliced from a file). An unprivileged local user can deterministically overwrite read-only file data in the kernel page cache without modifying the on-disk file. Public PoC targets `/usr/bin/su` for a one-line root shell.
111
111
 
112
112
  Key characteristics:
113
- - **Deterministic exploitation** — no race condition, no kernel-version fingerprinting beyond the affected_versions range.
113
+ - **Deterministic exploitation** — no race condition, no kernel-version fingerprinting beyond the affected version range.
114
114
  - **Public PoC** — one-liner against `/usr/bin/su` from the V12 disclosure.
115
115
  - **Page-cache corruption without on-disk write** — file-integrity tools that hash on-disk bytes (AIDE, Tripwire, IMA in measure-only mode) cannot detect the corruption.
116
116
  - **Module-unload mitigation is identical to Dirty Frag** — blacklist `esp4`, `esp6`, `rxrpc` in `/etc/modprobe.d/`. Any host already mitigated for Dirty Frag by module blacklist is already mitigated for Fragnesia, with no further action required.
117
117
  - **Live-patch is non-reboot** — AlmaLinux + CloudLinux kernels in testing as of 2026-05-13; Canonical Livepatch + kpatch follow standard cadence.
118
- - **Not CISA KEV-listed as of 2026-05-14**, no active exploitation observed in the wild yet. RWEP today is 20; expect 55+ if KEV-listed, 65+ if active exploitation confirmed.
118
+ - **Not CISA KEV-listed as of the 2026-09-27 KEV catalog**, and no active exploitation has been observed in the wild. RWEP is 35; a KEV listing takes it to 60, and confirmed active exploitation to 80.
119
119
 
120
120
  **Lesson for operators:** when a CVE patch lands, retain the pre-patch compensating controls (module blacklists, sysctl restrictions) until the patched code has soaked. Fragnesia is the canonical case — the Dirty Frag patch introduced Fragnesia, and the same `modprobe -r esp4 esp6 rxrpc` mitigation covers both.
121
121
 
@@ -168,9 +168,9 @@ Note: ATLAS refs are intentionally empty in frontmatter — these are Linux kern
168
168
  | CVE | CVSS | RWEP | CISA KEV | PoC Public | AI-Discovered | Active Exploitation | Patch Available | Live Patch | Reboot Required |
169
169
  |---|---|---|---|---|---|---|---|---|---|
170
170
  | CVE-2026-31431 (Copy Fail) | 7.8 | 90 | Yes (2026-05-01, due 2026-05-15) | Yes — 732-byte script | Yes | Confirmed | Yes | Yes (kpatch/livepatch/kGraft) | Yes |
171
- | CVE-2026-43284 (Dirty Frag ESP) | 7.8 | 38 | No | Yes | No | Suspected | Yes | No (kpatch RHEL-only) | Yes |
172
- | CVE-2026-43500 (Dirty Frag RxRPC) | 7.6 | 81 | No | Yes (chain component) | No | Suspected | Yes | Partial (kpatch) | Yes if no live patch |
173
- | CVE-2026-46300 (Fragnesia) | 7.8 | 20 | No (likely candidate) | Yes — one-liner vs /usr/bin/su | No | None observed | Yes (testing on Alma/CloudLinux) | Yes (kpatch / canonical-livepatch / KernelCare) | No (module-unload mitigation is non-reboot) |
171
+ | CVE-2026-43284 (Dirty Frag ESP) | 8.8 | 53 | No | Yes | Yes (AI-assisted) | Suspected | Yes | No (kpatch RHEL-only) | Yes |
172
+ | CVE-2026-43500 (Dirty Frag RxRPC) | 7.6 | 47 | No | Yes (chain component) | Yes (AI-assisted) | Suspected | Yes | No | Yes |
173
+ | CVE-2026-46300 (Fragnesia) | 7.8 | 35 | No (likely candidate) | Yes — one-liner vs /usr/bin/su | Yes (AI-assisted) | None observed | Yes (testing on Alma/CloudLinux) | Yes (kpatch / canonical-livepatch / KernelCare) | No (module-unload mitigation is non-reboot) |
174
174
 
175
175
  ---
176
176
 
@@ -338,9 +338,9 @@ Produce this structure:
338
338
 
339
339
  ### RWEP Scores
340
340
  CVE-2026-31431: CVSS 7.8 / RWEP 90 — immediate action required (4h)
341
- CVE-2026-43284: CVSS 7.8 / RWEP 38 — remediate within 7 days; disable RxRPC/IPsec chain if not required
342
- CVE-2026-43500: CVSS 7.6 / RWEP 32 — remediate within 7 days; consider disabling RxRPC module
343
- CVE-2026-46300: CVSS 7.8 / RWEP 20 — patch within standard cycle; module unload (esp4/esp6/rxrpc) is the immediate non-reboot mitigation. Same mitigation set as Dirty Frag — already-blacklisted hosts are already covered. Reassess if CISA KEV-listed (expected RWEP 55+).
341
+ CVE-2026-43284: CVSS 8.8 / RWEP 53 — remediate within 7 days; disable RxRPC/IPsec chain if not required
342
+ CVE-2026-43500: CVSS 7.6 / RWEP 47 — remediate within 7 days; consider disabling RxRPC module
343
+ CVE-2026-46300: CVSS 7.8 / RWEP 35 — patch within standard cycle; module unload (esp4/esp6/rxrpc) is the immediate non-reboot mitigation. Same mitigation set as Dirty Frag — already-blacklisted hosts are already covered. Reassess on a CISA KEV listing, which adds 25 points.
