0 Days Archives - Phoenix Security

Category: 0 Days

The supply chain is under sustained attack. Phoenix Security launches Blue Shield to close the door

Phoenix Security has launched Blue Shield, a behavioural supply chain firewall that blocks malicious packages and AI agent skills at the point of install — across the developer workstation, CI/CD pipeline, and agent session. Built on the Phoenix Blue intelligence backbone, which has tracked 59 campaigns and 657 malicious package versions since June 2024 with zero CVEs assigned during active exploitation, Blue Shield’s free core tier is open today at phxintel.security

Francesco Cipollone

GitHub Internal Repository Breach via Poisoned VS Code Extension (May 2026): TeamPCP Exfiltrates 3,800 Repos Through the Developer Trust Surface

TeamPCP (UNC6780) breached GitHub’s internal infrastructure on May 19–20, 2026 through a poisoned VS Code extension that ran silently on a developer’s endpoint and exfiltrated approximately 3,800 internal repositories. The attack produced no CVE. Standard CVE-feed scanners, SCA tools, and signed-provenance checks all missed it. This is exactly the zero-CVE developer trust surface gap Phoenix Blue Intelligence and Phoenix Blue Shield are built to close.

Claire Harwood

Mini Shai-Hulud: TeamPCP’s Self-Propagating npm Worm Hits TanStack, OpenSearch, and Mistral AI Across 170 Packages

TeamPCP’s Mini Shai-Hulud worm hit 170 npm packages across TanStack, OpenSearch, and Mistral AI via OIDC token theft. Full IOCs, detection, and remediation.

Francesco Cipollone

Mini Shai-Hulud: SAP CAP and mbt npm Packages Backdoored via Bun-Loaded Credential Stealer with Claude Code Persistence

A coordinated npm supply chain attack hit SAP’s Cloud Application Programming Model toolchain on April 29, 2026, branding itself “Mini Shai-Hulud.” Four packages totaling 570,000 weekly downloads were poisoned in a 2-hour window. The payload uses Bun as a runtime to evade Node.js detection, pulls 134 credential paths from infected hosts, dumps GitHub Actions runner memory, and persists through Claude Code SessionStart hooks and VS Code tasks.json folderOpen triggers. Over 1,197 victim repositories were live on GitHub within hours. Zero CVEs assigned.

Francesco Cipollone

Beat Sha1-Hulud 3.0 Before It Ships Your Secrets

Sha1-Hulud V3.0 is not a typical vulnerability — it’s a malicious npm package that executes on install, steals CI and cloud credentials, and weaponizes npm and GitHub tokens to spread further. If it touched your build system, assume compromise.

Francesco Cipollone

MongoBleed: CVE-2025-14847 Memory Corruption in MongoDB. Your Database Talks Back

A compression bug in MongoDB turns a core database feature into a silent data exfiltration channel. CVE-2025-14847, nicknamed MongoBleed, allows remote attackers to extract uninitialized heap memory without credentials. With zlib enabled by default and tens of thousands of instances exposed online, this is a real-world data breach waiting to happen.

Francesco Cipollone

React2Shell CVE-2025-55182 plus CVE-2025-55184 Ddos: Exploitation update, In-the-Wild Abuse, update IOCs, exploited target, threat actors and scanning resources

React2Shell is a pre-auth, single-request RCE in React Server Components that turned Next.js App Router deployments into high-value internet targets overnight. This write-up breaks down the exploit chain, what attackers do after landing, and the fast-moving follow-up CVEs that forced teams to patch again.

Francesco Cipollone

React2Shell / React4Shell Resources: CVE-2025-55182 (React RSC Flight) and CVE-2025-66478 (Next.js App Router) with IOCs, exploitability updates, and scanning links

React4Shell (also tracked as React2Shell and “Freight Night”) turns React Server Components into an unauthenticated remote code execution path via the Flight protocol. Public PoCs are circulating, scanning is spiking, and large-scale exploitation has already been reported. Patch fast, then verify what’s actually running.

Francesco Cipollone

React4Shell (React2Shell) Is being exploited at scale: Critical Unauthenticated RCE in React RSC Flight (CVE-2025-55182) and Next.js (CVE-2025-66478)

Francesco Cipollone

React2Shell Campaign Patch RSC Stack Now: Critical Unauthenticated RCE in the Flight Protocol CVE-2025-55182 (React) and CVE-2025-66478 (Next.js)

Two critical CVEs (React and Next.js now called React2Shell or React4shell recalling log4j and spring4shell vulnerabilities) expose an unauthenticated remote code execution path via the “Flight” protocol. If you are running server-rendered React with RSC enabled, assume exposure until you prove otherwise and patch fast.

Francesco Cipollone

Sha1-Hulud 2.0 A Multi-Stage npm Supply Chain Attack Targeting Code, Cloud, and CI/CD

The Shai Hulud campaign marks a major escalation in npm supply chain attacks. This article examines how the malware executes during preinstall, steals cloud and CI/CD secrets, injects GitHub workflows, attempts container breakout, and propagates across nearly 700 compromised packages. The full timeline tracks the attack from the first September incidents through the November V2 expansion.

Francesco Cipollone

Sha1-Hulud V2 Second Coming NPM’s Latest Supply Chain Strikes Again 26K repo compromised and 425 new libraries, how to scan and recover

Shai Hulud weaponised npm’s trust model with stolen maintainer credentials, poisoned tarballs, and GitHub Actions backdoors that keep exfiltrating from CI. At least 608 packages are in scope, including assets from PostHog, ENS, AsyncAPI, Postman, and Zapier. This article maps the updated blast radius and gives a remediation plan built on ASPM, reachability, and remediation-aware exposure management.

Francesco Cipollone