CloudSec Archives - Phoenix Security

Category: CloudSec

From 40 to 800 Commits: What Breaks in Security When Build Stops Being the Bottleneck

Phoenix’s engineering output jumped from 40 to 800 commits per developer a month. Code review didn’t survive the jump intact — Faros AI’s telemetry on 22,000 developers shows 31.3% of PRs now merge unreviewed. Here’s what broke, and what we rebuilt around generation instead of inspection.

From SBOM to Declaration: Closing the CRA 24-Hour Clock Across One Platform

From 11 September 2026, EU Cyber Resilience Act Article 14 gives manufacturers 24 hours to report an actively exploited vulnerability. Most AppSec programmes are built around CVE enrichment, which arrives too late and can’t see malicious packages at all. Phoenix’s five-stage pipeline turns SBOM, exploitation intelligence, and risk exceptions into one Article 14-ready evidence chain.

Exploit Hunt: How Threat-Model-Led AI Hunting Finds Real Zero-Days — and Why It Beats Scanning and Pentesting

Exploit Hunt runs an adversarial three-persona pipeline inside Phoenix Purple’s knowledge graph: attacker, skeptic, exploit developer. Every reported finding ships as a runnable proof of concept, not a severity label. In one verified run, 3 target files produced 9 confirmed exploits — and the skeptic gate correctly killed every disputed finding before it reached proof.

Phoenix Security Launches the Exploit Hunt: A Threat-Model-Led AI Red Team That Attacks Your Code and Proves the Exploit

Phoenix Security releases Exploit Hunt at Black Hat USA 2026 — an AI red team that takes targets from a live threat model and reports a finding only after writing and validating a runnable proof-of-concept exploit. Available in Phoenix Purple now.

Mini Shai-Hulud keyv/cacheable npm Compromise (No CVE Assigned): Self-Propagating Worm Steals CI, Cloud, and Developer Credentials

An attacker hijacked the keyv/cacheable npm maintainer account and shipped a self-propagating Mini Shai-Hulud worm across 2 billion+ monthly installs, reaching most teams transitively through ESLint. Valid OIDC provenance masked the compromise. No CVE was assigned.

Give Me the List of Fixes: Phoenix Purple Launches Graph-Native Remediation for SAST and SCA

Phoenix Purple now runs deterministic SAST and SCA on a knowledge graph, adding reachability, a chainability map, and one-click assessment and remediation. Instead of four disconnected scanner reports, engineers get one ranked fix list with a clear breaking-change verdict on every item, ready to review and ship.

The Clearinghouse Problem: Coordination Was Never the Bottleneck. Remediation Is.

Gold Eagle solves a coordination gap that was real, but it was never the actual bottleneck. Finding vulnerabilities was never the hard part. The hard part is fixing them everywhere they run, grouped by owner and bundled for remediation velocity. That’s the constraint no clearinghouse touches.

AsyncAPI Supply Chain Compromise: CI/CD Pwn Request Delivers Miasma RAT Across Four npm Packages

An attacker turned AsyncAPI’s own CI/CD pipeline into a publisher, hiding a PAT theft inside 37 decoy pull requests, then pushing straight to release branches to ship the Miasma RAT to 3M weekly npm downloads under valid SLSA provenance, with zero CVE assigned.

Close the Tap, Burn the Backlog: The Control Framework Behind Agentic SDLC Security

easy-day-js / EASY_DAY_JS_MASTRA_2026: Typosquatted Dependency Delivers Cross-Platform RAT to 144 npm Packages

A typosquatted npm dependency called easy-day-js — an exact metadata clone of the legitimate dayjs library — was injected across 144 @mastra packages in an 88-minute automated publishing window, reaching over 1.1 million weekly downloads. The second-stage payload is a cross-platform RAT that installs OS-level persistence on Windows, macOS, and Linux and targets LLM API keys, cloud credentials, and 166 cryptocurrency wallet extensions. No CVE was assigned; every CVE-based scanner was blind during active exploitation.

The supply chain is under sustained attack. Phoenix Security launches Blue Shield to close the door

Phoenix Security has launched Blue Shield, a behavioural supply chain firewall that blocks malicious packages and AI agent skills at the point of install — across the developer workstation, CI/CD pipeline, and agent session. Built on the Phoenix Blue intelligence backbone, which has tracked 59 campaigns and 657 malicious package versions since June 2024 with zero CVEs assigned during active exploitation, Blue Shield’s free core tier is open today at phxintel.security

Miasma. The Worm That Lives Inside Your AI Tools

TeamPCP (UNC6780) released Miasma in June 2026: a self-spreading worm that injects itself into the SessionStart hooks of 13 AI coding tools including Claude Code, GitHub Copilot, and Gemini CLI. It forges SLSA provenance signatures to pass npm audit checks, uses GitHub itself as a command-and-control channel, and carries a DEADMAN_SWITCH that wipes developer machines if tokens are revoked before network isolation. Zero CVEs assigned. Every standard scanner returns clean.