344
344
  ```
345
345
 
346
346
  ---
@@ -389,7 +389,7 @@ Maps the kernel LPE findings above to MITRE D3FEND techniques with explicit defe
389
389
 
390
390
  After producing the kernel LPE triage output, the operator should chain into the following skills. Each entry names a downstream or sibling skill and the specific reason to invoke it from this finding.
391
391
 
392
- - **`exploit-scoring`** — recalculate RWEP when any of the inputs that drive the score change post-triage: a new CISA KEV listing for Dirty Frag, a public PoC for CVE-2026-43500's RxRPC leg, or an AI-discovery flag flip. RWEP, not CVSS, is the prioritisation signal — re-run scoring rather than re-reading the static value in the matrix above.
392
+ - **`exploit-scoring`** — recalculate RWEP when any of the inputs that drive the score change post-triage: a new CISA KEV listing for Dirty Frag, confirmed active exploitation of either leg, or an AI-discovery flag flip. RWEP, not CVSS, is the prioritisation signal — re-run scoring rather than re-reading the static value in the matrix above.
393
393
  - **`defensive-countermeasure-mapping`** — map each kernel LPE finding to D3FEND counters (D3-EAL for executable allowlisting at the kernel-module layer, D3-ASLR for address-space layout randomisation hardening, D3-PSEP for process self-modification prevention, D3-PHRA for process hardening / runtime attestation) and produce the defence-in-depth, least-privilege, zero-trust layered remediation plan rather than a single-control patch ticket.
394
394
  - **`attack-surface-pentest`** — verify that the kernel LPE class is in the organisation's pen-test scope (TIBER-EU / DORA TLPT for EU financial-sector orgs, CBEST for UK financial, or the equivalent red-team programme). Most 2025-vintage pen-test scopes are perimeter / web-app focused and do not exercise local LPE primitives against the patched-kernel claim.
395
395
  - **`compliance-theater`** — test whether the org's SI-2 / A.8.8 / PCI 6.3.3 patch-management evidence is CVSS-anchored theater for a KEV-listed, AI-discovered, 732-byte deterministic LPE. The 30-day window is the exploitation window; if the org cannot show live-patch-within-4-hours capability or documented compensating controls, the patch-management control is theater for this CVE class.
package/skills/policy-exception-gen/skill.md CHANGED
@@ -23,7 +23,7 @@ forward_watch:
23
23
  - EU CRA exceptions for AI pipeline components
24
24
  - NIST SP 800-204 series updates for microservices
25
25
  - FedRAMP updates for container/serverless authorization
26
- last_threat_review: "2026-09-18"
26
+ last_threat_review: "2026-09-28"
27
27
  ---
28
28
 
29
29
  # Policy Exception Generation
@@ -109,10 +109,10 @@ For each residual TTP an exception leaves in scope, the compensating control bun
109
109
 
110
110
  | Residual TTP | Evidence CVE / class | CVSS | RWEP tier | KEV | Public PoC | AI-accelerated | Live-patchable | Implication for compensating bundle |
111
111
  |---|---|---|---|---|---|---|---|---|
112
- | T1068 (Privilege Escalation — Copy Fail class) | CVE-2026-31431 | High | Critical | Yes | Yes (732 bytes, deterministic) | Yes | Yes (kpatch/livepatch) | Live patch within 4 hours OR network isolation — anything weaker is non-defensible |
113
- | T1190 (Exploit Public-Facing Application — IPsec subsystem) | CVE-2026-43284 (Dirty Frag) | High | High | Pending | Partial | No | Limited | eBPF kernel-text integrity monitoring + maintenance-window reboot SLA |
112
+ | T1068 (Privilege Escalation — Copy Fail class) | CVE-2026-31431 | 7.8 | 90 | Yes (2026-05-01) | Yes (732 bytes, deterministic) | Yes | Yes (kpatch/livepatch) | Live patch within 4 hours OR network isolation — anything weaker is non-defensible |
113
+ | T1190 (Exploit Public-Facing Application — IPsec subsystem) | CVE-2026-43284 (Dirty Frag) | 8.8 | 53 | No | Yes (chain component) | Yes (AI-assisted discovery) | Limited (kpatch RHEL-only) | eBPF kernel-text integrity monitoring + maintenance-window reboot SLA |
114
114
  | AML.T0051 (LLM Prompt Injection — emergent on model upgrade) | CVE-2025-53773 (Copilot YOLO-mode RCE) | 7.8 (AV:L) | 30 | No | Yes | Yes | Yes (SaaS push / IDE update) | Behavioral regression suite + system-prompt hardening + tool allowlist |
115
- | AML.T0010 (ML Supply Chain Compromise — MCP) | CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 (AV:L) | 35 | No | Partial | No | Yes (IDE update) | MCP server allowlist + signed-manifest enforcement + per-server auth |
115
+ | AML.T0010 (ML Supply Chain Compromise — MCP) | CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 (AV:L) | 35 | No | Yes | No | Yes (IDE update) | MCP server allowlist + signed-manifest enforcement + per-server auth |
116
116
  | T1525 / T1610 (Implant Internal Image / Deploy Container) | Image-supply-chain class | Varies | High | N/A | Operational | Yes | N/A (image rebuild) | CI image scanning gate at CVSS ≥ 7.0, SBOM per image, image-registry signing |
117
117
 
118
118
  An exception that names a residual TTP without a compensating-control bundle of equal or greater RWEP-justified strength is theater. The compliance-theater skill's universal test (demand the bypassing TTP for any claimed compensating control) should be run against the bundle before the exception is approved.
