--- title: Zapscape KVM escape lands while skills.sh supply chain... description: A new KVM guest-to-host escape called Zapscape was patched July 21, with a proof-of-concept already public and RHEL systems additionally exposed to... canonical: https://daily.dev/posts/zapscape-kvm-escape-lands-while-skills-sh-supply-chain-attack-details-deepen-04t3qxqnh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Zapscape KVM escape lands while skills.sh supply chain attack details deepen | daily.dev og:description: A new KVM guest-to-host escape called Zapscape was patched July 21, with a proof-of-concept already public and RHEL systems additionally exposed to... og:url: https://daily.dev/posts/zapscape-kvm-escape-lands-while-skills-sh-supply-chain-attack-details-deepen-04t3qxqnh og:image: https://api.daily.dev/og/posts/04t3qxQNH.png og:image:alt: Zapscape KVM escape lands while skills.sh supply chain attack details deepen og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Zapscape KVM escape lands while skills.sh supply chain attack details deepen **[Security Digest](https://daily.dev/sources/security_digest)** · 5 min read · 2 upvotes · 0 comments ## Summary A new KVM guest-to-host escape called Zapscape was patched July 21, with a proof-of-concept already public and RHEL systems additionally exposed to unprivileged local escalation via world-writable /dev/kvm. The skills.sh supply chain attack from yesterday's digest has more detail worth absorbing: progressive discovery hid payloads in secondary setup files, and over 30% of malicious skills abused Claude Code to drop additional malware. CERT Polska's supplementary report on Poland's December 2025 energy sector attack reveals a second CHP plant was hit and a novel OT access vector via misconfigured private APN — details presented at DEF CON. Google's threat intelligence group has retired APT numbering in favor of a named-plus-country-initial scheme, now tracking over 5,000 clusters. ## Content **TLDR:** A new KVM guest-to-host escape called Zapscape was patched July 21, with a proof-of-concept already public and RHEL systems additionally exposed to unprivileged local escalation via world-writable /dev/kvm. The skills.sh supply chain attack from yesterday's digest has more detail worth absorbing: progressive discovery hid payloads in secondary setup files, and over 30% of malicious skills abused Claude Code to drop additional malware. CERT Polska's supplementary report on Poland's December 2025 energy sector attack reveals a second CHP plant was hit and a novel OT access vector via misconfigured private APN — details presented at DEF CON. Google's threat intelligence group has retired APT numbering in favor of a named-plus-country-initial scheme, now tracking over 5,000 clusters. --- ## Zapscape: KVM guest-to-host escape patched July 21, PoC public, RHEL additionally exposed to unprivileged escalation A use-after-free in KVM's shadow MMU emulation code — introduced around mid-2020 — lets an attacker with guest VM access crash the host kernel or execute code as root, potentially compromising every VM on the same physical machine. On RHEL, where /dev/kvm ships world-writable (mode 0666), unprivileged local users can exploit it without any guest access at all. A non-weaponized proof-of-concept is already public. Ubuntu still hasn't shipped a patch for Januscape, the previous KVM breakout, so if you're running KVM infrastructure you now have two unpatched escapes to track — check whether your distro has pushed the July 21 fix. [Read more](https://daily.dev/feed-by-ids?id=4v03DtmLp&id=2ZONr1g5D) ## CERT Polska: second CHP plant hit in Poland's December 2025 energy attack, OT access via misconfigured private APN CERT Polska's supplementary report on the December 2025 attack — previously known to have hit 30 wind and solar farms and one large CHP plant — reveals a second, smaller CHP plant serving 50,000 residents was also targeted. The attack caused a steam turbine and water treatment station to shut down, briefly interrupting cogeneration. The investigation's most significant finding is the attack vector: OT network access via a private APN where a misconfiguration allowed arbitrary device-to-device connections. CERT Polska says this misconfiguration is common in Poland and internationally. Details were presented at DEF CON. [Read more](https://daily.dev/posts/t5kbgB8pF) ## TrueConf servers backdoored by Head Mare, trojanized installers distributed to connecting clients The Head Mare hacktivist group exploited unpatched TrueConf video conferencing servers (pre-5.3.9, 5.4.9, and 5.5.5) to replace legitimate client installers with versions carrying the PhantomCore backdoor. Initial access came via TCP port 4307, which requires no authentication by default. Two vulnerabilities — KLCERT-26-057 (arbitrary code execution in TrueConf's isolated environment) and KLCERT-26-058 (sandbox escape) — chained to NT AUTHORITY\SYSTEM. A second backdoor, PhantomGraph, receives commands via Microsoft OneDrive and was observed dumping LSASS. TrueConf patched both flaws