CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
The 48-hour scan reveals a threat landscape dominated by the active weaponization of AI infrastructure tooling and the accelerating erosion of U.S. cybersecurity governance. Threat actors are systematically compromising the security and AI development tools organizations rely on—from the CVSS 10.0 Flowise RCE exploitation across 12,000+ exposed instances to TeamPCP’s four-wave supply chain campaign targeting Trivy, LiteLLM, and KICS. North Korea’s Contagious Interview operation has expanded to five package ecosystems with 1,700+ malicious packages. Compounding these threats, CISA’s operational capacity has contracted to 26% of authorized strength, degrading the federal cybersecurity safety net enterprises depend on.
Overnight Research Output
Flowise CVSS 10.0 RCE: AI Agent Builders Under Attack
CRITICAL
Summary: CVE-2025-59528 is a maximum-severity code injection vulnerability in Flowise, one of the most widely deployed open-source platforms for building LLM agents and agentic pipelines with over 43,000 GitHub stars. The flaw resides in the CustomMCP node, which passed user-supplied JavaScript directly to the Function() constructor without validation, granting unauthenticated attackers full Node.js runtime access—including command execution and filesystem manipulation—via a single POST request. Active exploitation was confirmed by VulnCheck in April 2026, more than six months after the patch was released in version 3.0.6. This is the third Flowise vulnerability exploited in the wild within twelve months, establishing the platform as a sustained target.
Action Required: Upgrade all Flowise instances to version 3.1.1 immediately. Treat any internet-exposed instance running a vulnerable version as potentially compromised. Rotate all credentials held within Flowise configurations—LLM API keys, database credentials, and cloud service tokens. Audit access logs for POST requests to /api/v1/node-load-method/customMCP dating back to September 2025.
BleepingComputer — Max-severity Flowise RCE vulnerability now exploited in attacks
The Hacker News — Flowise AI Agent Builder Under Active Exploitation
TeamPCP: Supply Chain Attacks on AI Development Infrastructure
CRITICAL
Summary: Between March 19 and March 27, 2026, threat actor TeamPCP (tracked by Google as UNC6780) executed a four-wave supply chain campaign compromising Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK. The campaign exploited a structural vulnerability in CI/CD pipelines: security scanners occupy privileged positions with access to cloud credentials and deployment tokens. LiteLLM’s role as a unified gateway to 100+ LLM APIs made it an exceptionally high-value target—a single compromised package could expose credentials for OpenAI, Anthropic, AWS Bedrock, and Google Vertex AI simultaneously. The malware used Python .pth files for persistence that survives package removal and Wiz Research confirmed TeamPCP has pivoted to ransomware monetization via the Vect RaaS operation.
Action Required: Organizations that ran affected Trivy or KICS GitHub Actions between March 19–27, or installed LiteLLM versions 1.82.7 or 1.82.8, should treat all accessible pipeline credentials as compromised and rotate immediately. Reimage any host that had the compromised LiteLLM versions installed—the .pth persistence mechanism may survive package removal. Audit Python site-packages directories for litellm_init.pth.
Wiz Research — Six Accounts, One Actor: The prt-scan Supply Chain
Wiz Research — TeamPCP LiteLLM Supply Chain Compromise
Contagious Interview Expands to Five Package Ecosystems
CRITICAL
Summary: North Korea’s UNC1069 threat cluster has expanded its Contagious Interview campaign to five major open-source package ecosystems: npm, PyPI, Go Modules, crates.io (Rust), and Packagist (PHP), publishing over 1,700 malicious packages. The campaign employs a “factory model” porting the same staged loader pattern across languages, with malicious code embedded inside functions matching each package’s advertised purpose to defeat install-time scanning. Most critically, on March 31, UNC1069 compromised an axios npm maintainer account, injecting the WAVESHAPER.V2 RAT into releases with ~100 million weekly downloads. The Socket Security analysis confirmed 164 fake Teams/Zoom domains blocked by SEAL in the past 60 days, demonstrating a parallel social engineering campaign.
Action Required: Audit dependency trees for confirmed malicious packages across all five ecosystems. Any environment that installed axios 1.14.1 or 0.30.4 between March 31 00:21–03:20 UTC should be treated as compromised. Cross-reference network telemetry against SEAL’s 164 blocked UNC1069 domains. Pin dependencies to verified checksums and enforce lock files across all ecosystems.