package/skills/sector-federal-government/skill.md CHANGED
@@ -60,7 +60,7 @@ forward_watch:
60
60
  - UK GovAssure replacing the legacy IT Health Check (ITHC) scheme — phased rollout for departments and ALBs through 2026
61
61
  - EU Cybersecurity Certification Scheme on Common Criteria (EUCC) operational — first certificates issued 2024; high-assurance level for government use cases ramping
62
62
  - Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities
63
- last_threat_review: "2026-09-18"
63
+ last_threat_review: "2026-09-28"
64
64
  discovery_mode: "standalone" # operator-reached via `exceptd brief sector-federal-government` or `exceptd ask`; not chained into any playbook's direct.skill_chain by design
65
65
  ---
66
66
 
@@ -140,11 +140,11 @@ Sourced from `data/cve-catalog.json`, `data/exploit-availability.json`, and CISA
140
140
 
141
141
  | Incident / Class | CVSS | RWEP | PoC Public? | CISA KEV? | AI-Accelerated? | Patch / Mitigation | FedRAMP-Visible? | CMMC-Visible? | SSDF-Attestable? |
142
142
  |---|---|---|---|---|---|---|---|---|---|
143
- | CVE-2026-30615 (Windsurf MCP local-vector RCE — DIB development environments) | 8.0 | 35 (see `cve-catalog.json`) | Partial conceptual exploit | No (architectural class) | Rides on AI agent tool-call autonomy; AV:L (attacker-controlled HTML processed by the MCP client) | Vendor IDE update + manifest signing + MCP server allowlisting | Limited — developer workstation tooling typically outside FedRAMP boundary | Partially — CMMC Level 2 CM (configuration management) and AC (access control) families touch developer workstations handling CUI; MCP-specific controls absent | SSDF practice PS.2 covers software dependency integrity but does not specify MCP manifest signing |
143
+ | CVE-2026-30615 (Windsurf MCP local-vector RCE — DIB development environments) | 8.0 | 35 (see `cve-catalog.json`) | Yes | No (architectural class) | Rides on AI agent tool-call autonomy; AV:L (attacker-controlled HTML processed by the MCP client) | Vendor IDE update + manifest signing + MCP server allowlisting | Limited — developer workstation tooling typically outside FedRAMP boundary | Partially — CMMC Level 2 CM (configuration management) and AC (access control) families touch developer workstations handling CUI; MCP-specific controls absent | SSDF practice PS.2 covers software dependency integrity but does not specify MCP manifest signing |
144
144
  | Volt Typhoon pre-positioning (PRC nation-state, CISA/FBI/NSA joint advisories ongoing since May 2023) | N/A (campaign) | N/A | Yes — public IOC sets and TTP descriptions | Multiple component CVEs in KEV | Yes — AI-assisted lateral movement reported in adjacent campaigns | Living-off-the-land detection; rigorous identity ZT (M-22-09 pillar 1); network ZT (M-22-09 pillar 3); credential hygiene | Partially — FedRAMP ConMon detects only the cloud-tenant surface | Partially — CMMC AC + AU + IR families address detection but not pre-positioning specifically | No — SSDF is producer-side |
145
145
  | Salt Typhoon US telco intrusions (PRC nation-state, publicly disclosed late 2024) | N/A (campaign) | N/A | Yes — IOC sets and CISA/FBI joint advisories | Multiple component CVEs in KEV | Yes — large-scale exploitation of edge-device CVEs | Patch + replace EOL edge devices; lawful-intercept-interface hardening; segment carrier management plane | No — telco infrastructure outside FedRAMP scope | No — telco carriers outside CMMC scope | No |
146
146
  | SolarWinds Orion supply-chain compromise (CVE-2020-10148 + SUNBURST backdoor, historical reference) | 9.8 | not in current `data/cve-catalog.json` — pre-scope incident | Yes — fully post-disclosure | Yes (KEV at time of disclosure) | No — long-game manual TTP | Patch; rotate all credentials handled by affected Orion deployments; rebuild from clean state | Yes — FedRAMP-authorized SolarWinds Orion ATOs were impacted; ConMon did not detect the implanted update | Yes — DIB contractors using Orion were impacted; current 800-171 SI-3 / SI-4 controls would not have detected the implant | Partially — SLSA L3 + in-toto + reproducible builds would have detected the build-time tampering; SSDF self-attestation alone would not |
147
- | XZ Utils backdoor (CVE-2024-3094, 2024) | 10.0 | 70 (catalog: KEV 2024-04-03; active_exploitation=suspected; ai_discovered=false) | Yes — fully public post-disclosure | Yes — KEV 2024-04-03 | No — multi-year human social-engineering long game | Distro rollback to 5.4.x; key revocation in federal build pipelines | Indirectly — federal-procured Linux distros downstream of upstream sshd were exposed | Yes — DIB development environments built against affected distros were in scope | Partially — SSDF PS.1 / PS.2 reference dependency integrity; do not require SLSA L3 detection |
147
+ | XZ Utils backdoor (CVE-2024-3094, 2024) | 10.0 | 45 (see `cve-catalog.json`; not KEV-listed, exploitation suspected, human-discovered) | Yes — fully public post-disclosure | No | No — multi-year human social-engineering long game | Distro rollback to 5.4.x; key revocation in federal build pipelines | Indirectly — federal-procured Linux distros downstream of upstream sshd were exposed | Yes — DIB development environments built against affected distros were in scope | Partially — SSDF PS.1 / PS.2 reference dependency integrity; do not require SLSA L3 detection |
