SECURITY INTEL · MONTHLY

2026-07 CleanSource Community Monthly Security Intelligence Digest

In July 2026 (1–30 July), the Sectrend CleanSource community monitored and published 197 security advisories, spanning AI agents and developer tooling, web and API services, databases and data infrastructure, browsers and endpoint software, IoT, and the open source supply chain.

197 Advisories

27 CSSA exclusive

37 CVE highlights

133 Poisoning alerts

01 Statistics

Statistics

CSSA exclusive · 13.7%

All rated 9.0 or above; 21 scored a perfect 10.0

CVE highlights · 18.8%

35 rated 9.0 or above (94.6%); 7 at 10.0

133

Supply chain poisoning · 67.5%

npm 119 · PyPI 14

The 27 CSSA exclusive advisories (not yet in CVE) concentrate on untrusted deserialization, command and code injection, missing authentication and authorization, path traversal and dangerous file upload — characterized by a low barrier to exploitation, inheritance of host privileges and execution across trust boundaries. Among the 37 selected CVEs, 18 point directly at remote code execution, arbitrary command execution or host control, while another 18 involve authentication, authorization, bypass or privilege risk; the two sets overlap. The 133 poisoning records correspond to 133 unique packages and 133 unique MD5 hashes, indicating these are not repeat reports of the same artifact. Malicious domain communication and malicious command execution appear in 127 and 126 records respectively, the two most prominent behavioral patterns.

02 Trending

Trending

T1 Poisoning shifts from scattered samples to batch exposure

The 133 poisoning records account for more than two thirds of all advisories, with npm making up 89.5% of poisoning samples. Peak single-day disclosure reached 10 records, occurring on 13, 17, 28 and 30 July — indicating that malicious package placement and discovery both follow a batch pattern.

T2 AI agents and developer toolchains become a high-privilege attack surface

The following components appeared repeatedly across this month's advisories, with risk extending from model input through plugins, MCP endpoints, sandboxes, credentials and host command execution paths.

Claude crewAI DeepSeek-Reasonix Camel LocalAI DB-GPT open-swe QwenPaw sglang Kotaemon terraform-mcp-server Ruflo Crawl4AI

T3 Remote execution and authentication defects rise together

Vulnerabilities arise not only from traditional command injection, SQL injection and memory corruption, but also from identity boundary issues: default keys, unauthenticated endpoints, cross-tenant credential reuse, OAuth signature verification and session revocation. Execution risk and identity boundary risk each account for 48.6% of selected CVEs, and the two sets overlap, so they should not be summed.

T4 Remediation priority cannot rest on CVSS alone

Deployment conditions — internet exposure, anonymous mode, CI/CD workflows, plugin auto-loading, shared storage and high-privilege execution — significantly amplify exploitability and business impact. Prioritization should be dynamic, informed by asset exposure and privilege context.

03 Deep Dive

Deep Dive

CSSA exclusive advisories · severity distribution

Perfect 10.0 (21 advisories) 77.8%

9.0 – 9.9 (6 advisories) 22.2%

Affected component types: AI agent orchestration, inference and agent frameworks; plugin and sandbox systems and browser automation; web consoles and APIs; language runtimes, network gateways and security tooling. Attack characteristics: many require no authentication or only low-complexity input; once a component runs with elevated privileges, an attacker inherits access to the host, repositories, cloud credentials or business data. Early warning value: CSSA advisories surface risk without waiting on the standard CVE process, and should feed into internal temporary vulnerability numbering, asset correlation and rapid mitigation workflows.

CVE highlights · risk type distribution

RCE / arbitrary command execution / host control (18) 48.6%

Authentication, authorization, bypass or privilege risk (18) 48.6%

The two sets overlap and should not be summed. Remediation difficulty: fixes in frameworks, MCP, CI/CD and identity systems typically involve configuration, permissions and key rotation — upgrading the version alone does not close the case.