The Hacker News — N. Korean Hackers Spread 1,700+ Malicious Packages
Socket Security — Contagious Interview Malicious Packages Across Go, Rust, PHP
CISA Governance Disruption: Enterprise Implications
HIGH
Summary: CISA has lost roughly one-third of its workforce over the past 14 months, falling from approximately 3,400 employees to around 2,341, with a February 2026 DHS funding lapse furloughing an additional 1,453 staff—leaving the agency operating with approximately 888 essential personnel, roughly 26% of original authorized strength. Programs enterprises depend on—including the red team, continuous monitoring, incident response cadre, and pre-ransomware notification initiative—have been significantly curtailed or lost key personnel. The FY2027 budget proposes a further $707 million in cuts. The near-lapse of MITRE’s CVE program contract in April 2025 exposed that what the industry treated as permanent infrastructure is a contract relationship that can lapse without warning.
Action Required: Audit dependencies on CISA-provided services—incident response plans, KEV catalog reliance, NVD enrichment data, and CISA-led training programs. Subscribe to vendor security advisory feeds directly. Join your sector-specific ISAC if not already participating. Begin CIRCIA compliance preparation regardless of rulemaking delays. Evaluate commercial threat intelligence services as supplements for CISA advisories.
The Irremediable Attack Surface: SOHO Device Monoculture
HIGH
Summary: APT28’s FrostArmada campaign compromised over 18,000 SOHO routers to hijack DNS resolution and conduct adversary-in-the-middle attacks against cloud credentials, disrupted by a DOJ-led operation in April 2026. This whitepaper treats the incident as a case study in systemic, irremediable risk: the overwhelming majority of compromised devices were end-of-life MikroTik and TP-Link routers that will never receive patches. The DNS hijacking vector is passive, invisible to endpoint security, and survives full enterprise network remediation. The paper synthesizes a decade of nation-state SOHO exploitation—from VPNFilter through Volt Typhoon to FrostArmada—identifying the structural conditions that make tens of millions of EOL devices a permanent operational asset for state-sponsored actors.
Action Required: Assess remote worker and branch office exposure to compromised SOHO infrastructure. Enforce DNS-over-HTTPS for all remote endpoints. Implement conditional access policies with network posture signaling. Evaluate DNSSEC adoption for domains used in authentication flows. This is a strategic paper—CISOs should use it to re-evaluate zero trust model assumptions about DNS integrity and network path verification.
Krebs on Security — Russia Hacked Routers to Steal Microsoft Office Tokens
The Hacker News — Russian State-Linked APT28 Exploits SOHO Routers
BleepingComputer — Authorities Disrupt Router DNS Hijacks Used to Steal Microsoft 365 Logins
Notable News & Signals
Docker AuthZ Bypass (CVE-2026-34040)
Container authorization plugin bypass allows privilege escalation. General container security is covered in existing CSA corpus; this is an incremental CVE without AI-specific dimensions but worth monitoring.
GPUBreach RowHammer Privilege Escalation
Novel hardware security research demonstrating RowHammer-style attacks against GPU memory. Lacks enterprise immediacy with no active exploitation reported, but represents an emerging research vector for GPU-intensive AI workloads.
Storm-1175 Medusa Ransomware Zero-Day
China-linked ransomware group deploying zero-day exploits. Significant operational threat but within the ransomware landscape already documented in CSA corpus; no AI-specific angle identified.
FBI Reports Record $21B in Cybercrime Losses
Annual IC3 report documents record cybercrime losses at $21 billion. Useful benchmark for board-level risk quantification conversations but does not require dedicated CSA research treatment.
Iran-Linked PLC Targeting of U.S. Infrastructure
Ongoing targeting of programmable logic controllers in U.S. critical infrastructure by Iranian-linked actors. OT/ICS security is covered in prior CSA guidance; this is an ICS-layer incident rather than AI-specific.
Topics Already Covered (No New Action Required)
- Docker CVE-2026-34040 AuthZ Bypass: Container authorization plugin bypass. General container security covered in existing corpus; incremental CVE without AI-specific dimensions.
- GPUBreach RowHammer Escalation: Novel hardware research. No active exploitation reported; lacks enterprise immediacy at this time.
- Storm-1175 Medusa Ransomware: China-linked ransomware with zero-day chaining. Well within documented ransomware threat landscape; no AI-specific angle.
- Iran-Linked PLC Targeting: OT/ICS security incident covered in prior CISA AI guidance notes. ICS-layer technical incident rather than AI security topic.
- ENISA EU Digital Wallet Certification: Digital identity governance consultation. Relevant to cloud security but outside AI Safety Initiative scope.