148
148
  | Typosquat against MCP / `@modelcontextprotocol/*` / Hugging Face namespaces targeting DIB AI developers (AML.T0010 class, ongoing) | N/A (technique class) | N/A | Yes — multiple public incidents | No (technique class) | Yes — AI assistants accelerate convincing tool-description authoring | Pin versions; verify publisher provenance; enforce private registry mirroring for CUI development environments | Limited | Partially — CMMC SC + SI families address some controls but MCP namespace specifically is not covered | Yes — SSDF practice PS.2 (software integrity) applies but does not specify the technique-class control |
149
149
  | AI-generated code committed to federal / DIB codebases without provenance markers (no CVE — class risk) | N/A | N/A | Pervasive | No | Yes — by definition | Commit-trailer provenance markers; PR-level attestation; in-CI AI-code detector; restricted federal-codebase AI tool allowlist | No — not within FedRAMP control set | No — CMMC Level 2 does not address AI-codegen provenance | No — SSDF does not specify AI-codegen attribution |
150
150
  | Edge / VPN appliance zero-days driving recent CISA Emergency Directives (ED 24-01 Ivanti Connect Secure class, ED 24-02 Microsoft / Midnight Blizzard, ongoing 2024-2026) | varies — multiple CVEs, most in KEV | varies | Yes — public PoCs typically within days | Yes | Yes — AI-assisted reverse engineering on appliance firmware reported | Vendor patch + agency-specific compensating controls per the ED text; ED-mandated actions within hours-to-days | Yes — affected appliances often within FedRAMP-authorized boundaries or boundary-adjacent | Yes — DIB contractors using affected appliances inherit the threat | Producer-side — appliance vendor SSDF attestations are downstream evidence |
package/skills/security-maturity-tiers/skill.md CHANGED
@@ -44,7 +44,7 @@ forward_watch:
44
44
  - Framework updates that change minimum compliance baselines
45
45
  - New tooling that makes higher tiers more accessible
46
46
  - PQC tooling maturity shifting overkill to practical
47
- last_threat_review: "2026-09-18"
47
+ last_threat_review: "2026-09-28"
48
48
  ---
49
49
 
50
50
  # Security Maturity Tiers
@@ -526,14 +526,14 @@ D3FEND references from `data/d3fend-catalog.json`. This skill prescribes a roadm
526
526
 
527
527
  Tiered to the current `data/cve-catalog.json`, using RWEP (`lib/scoring.js`) as the priority metric, not CVSS:
528
528
 
529
- | Tier | Coverage requirement | CVEs in scope as of 2026-05-01 | Available exploits | Required protective state |
529
+ | Tier | Coverage requirement | Example CVEs in scope | Available exploits | Required protective state |
530
530
  |---|---|---|---|---|
531
531
  | MVP | RWEP >= 70 | CVE-2026-31431 (Copy Fail, RWEP 90, CVSS 7.8) | Public 732-byte deterministic PoC; KEV-listed 2026-05-01 (federal due 2026-05-15); AI-discovered; live-patch available (kpatch / canonical-livepatch / kGraft) | Live-patched within hours of KEV listing OR fully patched + rebooted OR network-isolated with documented reboot date |
532
- | Practical | RWEP >= 30 | CVE-2026-31431 (90), CVE-2026-30615 (Windsurf MCP local-vector RCE, 35, CVSS 8.0), CVE-2025-53773 (Copilot YOLO-mode RCE, 30, CVSS 7.8) | Copy Fail as above; CVE-2026-30615 + CVE-2025-53773 both AV:L local-vector, demonstrated PoC, vendor-patchable; AI-coding-assistant scope | All MVP coverage plus: prompt-injection classifier in front of any LLM processing external content; phishing simulation using AI-generated content; org-wide AI-coding-assistant version management; MCP server allowlisting with signed manifests |
533
- | Overkill | All catalog entries regardless of RWEP | CVE-2026-31431 (90), CVE-2026-43284 (Dirty Frag ESP/IPsec, 38, CVSS 7.8), CVE-2026-30615 (Windsurf MCP local-vector RCE, 35, CVSS 8.0), CVE-2026-43500 (Dirty Frag RxRPC, 32, CVSS 7.6), CVE-2025-53773 (Copilot YOLO-mode RCE, 30, CVSS 7.8) | Public PoC for all; Dirty Frag pair has no live patch (kpatch RHEL-only); Windsurf is local-vector supply-chain class; chained Dirty Frag requires kernel-version fingerprinting | All Practical coverage plus: kernel hardening (unprivileged_userns_clone=0, unprivileged_userfaultfd=0, kptr_restrict=2); seccomp profiles on all containers; eBPF runtime detection; immutable infrastructure for the workloads that tolerate it; sandboxed MCP execution; per-invocation capability tokens for AI agents |
532
+ | Practical | RWEP >= 30 | CVE-2026-31431 (90), CVE-2026-43284 (Dirty Frag ESP/IPsec, 53, CVSS 8.8), CVE-2026-43500 (Dirty Frag RxRPC, 47, CVSS 7.6), CVE-2026-30615 (Windsurf MCP local-vector RCE, 35, CVSS 8.0), CVE-2025-53773 (Copilot YOLO-mode RCE, 30, CVSS 7.8) | Copy Fail as above; the Dirty Frag pair has a public chain PoC and no broad live patch (kpatch RHEL-only); CVE-2026-30615 + CVE-2025-53773 both AV:L local-vector, demonstrated PoC, vendor-patchable; AI-coding-assistant scope | All MVP coverage plus: prompt-injection classifier in front of any LLM processing external content; phishing simulation using AI-generated content; org-wide AI-coding-assistant version management; MCP server allowlisting with signed manifests |