Explicit CWE hotspots

CWE-78 OS command injection 3

CWE-89 SQL injection 3

CWE-306 Missing authentication 3

CWE-502 Untrusted deserialization 2

CWE-862 Missing authorization 2

CWE-94 Code injection 2

CWE-122 Heap buffer overflow 2

Supply chain poisoning · registry distribution

npm 119 · 89.5% PyPI 10.5%

Batch pattern: 10 disclosures each on 13, 17, 28 and 30 July marked single-day peaks; 9 each on 21, 14 and 9 July showed repeated waves of concentrated exposure. Naming characteristics: 8 package names contain CLI, 5 contain SDK and 6 are scoped packages — naming that amplifies the risk of accidental installation and confusion with internal tooling. Response principle: if a malicious package has been installed or executed, treat the host as compromised rather than simply uninstalling; key rotation must be performed from a trusted device.

04 Summary

Summary

R1 Urgent triage and remediation

Development

Within 24 hours, review the 7 CVSS 10.0 vulnerabilities and every internet-exposed 9.8–9.9 vulnerability, building a component–version–deployment–owner inventory. Where immediate upgrade is impossible, first disable anonymous access, MCP endpoints, plugin upload or high-risk interfaces
Conduct a dedicated review of deserialization, shell invocation, dynamic expression, template rendering and file upload paths, prioritizing replacement of pickle, eval and uncontrolled autoType mechanisms
Examine OAuth token revocation, signature verification, default keys, cross-tenant context and role permission checks, rather than patching only the surface interface

Security

Place remote execution, authentication bypass, SQL injection and supply chain poisoning in this month's P0/P1 queue, ordering them by internet exposure, runtime privilege and data sensitivity
Search specifically for anomalous OAuth callbacks, MCP tool invocations, plugin directory changes, CI workflow executions, shell subprocesses, DNS egress and package manager installation logs
For devices where a malicious package executed, apply network isolation, memory and disk forensics, persistence hunting and credential rotation, restoring service only after confirming cleanliness

R2 Strengthen secure development practice

Development

Never pass user input directly into shells, interpreters, deserializers or dynamic templates; use parameterized invocation, structured formats, type allowlists and signature verification
Establish deny-by-default policies for anonymous mode, administrative interfaces, MCP tools and plugin mechanisms, with object-level authorization and server-side role checks

Security

Strengthen detection of CWE-502, 78, 94, 306, 862, 22, 434, 89 and 122 in code audit rules, treating high-privilege runtime context as a risk amplifier
Add prompt injection, tool invocation authorization, credential isolation, sandbox escape and external content integrity testing for AI and agent applications

R3 Supply chain governance

Development

Use lockfiles, exact versions, trusted mirrors and hash verification; every new dependency must pass review of maintenance activity, publisher, publication date, install scripts and name similarity
Use short-lived credentials and least privilege in build environments; prohibit long-lived personal tokens from entering npm/PyPI installation and CI build contexts

Security

Add rules for malicious packages, name impersonation, anomalous versions, install scripts, malicious domains and package hashes to SCA policy, and run a retrospective scan against this month's 133 samples
Establish combined alerting across DNS/HTTP egress, package managers and EDR process chains, focusing on npm/python processes spawning shell, curl or PowerShell

R4 Defense in depth

Development

Run AI agents, plugins and model processing tasks in isolated containers or sandboxes with no access to host files, cloud metadata or production credentials by default
Isolate sessions, tokens, caches and tool context per tenant, requiring explicit confirmation and non-bypassable server-side policy for dangerous actions

Security

Establish coordination across WAF/API gateway, IAM, EDR, DNS security, SCA and CI/CD: block entry, restrict privilege, detect execution, trace egress and revoke credentials quickly
Review vulnerability response time, exposed asset coverage, malicious package hit rate and credential rotation completion monthly, driving governance closure through quantified metrics

Published by CleanSource Community ｜ Date: 2026-08-04
Sources: Sectrend CSSA vulnerability intelligence (270k+ advisories) · open source registry poisoning monitoring ｜ Please credit the source when redistributing