Welcome back! In this edition, we bring you the latest in cloud security—noteworthy incidents, exclusive data, and crucial vulnerabilities.
The Wiz Research team is currently tracking an escalating threat from TeamPCP, whose supply chain operations target key developer tools like Checkmarx KICS and Bitwarden CLI. By abusing package registries and tag redirection to steal credentials, this group highlights a dangerous shift toward downstream compromise. Don’t miss our latest blog to understand TeamPCP’s operational patterns and how to secure your own supply chain against these sophisticated moves.
✨Highlights
Context.ai OAuth Token Compromise
On April 19, 2026, Vercel disclosed a security incident stemming from a "double supply chain attack" that originated with the compromise of Context.ai’s consumer-focused AI Office Suite. By exploiting a compromised OAuth token from a Vercel employee who had granted broad "Allow All" permissions, the attacker gained unauthorized access to Vercel’s internal Google Workspace, effectively leveraging the third-party tool to reach downstream customers. This incident reflects a growing trend in sophisticated tradecraft—seen in high-profile campaigns like Salesloft Drift and Midnight Blizzard—where attackers bypass primary platform vulnerabilities in favor of abusing trusted OAuth integrations. By utilizing pre-authorized access and delegated permissions, these actors can achieve stealthy lateral movement and significantly expand the blast radius across multiple interconnected organizations.
Read more in our blog https://www.wiz.io/blog/contextai-oauth-token-compromise
🐞 High Profile Vulnerabilities
Critical SQL Injection Vulnerability in LiteLLM Exploited in-the-Wild
A critical pre-authentication SQL injection vulnerability (CVE-2026-42208) in LiteLLM allows unauthenticated attackers to execute arbitrary SQL queries against the backend database. Exploitation has been observed in the wild, with attackers specifically targeting tables containing high-value secrets such as API keys, provider credentials, and environment variables.
According to Wiz data, 21% of cloud environments have resources vulnerable to this vulnerability.
Pre-Auth RCE Vulnerability in Marimo Exploited in-the-Wild
A critical pre-authentication remote code execution (RCE) vulnerability has been identified in Marimo, where improper authentication enforcement in the /terminal/ws WebSocket endpoint allows unauthenticated attackers to obtain a full interactive shell. The issue, tracked as CVE-2026-39987 and added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, enables arbitrary command execution without requiring valid credentials, even when authentication is configured.
According to Wiz data, 5% of cloud environments have resources vulnerable to this vulnerability.
Learn more here https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc
Critical Vulnerability in Nexus Repository 3 Enabled by Hardcoded Credential
A critical vulnerability (CVE-2026-5189) in Sonatype Nexus Repository 3 allows unauthenticated attackers with network access to exploit a hardcoded credential in an internal database component. Successful exploitation can lead to unauthorized database access and potential command execution on the host system. The issue only affects environments where a non-default configuration, the OrientDB binary listener, is explicitly enabled.
According to Wiz data, 1% of cloud environments have resources vulnerable to this vulnerability.
Critical Header Injection Vulnerability in Axios
A critical vulnerability in Axios (CVE-2026-40175) allows prototype pollution in third-party dependencies to be leveraged for request smuggling, potentially enabling cloud metadata exfiltration or remote code execution. However, exploitation is situational, as it requires a prior prototype pollution vulnerability elsewhere in the application stack, and specific conditions for triggering malicious header injection, meaning Axios alone is not directly exploitable in typical deployments.
According to Wiz data, less than 1% of cloud environments have resources vulnerable to this vulnerability.
Learn more here https://www.aikido.dev/blog/axios-cve-2026-40175-a-critical-bug-thats-not-exploitable
🔓Security incidents & campaigns
TeamPCP Activity Expands Across Supply Chain Ecosystem
Recent activity linked to TeamPCP shows continued expansion of their supply chain operations, with multiple confirmed and suspected incidents targeting developer tooling and distribution channels. Most notably, a fresh compromise of Checkmarx KICS artifacts and Bitwarden CLI distributions involved both the publication of new malicious versions and the hijacking of existing tags to point to attacker-controlled images. In parallel, sporadic infections resembling CanisterWorm behavior were observed across npm and PyPI packages, potentially indicating either TeamPCP experimentation or copycat activity leveraging similar techniques. Additional overlap appears in the Xinference compromise, where embedded indicators referenced TeamPCP despite disputed attribution .
While some of these packages remain low-prevalence, the operational pattern is consistent: abuse of package registries, tag redirection, and CI/CD trust boundaries to enable credential theft and downstream compromise. This reinforces TeamPCP’s strategic focus on developer ecosystems, with ongoing attempts to scale impact through automation and supply chain positioning rather than single high-volume infections.
PolinRider Campaign: DPRK-Linked Supply Chain Attack Infects GitHub Repositories
A supply chain campaign attributed to a DPRK-linked threat actor, PolinRider, has resulted in the compromise of over 1,900 GitHub repositories through malicious npm packages, VS Code artifacts, and injected JavaScript payloads. The campaign leverages stealthy code injection and blockchain-based command-and-control (C2) infrastructure to achieve persistent access, remote code execution, and credential theft across developer environments and downstream projects.
Learn more here https://github.com/OpenSourceMalware/PolinRider
Stolen SaaS Integration Tokens Enable Data Theft Across Snowflake Environments
A data theft campaign has impacted multiple organizations following the compromise of a third-party SaaS integration provider, reportedly Anodot. Stolen authentication tokens were leveraged to access customer environments, primarily targeting Snowflake, resulting in unauthorized data access and extortion attempts attributed to ShinyHunters. Snowflake confirmed that the activity did not stem from a vulnerability in its platform but rather from compromised third-party integrations.
Learn more here https://www.bleepingcomputer.com/news/security/snowflake-customers-hit-in-data-theft-attacks-after-saas-integrator-breach/
UAT-10608 Campaign Abuses React2Shell for Cloud Credential Harvesting
An automated campaign attributed to threat cluster UAT-10608 is exploiting vulnerable Next.js applications to achieve pre-authentication remote code execution and deploy a multi-phase credential harvesting framework. The operation has compromised hundreds of hosts across cloud environments, enabling widespread extraction of sensitive credentials, including cloud tokens, SSH keys, and API secrets.
Learn more here https://blog.talosintelligence.com/uat-10608-inside-a-large-scale-automated-credential-harvesting-operation-targeting-web-applications/
Sporadic CanisterWorm Infections on npm and PyPi
Several legitimate packages on npm and PyPi have been compromised with malicious payloads exhibiting similarities to CanisterWorm. These may be related to TeamPCP activity or might be a copycat. None of the packages affected so far have been prevalent, each having at most a few hundred downloads. Wiz Research expects the impact of these particular cases to be minimal, and unlikely to result in a successful worm campaign.
Learn more here https://socket.dev/blog/namastex-npm-packages-compromised-canisterworm
Hold on to your headphones!
Tune in to "Crying Out Cloud", our monthly roundup of cloud security news podcast! Hosted by the talented duo Eden Naftali and Amitai Cohen 👏
Listen on Spotify and Apple Podcasts.