533
+ | Overkill | All catalog entries regardless of RWEP | CVE-2026-31431 (90), CVE-2026-43284 (Dirty Frag ESP/IPsec, 53, CVSS 8.8), CVE-2026-30615 (Windsurf MCP local-vector RCE, 35, CVSS 8.0), CVE-2026-43500 (Dirty Frag RxRPC, 47, CVSS 7.6), CVE-2025-53773 (Copilot YOLO-mode RCE, 30, CVSS 7.8) | Public PoC for all; Dirty Frag pair has no live patch (kpatch RHEL-only); Windsurf is local-vector supply-chain class; chained Dirty Frag requires kernel-version fingerprinting | All Practical coverage plus: kernel hardening (unprivileged_userns_clone=0, unprivileged_userfaultfd=0, kptr_restrict=2); seccomp profiles on all containers; eBPF runtime detection; immutable infrastructure for the workloads that tolerate it; sandboxed MCP execution; per-invocation capability tokens for AI agents |
534
534
 
535
535
  Refresh trigger: re-run `node lib/scoring.js` and rebuild this matrix whenever `data/cve-catalog.json` is updated. The zero-day learning loop also feeds back into the tier mapping when a new CVE is added.
536
536
 
537
- Note on CVSS divergence: every CVE in this catalog has a CVSS in the 7.6–8.0 range — CVSS alone would prioritise the highest-band CVE without distinguishing the AI-discovered KEV-listed deterministic LPE (Copy Fail) from the local-vector MCP supply-chain class (Windsurf). RWEP correctly ranks Copy Fail (90) above Windsurf (35) because KEV listing, deterministic exploitability, AI discovery, and broad blast radius dominate. The MVP tier protects against the right thing first.
537
+ Note on CVSS divergence: every CVE in this matrix has a CVSS between 7.6 and 8.8, so CVSS alone would prioritize the highest-band CVE without distinguishing the AI-discovered KEV-listed deterministic LPE (Copy Fail) from the local-vector MCP supply-chain class (Windsurf). RWEP correctly ranks Copy Fail (90) above Windsurf (35) because KEV listing, deterministic exploitability, AI discovery, and broad blast radius dominate. The MVP tier protects against the right thing first.
538
538
 
539
539
  ---
package/skills/supply-chain-integrity/skill.md CHANGED
@@ -67,7 +67,7 @@ d3fend_refs:
67
67
  - D3-CBAN
68
68
  - D3-EAL
69
69
  - D3-EHB
70
- last_threat_review: "2026-09-18"
70
+ last_threat_review: "2026-09-28"
71
71
  ---
72
72
 
73
73
  # Supply-Chain Integrity Assessment
@@ -167,8 +167,8 @@ Sourced from `data/cve-catalog.json`, `data/exploit-availability.json`, and publ
167
167
 
168
168
  | Incident / Class | CVSS | RWEP | PoC Public? | CISA KEV? | AI-Accelerated? | Patch / Mitigation | SLSA-Detectable? | SBOM-Detectable? | VEX-Helpful? |
169
169
  |---|---|---|---|---|---|---|---|---|---|
170
- | CVE-2026-30615 (Windsurf MCP zero-interaction RCE) | 9.8 | 35 (see `cve-catalog.json`) | Partial conceptual exploit | No (architectural class) | No direct AI weaponization recorded; the attack rides on AI agent tool-call autonomy | Vendor IDE update + manifest signing | Partially — SLSA L3 on the MCP server build would attest the binary, but client-side trust verification is the actual control | Partially — SBOM lists the MCP server package; VEX from the publisher would mark unpatched versions as `affected` | Yes — CSAF 2.0 VEX from the vendor classifies versions |
171
- | XZ Utils backdoor (CVE-2024-3094, 2024) | 10.0 | 70 (catalog: KEV 2024-04-03; active_exploitation=suspected; ai_discovered=false) | Yes — fully public post-disclosure | Yes — KEV 2024-04-03 | No — multi-year human social-engineering long game | Distro rollback to 5.4.x; key revocation in build pipelines | Yes — SLSA L3 with reproducible builds would have detected divergence between source and binary | Partially — SBOM lists `xz` but not the modified release tarball provenance | Yes — VEX statements published rapidly after disclosure |
170
+ | CVE-2026-30615 (Windsurf MCP local-vector RCE) | 8.0 | 35 (see `cve-catalog.json`) | Yes | No (architectural class) | No direct AI weaponization recorded; the attack rides on AI agent tool-call autonomy | Vendor IDE update + manifest signing | Partially — SLSA L3 on the MCP server build would attest the binary, but client-side trust verification is the actual control | Partially — SBOM lists the MCP server package; VEX from the publisher would mark unpatched versions as `affected` | Yes — CSAF 2.0 VEX from the vendor classifies versions |
171
+ | XZ Utils backdoor (CVE-2024-3094, 2024) | 10.0 | 45 (see `cve-catalog.json`; not KEV-listed, exploitation suspected, human-discovered) | Yes — fully public post-disclosure | No | No — multi-year human social-engineering long game | Distro rollback to 5.4.x; key revocation in build pipelines | Yes — SLSA L3 with reproducible builds would have detected divergence between source and binary | Partially — SBOM lists `xz` but not the modified release tarball provenance | Yes — VEX statements published rapidly after disclosure |
172
172
