Public PoC Drops for Critical libssh2 Flaw Hiding Inside Curl, Git, and PHP

Public PoC released for critical libssh2 client-side flaw (CVE-2026-55200). A proof-of-concept is now public for a memory-corruption bug in libssh2’s ssh2_transport_read() function: a malicious or compromised SSH server sends a crafted packet, an unvalidated packet_length triggers a 32-bit integer wrap and an undersized heap allocation, and subsequent writes overflow it, creating an out-of-bounds write with possible remote code execution on the connecting client — no credentials or user interaction required. It affects every release up to and including version 1.11.1, with a CVSS score of 9.2. The published PoC is a local trigger/RCE harness, not a turnkey remote exploit.

So what: Three of the four items in this space share the same shape: the trusted thing turned against you — the SSH library you didn’t know you shipped, the dev tool that auto-runs on folder-open, the sanctioned cloud app used as a covert channel. The constant is inventory and trust-boundary discipline: a software bill of materials that can actually locate a dependency, dev environments treated as production, and known-good SaaS monitored as a potential exfiltration path rather than waved through.

New ‘DirtyClone’ Linux kernel local-root variant (CVE-2026-43503). JFrog detailed a new variant of the Dirty Frag kernel flaw that lets a local user gain root access via cloned packets, working on Debian, Ubuntu, and Fedora with default namespace configurations. The highest risk is to multi-tenant hosts: any local user holding — or able to acquire, often via unprivileged user namespaces — the CAP_NET_ADMIN capability is exploitable.

So what: Three of the four items in this space share the same shape: the trusted thing turned against you — the SSH library you didn’t know you shipped, the dev tool that auto-runs on folder-open, the sanctioned cloud app used as a covert channel. The constant is inventory and trust-boundary discipline: a software bill of materials that can actually locate a dependency, dev environments treated as production, and known-good SaaS monitored as a potential exfiltration path rather than waved through.

Hijacked npm and Go packages deploy a Python infostealer via VS Code tasks. JFrog found two hijacked npm packages (html-to-gutenberg and fetch-page-assets) and a cluster of Go packages that hide execution inside a VS Code task set to run automatically when the project folder opens, sidestepping npm lifecycle scripts. The chain pulls encrypted JavaScript from blockchain transaction data, opens a socket.io backdoor, and drops a cross-platform Python infostealer targeting Windows, Linux, and macOS.

So what: Three of the four items in this space share the same shape: the trusted thing turned against you — the SSH library you didn’t know you shipped, the dev tool that auto-runs on folder-open, the sanctioned cloud app used as a covert channel. The constant is inventory and trust-boundary discipline: a software bill of materials that can actually locate a dependency, dev environments treated as production, and known-good SaaS monitored as a potential exfiltration path rather than waved through.

Mustang Panda turns Zoho WorkDrive into a C2 channel inside Indian government networks. Acronis, working with India’s CERT-In, found active compromises in Indian government networks — including senior administrative staff — with the China-aligned group Mustang Panda abusing Zoho WorkDrive, a platform common in India’s public sector, so the traffic looks like ordinary cloud activity. New tooling includes SHARDLOADER, a DLL sideloaded via a signed binary, delivering the MINIRECON implant plus a second payload.

So what: Three of the four items in this space share the same shape: the trusted thing turned against you — the SSH library you didn’t know you shipped, the dev tool that auto-runs on folder-open, the sanctioned cloud app used as a covert channel. The constant is inventory and trust-boundary discipline: a software bill of materials that can actually locate a dependency, dev environments treated as production, and known-good SaaS monitored as a potential exfiltration path rather than waved through.

Malicious ‘Perplexity’ Chrome extension intercepted searches and address-bar input. Microsoft Defender research found a Chrome extension called ‘Search for perplexity ai’ impersonating the AI search engine via a look-alike domain, perplexity-ai[.]online. It set itself as the default search engine and routed every query and every character typed into the address bar through an attacker server before redirecting to real results. Google removed the extension after disclosure; Microsoft found no evidence of password theft, but noted it had far more access than a search box needs.

So what: Both stories reflect the browser and extension trust surface being weaponized around the AI-search moment — users grant an ‘AI’ helper standing access, and the channel becomes the collection point. The trust extended to AI-adjacent tooling is now the attack surface, and extension or agent permissions need to be governed like the privileged access they are.

Microsoft removes 119 Edge extensions hiding malware in images and fonts (‘StegoAd’). Microsoft tied 119 Edge add-ons — ad blockers, VPNs, translators, and downloaders with up to 2.6 million combined installs — to a single actor active since at least 2021, using steganography to hide payloads inside image and font files that woke days after install to steal credentials and run ad fraud. Multi-day delays and execution gates meant the payload didn’t fire for many installs, so the install count is a ceiling, not a victim count.

So what: Both stories reflect the browser and extension trust surface being weaponized around the AI-search moment — users grant an ‘AI’ helper standing access, and the channel becomes the collection point. The trust extended to AI-adjacent tooling is now the attack surface, and extension or agent permissions need to be governed like the privileged access they are.

CISA’s Cisco Catalyst SD-WAN Manager flaw (CVE-2026-20245) stays a federal must-fix. The actively exploited zero-day enabling root access on Catalyst SD-WAN Manager remains in CISA’s Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04, with federal civilian agency remediation deadlines in force. Additional Cisco items, including a Unified Communications Manager SSRF flaw, have also moved through the KEV catalog in late June.

So what: The takeaway is the BOD 26-04 cadence itself: KEV-driven, deadline-bound remediation is now the federal baseline, and the operational bottleneck is a visibility problem — knowing every place an affected build runs before the clock runs out.