cyber.hendryadrian.com
YouTube · Hak5

ThreatWire Reports Browser Use-After-Free Zero-Days and Supply-Chain Attacks

· 9:24 · Watch on YouTube ↗

Summary

ThreatWire covers a malicious Axios package release linked to a maintainer-account compromise, Cisco’s TeamPCP-related breach, browser zero-days, and other security developments including a hosting misconfiguration and updated DNS guidance.

Key points

  • Cisco reportedly suffered a breach tied to the TeamPCP Trivy incident; attackers obtained development-environment data and AWS keys used for unauthorized activity in Cisco-based AWS accounts.
  • Axios versions 1.14.1 and 0.30.4 were released with the confirmed-malicious [email protected] package, which could execute commands and exfiltrate data. The attackers compromised the lead maintainer’s account and removed warnings.
  • The Axios attack was attributed to a financially motivated group believed to be based in North Korea; Google researchers warned that stolen secrets could enable further compromises and extortion.
  • The video reports zero-day use-after-free vulnerabilities in Chrome/Chromium (CVE-2026-5281) and Firefox (CVE-2026-4688). The Firefox flaw was described as a sandbox escape and assigned a CVSS score of 10.
  • Railway disclosed a CDN caching misconfiguration that it estimated affected about 0.05% of hosted domains; some cached requests may have exposed authenticated data to unauthenticated users.
  • AWS launched Security Agent and DevOps Agent for autonomous AI penetration testing and incident resolution. Separately, the video says Vim patched an AI-discovered sandbox-escape vulnerability, while the Emacs team attributed another reported issue to Git.
  • NIST updated its DNS security deployment guidance, including recommendations on availability, zero-trust architecture, and hosting DNS information.

Article Details

Topics
  • [00:13] TeamPCP-related Cisco breach and software supply-chain threats
  • [01:00] Malicious package in compromised Axios releases
  • [03:15] Chrome and Firefox use-after-free zero-days
  • [05:19] AWS AI security agents and Railway CDN caching exposure
  • [07:06] Claude Code source exposure and reported vulnerability
  • [07:23] Updated NIST DNS security guidance
  • AI-discovered vulnerabilities in Vim and Emacs
  • LinkedIn browser-plugin data collection allegation

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainAttackers compromised the Axios maintainer’s account and released versions containing a confirmed-malicious package, compromising software dependencies.

Threat Actors

TeamPCPThe video attributes the Cisco breach to the TeamPCP Trivy incident, reporting that attackers obtained development data and AWS keys.

Vendors

Amazon Web ServicesAWS launched Security Agent and DevOps Agent for autonomous AI penetration testing and incident resolution; AWS keys were also reportedly misused in Cisco-based accounts.

Products

Claude CodeIts source code was accidentally included in the npm package, and the exposed code was used to identify a vulnerability in its denied rules for curl and Wget.VimThe video reports an AI-discovered sandbox-escape attack chain involving Vim’s tab panel and says the Vim team patched it.

Countries

North KoreaThe financially motivated group behind the Axios attack was described as believed to be based in North Korea; this attribution is presented as uncertain.

Related Articles