  | Typosquat in `@modelcontextprotocol/*` namespace (AML.T0010 class, ongoing 2024-2026) | N/A (technique class) | N/A | Yes — multiple public incidents | No (technique class) | Yes — AI assistants accelerate convincing tool-description authoring | Mitigation only: pin versions, verify npm provenance attestation, enforce publisher allowlist | Yes — SLSA provenance from a known publisher fails for a typosquatted package | Yes — SBOM diff at install time flags new unrecognized package | Limited — VEX is about known vulns, not malicious-by-design packages |
173
173
  | Hugging Face poisoned model weights (AML.T0018, ongoing) | N/A (technique class) | N/A | Yes — public research demonstrations of RCE in model artifacts using code-executing serialization formats | No | Yes — adversarial weights via training-data poisoning is AI-accelerated | Reject code-executing serialization formats; require safetensors; verify Sigstore / OpenSSF model-signing signatures | Yes — SLSA-style attestation of model training run | Partial — ML-BOM (CycloneDX 1.6) inventories models; does not by itself attest integrity | Limited — VEX semantics map weakly to model integrity |
174
174
  | AI-coding-assistant generated code with no provenance markers (no CVE — class risk) | N/A | N/A | N/A — pervasive in 2024-2026 codebases | No | Yes — by definition | Mitigation: commit-message provenance markers, in-toto-style attestation that ties commit to model + prompt context | Partially — SLSA provenance can attest the human author of a commit; AI-co-author attribution is not standardized | No — SBOM does not currently inventory AI-generated code segments | Not applicable |
package/skills/threat-model-currency/skill.md CHANGED
@@ -22,7 +22,7 @@ forward_watch:
22
22
  - New CISA KEV entries in kernel/AI/supply chain categories
23
23
  - New MCP or agent protocol security disclosures
24
24
  - Emerging malware families using AI for evasion
25
- last_threat_review: "2026-09-18"
25
+ last_threat_review: "2026-09-28"
26
26
  discovery_mode: "standalone" # operator-reached via `exceptd brief threat-model-currency` or `exceptd ask`; not chained into any playbook's direct.skill_chain by design
27
27
  ---
28
28
 
@@ -294,12 +294,12 @@ A threat model is "current" only if it accounts for every `data/cve-catalog.json
294
294
  |---|---|---|---|---|---|---|---|---|
295
295
  | CVE-2026-31431 | Copy Fail | 7.8 | 90 | Yes (2026-05-01, due 2026-05-15) | Yes — 732-byte deterministic | AI-discovered | Yes (kpatch / canonical-livepatch / kGraft) | Must name as named threat. Patch SLA must reflect KEV + deterministic class — live-patch within hours, not 30 days. |
296
296
  | CVE-2025-53773 | Copilot YOLO-mode RCE | 7.8 | 30 | No | Yes — demonstrated | AI-weaponized | Yes (SaaS vendor patch / IDE update) | Must include prompt-injection-driven YOLO-mode escalation as RCE vector if any developer uses Copilot. |
297
- | CVE-2026-30615 | Windsurf MCP local-vector RCE | 8.0 | 35 | No | Partial | No | Yes (IDE update) | Must include MCP supply chain if any developer uses any MCP-capable assistant. |
298
- | CVE-2026-43284 | Dirty Frag (ESP/IPsec) | 7.8 | 38 | No | Yes — chain component | No | No | Required if IPsec-based controls are claimed as compensating. |
299
- | CVE-2026-43500 | Dirty Frag (RxRPC) | 7.6 | 32 | No | Yes — chain component | No | No | Required when chained with CVE-2026-43284 in IR scenario planning. |
300
- | CVE-2026-46300 | Fragnesia | 7.8 | 20 (today) / 55+ on KEV | No (candidate) | Yes — one-liner vs /usr/bin/su | No (human-discovered by V12 security team) | Yes (kpatch / canonical-livepatch / KernelCare) | Required when the threat model claims patches close bug families — Fragnesia is the sibling bug introduced by the Dirty Frag patch; the same `blacklist esp4 / esp6 / rxrpc` mitigation covers both. Treat as the canonical "today" example of threat-intel decay measured in days, not quarters. |
297
+ | CVE-2026-30615 | Windsurf MCP local-vector RCE | 8.0 | 35 | No | Yes | No | Yes (IDE update) | Must include MCP supply chain if any developer uses any MCP-capable assistant. |
298
+ | CVE-2026-43284 | Dirty Frag (ESP/IPsec) | 8.8 | 53 | No | Yes — chain component | AI-assisted discovery | No | Required if IPsec-based controls are claimed as compensating. |
299
+ | CVE-2026-43500 | Dirty Frag (RxRPC) | 7.6 | 47 | No | Yes — chain component | AI-assisted discovery | No | Required when chained with CVE-2026-43284 in IR scenario planning. |
300
+ | CVE-2026-46300 | Fragnesia | 7.8 | 35 (60 if KEV-listed) | No (candidate) | Yes — one-liner vs /usr/bin/su | AI-assisted discovery (Zellic's agentic auditing tool) | Yes (kpatch / canonical-livepatch / KernelCare) | Required when the threat model claims patches close bug families — Fragnesia is the sibling bug introduced by the Dirty Frag patch; the same `blacklist esp4 / esp6 / rxrpc` mitigation covers both. Treat as the canonical "today" example of threat-intel decay measured in days, not quarters. |
301
301
 
302
- The hard rule for currency scoring: every CVE in the catalog with RWEP >= 50 (currently CVE-2026-31431) must appear in the threat model under its named threat or its CVE ID. RWEP 40–49 entries should appear if the org uses the affected technology. Sub-40 entries appear by exception.
