← Back to Threat Briefs

Cyber Threat Brief — July 19 2026

⚠️ This report is AI-generated. Always validate findings.

1. ViteVenom npm Supply Chain — Blockchain C2 RAT

TL;DR: Seven malicious npm packages impersonating the @vitejs namespace deliver a RAT via four-tier blockchain C2 (Tron/Aptos/BSC). Import-time execution evades install-time scanners. Remove affected packages, rotate all credentials.

What’s New:

  • Checkmarx published ViteVenom analysis July 17; linked to SuccessKey actor and ChainVeil campaign
  • Scoped packages (@vite-tab/tab, @vite-mcp/vite-type, etc.) typosquat the legitimate @vitejs/* namespace — ~2,420 total downloads
  • Malicious code executes at import time not install time, bypassing most endpoint and npm audit detections
  • C2 resolution: query Tron wallet → decode reversed data field → extract BSC tx hash → decrypt payload with hardcoded key; Aptos fallback; HTTP direct fallback
  • RAT capabilities: reverse shell, credential harvesting, file exfiltration, persistent backdoor via .bashrc/.zshrc/.profile injection

Actionable Intel

ArtifactTypeATT&CKLog SourceAction
@uw010010/vite-treeMalicious npm pkgT1195.002npm audit / lockfilesRemove; audit package-lock.json
@vite-tab/tabMalicious npm pkgT1195.002npm audit / lockfilesRemove immediately
@vite-ln/build-tsMalicious npm pkgT1195.002npm audit / lockfilesRemove immediately
@vite-mcp/vite-typeMalicious npm pkgT1195.002npm audit / lockfilesRemove immediately
@vite-pro/vite-uiMalicious npm pkgT1195.002npm audit / lockfilesRemove immediately
@vitets/vite-tsMalicious npm pkgT1195.002npm audit / lockfilesRemove immediately
@vite-ts/vite-uiMalicious npm pkgT1195.002npm audit / lockfilesRemove immediately
Tron/Aptos/BSC blockchain queriesC2 resolutionT1102.002DNS / proxy logsAlert on Tron/Aptos/BSC API calls from dev machines
.bashrc/.zshrc/.profile modificationsPersistenceT1546.004EDR / file integrityAlert on unauthorized shell profile changes

Detection

SourceRuleGap
Splunk ESCUNoneNo rule for blockchain-based C2 resolution or npm supply chain import-time payloads
ElasticNoneNo rule for scoped npm typosquats or import-time execution
SigmaNoneNeed rule for anomalous Tron/Aptos/BSC API calls from developer workstations

Sources: Checkmarx, The Hacker News

2. Januscape — KVM Guest-to-Host VM Escape — CVE-2026-53359

TL;DR: 16-year-old use-after-free in KVM x86 shadow MMU enables guest-to-host escape on both Intel and AMD. PoC panics host; unreleased exploit claims full host code execution. Patch requires two coupled CVEs.

What’s New:

  • Disclosed July 7 by security researcher; first KVM/x86 guest-to-host escape working on both Intel and AMD
  • UAF in kvm_mmu_get_child_sp() — shadow page-table lookup compares only guest frame number (gfn) without checking role struct, causing type confusion
  • Public PoC panics host kernel; researcher claims separate unreleased exploit achieves full host RCE
  • Companion CVE-2026-46113 required — both patches must be applied together
  • Fixed in stable kernels July 4: 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, 5.10.260

Actionable Intel

ArtifactTypeATT&CKLog SourceAction
Commit 81ccda30b4e8 (CVE-2026-53359)PatchT1068Kernel versionVerify applied on all KVM hosts
Commit 0cb2af2ea66a (CVE-2026-46113)Companion patchT1068Kernel versionMust be applied with 53359
kvm_intel.nested=0 / kvm_amd.nested=0Mitigation—KVM configDisable nested virt for untrusted guests if unpatched
KVM host kernel panic / oopsExploitation indicatorT1068/var/log/kern.log, dmesgAlert on unexpected KVM host panics

Detection

SourceRuleGap
Splunk ESCUNoneNo rule for KVM host kernel exploitation indicators
ElasticNoneNo rule for shadow MMU exploitation or guest-to-host escape
SigmaNoneNeed rule for unexpected kernel panics on KVM hosts with nested virt enabled

Sources: The Hacker News, SecurityWeek, TuxCare

3. GhostLock — Linux Kernel Futex LPE — CVE-2026-43499

TL;DR: 15-year-old use-after-free in kernel futex priority-inheritance code gives any unprivileged local user root in ~5 seconds with 97% reliability. Container escape confirmed. Patch and audit multi-tenant environments immediately.

What’s New:

  • Disclosed July 7 by VEGA (Nebula Security) with working PoC (“IonStack part II: GhostLock”)
  • UAF in rtmutex priority-inheritance code — vulnerable range spans kernel 2.6.39 (May 2011) through pre-7.1
  • Exploit requires no special permissions, no unusual settings, no network access — ordinary threading calls suffice
  • Container escape confirmed — exploitable from inside containers to gain host root
  • Fix: upstream commit 3bfdc63936dd; CloudLinux and AlmaLinux test patches available; Red Hat advisory RHSB-2026-010

Actionable Intel

ArtifactTypeATT&CKLog SourceAction
Commit 3bfdc63936dd (CVE-2026-43499)PatchT1068Kernel versionVerify patched on all Linux hosts
Companion CVE-2026-53166Related patchT1068Kernel versionApply both per Red Hat RHSB-2026-010
Unexpected futex syscall patternsExploitation indicatorT1068auditd / seccompAlert on rapid futex PI operations from unprivileged processes
Container escape to host rootPost-exploitationT1611Container runtime logsMonitor for privilege escalation events in container orchestrators

Detection

SourceRuleGap
Splunk ESCUNoneNo rule for futex PI exploitation patterns
ElasticNoneNo rule for GhostLock-specific indicators
SigmaNoneNeed rule for anomalous rtmutex/futex activity indicative of LPE

Sources: The Hacker News, AlmaLinux, Red Hat RHSB-2026-010

Status Updates

  • CVE-2026-58644 (SharePoint pre-auth deser RCE): CISA KEV federal deadline TODAY July 19. Confirmed exploited as zero-day pre-patch. Patch via July 14 Patch Tuesday. Original brief.
  • CVE-2026-39808 / CVE-2026-25089 (FortiSandbox triple-CVE chain): CISA KEV federal deadline TODAY July 19. Active exploitation in triple-CVE chain with CVE-2026-39813. Original brief.
  • CVE-2026-46817 (Oracle EBS): CISA KEV federal deadline passed yesterday July 18. DriveSurge IAB exploitation ongoing with 456+ attacks, 950 exposed instances. Original brief.