June 18, but organizations whose employees connect to third-party TrueConf servers are also at risk of receiving infected installers. [Read more](https://daily.dev/posts/davye5Ah0) ## skills.sh supply chain attack: progressive discovery hid payloads, 30%+ of skills abused Claude Code to drop malware The skills.sh attack covered in yesterday's digest has additional detail worth noting. Attackers used progressive discovery — an LLM context-management technique — to bury credential-stealing instructions in a secondary setup file loaded only after installation, making static analysis miss the payload entirely. Over 30% of the malicious skills abused Claude Code and OpenClaw to drop additional malware. Some skills rewrote their own system prompts to survive deletion attempts; others silently replaced Claude's built-in skill-creator with a malicious copy. Manually installed copies may still be sitting in agent environments with no automatic rollback available. [Read more](https://daily.dev/posts/KaAmk0EDA) --- ## Also notable - **Google retires APT numbering, now tracks 5,000+ clusters with named-plus-country-initial scheme:** Google Threat Intelligence Group replaced the Mandiant-inherited APT numbering system with a format pairing a memorable first name with a second word whose initial indicates country of origin (Castle for China, Ion for Iran, Neptune for North Korea, Relic for Russia), and now tracks over 5,000 activity clusters globally. - **NuGet.org cutting API key lifetime from 365 to 30 days starting August 17, npm removing 2FA-bypass publish rights in early 2027:** NuGet.org will enforce a 30-day maximum API key lifetime starting August 17; npm is restricting 2FA-bypass tokens now and will fully remove direct publish rights in early 2027, per the package management roundup covering pnpm 12.0.0-rc.1 and uv 0.12.2's new vulnerability audit command. [Read more](https://daily.dev/posts/0MEuY9IfL) - **GitHub npm and Actions supply chain hardening: 72-hour freeze on high-impact accounts, npm v12 disables install scripts by default:** GitHub's March–July 2026 supply chain changes include a 72-hour read-only freeze after email or 2FA recovery changes on high-impact npm accounts, npm v12 disabling install scripts and remote-URL dependencies by default, and actions/checkout blocking untrusted fork code — though staged and trusted publishing remain opt-in and unevenly adopted. [Read more](https://daily.dev/posts/VeLRggPFA) - **AI bot Sashiko found most of the critical/high bugs fixed in Linux 7.2-rc7 HWMON:** The Linux kernel's HWMON subsystem received a batch of fixes for the 7.2-rc7 release, with maintainer Guenter Roeck noting most address critical or high severity bugs — the majority discovered by Sashiko, an AI/LLM-based scanner finding race conditions, out-of-bounds accesses, and integer overflows in C code. [Read more](https://daily.dev/posts/p0m5e4bxD) - **Eufy doorbell: hardcoded AES-128-ECB key exposes hidden OCEAN network credentials, grants full home network access:** Security research on the Eufy Video Doorbell found the hidden OCEAN_XXXXXX management network credentials stored in flash memory encrypted with AES-128-ECB using a hardcoded key derived from a fixed string XORed with a repeating 3-byte pattern and MD5-hashed — connecting to the OCEAN network grants full internet access through the home network and access to the router's admin interface. [Read more](https://daily.dev/posts/XbYPVw6QR) --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#claude-code](https://daily.dev/tags/claude-code) [View this post on daily.dev](https://daily.dev/posts/zapscape-kvm-escape-lands-while-skills-sh-supply-chain-attack-details-deepen-04t3qxqnh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/zapscape-kvm-escape-lands-while-skills-sh-supply-chain-attack-details-deepen-04t3qxqnh","headline":"Zapscape KVM escape lands while skills.sh supply chain attack details deepen","text":"A new KVM guest-to-host escape called Zapscape was patched July 21, with a proof-of-concept already public and RHEL systems additionally exposed to unprivileged local escalation via world-writable /dev/kvm. The skills.sh supply chain attack from yesterday's digest has more detail worth absorbing: progressive discovery hid payloads in secondary setup files, and over 30% of malicious skills abused Claude Code to drop additional malware. CERT Polska's supplementary report on Poland's December 2025 energy sector attack reveals a second CHP plant was hit and a novel OT access vector via misconfigured private APN — details presented at DEF CON. Google's threat intelligence group has retired APT numbering in favor of a named-plus-country-initial scheme, now tracking over 5,000 clusters.","url":"https://daily.dev/posts/zapscape-kvm-escape-lands-while-skills-sh-supply-chain-attack-details-deepen-04t3qxqnh","datePublished":"2026-08-09T04:18:03.605Z","dateModified":"2026-09-13T20:47:17.349Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"Zapscape KVM escape lands while skills.sh supply chain attack details deepen"}]} ```