302
+ The hard rule for currency scoring: every CVE in the catalog with RWEP >= 50 (query `data/cve-catalog.json` for the current set) must appear in the threat model under its named threat or its CVE ID. RWEP 40–49 entries should appear if the org uses the affected technology. Sub-40 entries appear by exception.
303
303
 
304
304
  Run `node lib/scoring.js` to recompute RWEP if `data/cve-catalog.json` has been updated since `last_threat_review`.
305
305
 
package/skills/zeroday-gap-learn/skill.md CHANGED
@@ -23,7 +23,7 @@ forward_watch:
23
23
  - New ATLAS TTP additions in each ATLAS release
24
24
  - Framework updates that close previously open gaps
25
25
  - Vendor advisories for MCP/AI tool supply chain CVEs
26
- last_threat_review: "2026-09-18"
26
+ last_threat_review: "2026-09-28"
27
27
  discovery_mode: "standalone" # operator-reached via `exceptd brief zeroday-gap-learn` or `exceptd ask`; not chained into any playbook's direct.skill_chain by design
28
28
  ---
29
29
 
@@ -94,13 +94,13 @@ Status of the learning-loop entry for each CVE currently in `data/cve-catalog.js
94
94
  | CVE | KEV | PoC | AI-Discovered / AI-Enabled | RWEP | Lesson-Entry Status in `zeroday-lessons.json` |
95
95
  |---|---|---|---|---|---|
96
96
  | CVE-2026-31431 (Copy Fail) | Yes | Yes (732-byte) | Yes (AI-discovered ~1h) | 90 | Complete — pre-run lesson encoded below; new control requirements CISA-KEV-RESPONSE-SLA, LIVE-PATCH-CAPABILITY, KERNEL-EXPLOITATION-DETECTION generated |
97
- | CVE-2026-43284 (Dirty Frag — ESP/IPsec) | No | Yes (chain) | No | 38 | Complete — pre-run lesson encoded; new control requirements CRYPTO-SUBSYSTEM-INTEGRITY, PRE-PATCH-DISCLOSURE-RESPONSE generated |
98
- | CVE-2026-43500 (Dirty Frag — RxRPC) | No | Yes (chain) | No | 32 | Complete — covered jointly with CVE-2026-43284 (chain partner) |
97
+ | CVE-2026-43284 (Dirty Frag — ESP/IPsec) | No | Yes (chain) | Yes (AI-assisted discovery) | 53 | Complete — pre-run lesson encoded; new control requirements CRYPTO-SUBSYSTEM-INTEGRITY, PRE-PATCH-DISCLOSURE-RESPONSE generated |
98
+ | CVE-2026-43500 (Dirty Frag — RxRPC) | No | Yes (chain) | Yes (AI-assisted discovery) | 47 | Complete — covered jointly with CVE-2026-43284 (chain partner) |
99
99
  | CVE-2025-53773 (Copilot YOLO-mode RCE) | No | Yes (demonstrated) | Yes (AI tooling enables) | 30 | Complete — pre-run lesson encoded; new control requirements AI-TOOL-ACTION-AUTHORIZATION, AI-TOOL-INPUT-SANITIZATION, PROMPT-INJECTION-MONITORING generated |
100
- | CVE-2026-30615 (Windsurf MCP local-vector RCE) | No | Partial | No (supply-chain) | 35 | Complete — pre-run lesson encoded; new control requirements MCP-SERVER-SIGNING, MCP-TOOL-ALLOWLIST, MCP-SUPPLY-CHAIN-AUDIT generated |
101
- | CVE-2026-45321 (Mini Shai-Hulud TanStack npm worm) | Pending | Yes (worm in-wild) | No (engineering-grade chain) | n/a | Pre-run exemplar lesson encoded below (chained CI/CD primitives — Pwn Request + pnpm-store poisoning + OIDC theft); new control requirements PR-WORKFLOW-PRIVILEGE-CAP, ACTIONS-CACHE-INTEGRITY, OIDC-PUBLISH-AUDIT generated |
100
+ | CVE-2026-30615 (Windsurf MCP local-vector RCE) | No | Yes | No (supply-chain) | 35 | Complete — pre-run lesson encoded; new control requirements MCP-SERVER-SIGNING, MCP-TOOL-ALLOWLIST, MCP-SUPPLY-CHAIN-AUDIT generated |
101
+ | CVE-2026-45321 (Mini Shai-Hulud TanStack npm worm) | Yes (2026-05-27) | Yes (worm in-wild) | No (engineering-grade chain) | 70 | Pre-run exemplar lesson encoded below (chained CI/CD primitives — Pwn Request + pnpm-store poisoning + OIDC theft); new control requirements PR-WORKFLOW-PRIVILEGE-CAP, ACTIONS-CACHE-INTEGRITY, OIDC-PUBLISH-AUDIT generated |
102
102
  | MAL-2026-3083 (Elementary-Data PyPI worm — forged release via GitHub Actions script-injection) | No (OSSF Malicious Packages dataset; CISA KEV catalogues vendor CVEs only) | Yes (orphan commit + exfil domain confirmed in-wild during 8h window) | No (manual chain) | n/a | Pre-run exemplar lesson encoded below; control requirements GHACTIONS-EVENT-INTERPOLATION-BAN, INSTALL-HOOK-AUDIT, OSSF-MALPACKAGES-INGEST generated |
103
- | CVE-2026-46300 (Fragnesia — Dirty Frag sequel) | No (candidate within days) | Yes (one-liner vs /usr/bin/su) | No (human-discovered by V12 security team) | 20 | Complete — pre-run lesson encoded below; control requirements PAGE-CACHE-INTEGRITY-VERIFICATION, BUG-FAMILY-MITIGATION-PERSISTENCE, SCANNER-PAPER-COMPLIANCE-TEST generated. Pattern: a patch for one bug class introduced a sibling bug in the same primitive class. |
103
+ | CVE-2026-46300 (Fragnesia — Dirty Frag sequel) | No (candidate within days) | Yes (one-liner vs /usr/bin/su) | Yes (AI-assisted discovery with Zellic's agentic auditing tool) | 35 | Complete — pre-run lesson encoded below; control requirements PAGE-CACHE-INTEGRITY-VERIFICATION, BUG-FAMILY-MITIGATION-PERSISTENCE, SCANNER-PAPER-COMPLIANCE-TEST generated. Pattern: a patch for one bug class introduced a sibling bug in the same primitive class. |
104
104
 
105
105
  Every new entry added to `data/cve-catalog.json` must produce a corresponding entry here and in `data/zeroday-lessons.json` before the catalog change ships. Any CVE in the catalog without a complete lesson entry is a pre-ship-checklist failure.
106
106
 
@@ -234,7 +234,7 @@ Output: Lesson entry for data/zeroday-lessons.json
234
234
  3. **SCANNER-PAPER-COMPLIANCE-TEST**: A vulnerability scanner that reports "patched" based on kernel package version alone is paper compliance. The operational test: does the scan account for the module-unload mitigation surface, AND does it verify the kernel is on a build that includes the specific Fragnesia patch (not just any version newer than the Dirty Frag patch that introduced Fragnesia)?
235
235
 
236
236
  **Exposure scoring:**
237
- - RWEP: 20 today. Will jump to 55+ on CISA KEV listing (+25) and to 65+ on confirmed active exploitation (+20 more).
237
+ - RWEP: 35 today. A CISA KEV listing adds 25 (60), and confirmed active exploitation adds 20 more (80).
238
238
  - Audit-passing orgs still exposed: ~75%. Operators who retained the Dirty Frag module blacklist are already mitigated. Operators who relied on kernel-package-version alone with vanilla SI-2 / A.8.8 SLAs are exposed during the patch window.
239
239
  - Coverage failure: on-disk file-integrity tools (AIDE, Tripwire) report clean while the page-cache copy of /usr/bin/su is corrupted.
240
240
 
@@ -296,7 +296,7 @@ Output: Lesson entry for data/zeroday-lessons.json
296
296
 
297
297
  ### Lesson: CVE-2026-45321 (Mini Shai-Hulud TanStack npm worm)
298
298
 
299
- **Attack vector:** Engineering-grade three-primitive chain against the TanStack monorepo, disclosed 2026-05-11. (1) `pull_request_target` on `bundle-size.yml` runs fork-PR code with base-repo permissions (classic Pwn Request). (2) That run poisons the `actions/cache` pnpm-store under the key `Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')}` that `release.yml` later restores. (3) On the next main push, `release.yml` (which has `id-token: write` for npm publish) restores the poisoned cache and the worm captures the OIDC token. 84 malicious versions published across 42 @tanstack/* packages between 2026-05-11 19:20-19:26 UTC. ~150M weekly downloads in scope. CVSS 9.6; CISA KEV pending. Attribution: TeamPCP. No AI-assisted exploit-development attribution for this specific instance, but the chain shape is exactly what AML.T0017-class capability development produces at AI cadence — chained CI/CD primitives that no individual component owner recognises as exploitable.
299
+ **Attack vector:** Engineering-grade three-primitive chain against the TanStack monorepo, disclosed 2026-05-11. (1) `pull_request_target` on `bundle-size.yml` runs fork-PR code with base-repo permissions (classic Pwn Request). (2) That run poisons the `actions/cache` pnpm-store under the key `Linux-pnpm-store-${hashFiles('**/pnpm-lock.yaml')}` that `release.yml` later restores. (3) On the next main push, `release.yml` (which has `id-token: write` for npm publish) restores the poisoned cache and the worm captures the OIDC token. 84 malicious versions published across 42 @tanstack/* packages between 2026-05-11 19:20-19:26 UTC. ~150M weekly downloads in scope. CVSS 9.6; CISA added it to KEV on 2026-05-27. Attribution: TeamPCP. No AI-assisted exploit-development attribution for this specific instance, but the chain shape is exactly what AML.T0017-class capability development produces at AI cadence — chained CI/CD primitives that no individual component owner recognises as exploitable.
300
300
 
301
301
  **What control should have prevented this:**
302
302
  - Workflow-privilege isolation: `pull_request_target` should never run fork-PR code with base-repo permissions in the same job as cache writes. The chain is broken if the bundle-size workflow runs with `permissions: contents: read` and writes to a separate cache key.