<p><strong>TLDR:</strong> A new KVM guest-to-host escape called Zapscape was patched July 21, with a proof-of-concept already public and RHEL systems additionally exposed to unprivileged local escalation via world-writable /dev/kvm. The <a href="http://skills.sh" target="_blank" rel="noopener nofollow">skills.sh</a> supply chain attack from yesterday’s digest has more detail worth absorbing: progressive discovery hid payloads in secondary setup files, and over 30% of malicious skills abused Claude Code to drop additional malware. CERT Polska’s supplementary report on Poland’s December 2025 energy sector attack reveals a second CHP plant was hit and a novel OT access vector via misconfigured private APN — details presented at DEF CON. Google’s threat intelligence group has retired APT numbering in favor of a named-plus-country-initial scheme, now tracking over 5,000 clusters.</p>
<hr>
<h2>Zapscape: KVM guest-to-host escape patched July 21, PoC public, RHEL additionally exposed to unprivileged escalation</h2>
<p>A use-after-free in KVM’s shadow MMU emulation code — introduced around mid-2020 — lets an attacker with guest VM access crash the host kernel or execute code as root, potentially compromising every VM on the same physical machine. On RHEL, where /dev/kvm ships world-writable (mode 0666), unprivileged local users can exploit it without any guest access at all. A non-weaponized proof-of-concept is already public. Ubuntu still hasn’t shipped a patch for Januscape, the previous KVM breakout, so if you’re running KVM infrastructure you now have two unpatched escapes to track — check whether your distro has pushed the July 21 fix. <a href="https://daily.dev/feed-by-ids?id=4v03DtmLp&amp;id=2ZONr1g5D" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>CERT Polska: second CHP plant hit in Poland’s December 2025 energy attack, OT access via misconfigured private APN</h2>
<p>CERT Polska’s supplementary report on the December 2025 attack — previously known to have hit 30 wind and solar farms and one large CHP plant — reveals a second, smaller CHP plant serving 50,000 residents was also targeted. The attack caused a steam turbine and water treatment station to shut down, briefly interrupting cogeneration. The investigation’s most significant finding is the attack vector: OT network access via a private APN where a misconfiguration allowed arbitrary device-to-device connections. CERT Polska says this misconfiguration is common in Poland and internationally. Details were presented at DEF CON. <a href="https://daily.dev/posts/t5kbgB8pF" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>TrueConf servers backdoored by Head Mare, trojanized installers distributed to connecting clients</h2>
<p>The Head Mare hacktivist group exploited unpatched TrueConf video conferencing servers (pre-5.3.9, 5.4.9, and 5.5.5) to replace legitimate client installers with versions carrying the PhantomCore backdoor. Initial access came via TCP port 4307, which requires no authentication by default. Two vulnerabilities — KLCERT-26-057 (arbitrary code execution in TrueConf’s isolated environment) and KLCERT-26-058 (sandbox escape) — chained to NT AUTHORITY\SYSTEM. A second backdoor, PhantomGraph, receives commands via Microsoft OneDrive and was observed dumping LSASS. TrueConf patched both flaws June 18, but organizations whose employees connect to third-party TrueConf servers are also at risk of receiving infected installers. <a href="https://daily.dev/posts/davye5Ah0" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2><a href="http://skills.sh" target="_blank" rel="noopener nofollow">skills.sh</a> supply chain attack: progressive discovery hid payloads, 30%+ of skills abused Claude Code to drop malware</h2>
<p>The <a href="http://skills.sh" target="_blank" rel="noopener nofollow">skills.sh</a> attack covered in yesterday’s digest has additional detail worth noting. Attackers used progressive discovery — an LLM context-management technique — to bury credential-stealing instructions in a secondary setup file loaded only after installation, making static analysis miss the payload entirely. Over 30% of the malicious skills abused Claude Code and OpenClaw to drop additional malware. Some skills rewrote their own system prompts to survive deletion attempts; others silently replaced Claude’s built-in skill-creator with a malicious copy. Manually installed copies may still be sitting in agent environments with no automatic rollback available. <a href="https://daily.dev/posts/KaAmk0EDA" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Google retires APT numbering, now tracks 5,000+ clusters with named-plus-country-initial scheme:</strong> Google Threat Intelligence Group replaced the Mandiant-inherited APT numbering system with a format pairing a memorable first name with a second word whose initial indicates country of origin (Castle for China, Ion for Iran, Neptune for North Korea, Relic for Russia), and now tracks over 5,000 activity clusters globally.</li>
<li><strong><a href="http://NuGet.org" target="_blank" rel="noopener nofollow">NuGet.org</a> cutting API key lifetime from 365 to 30 days starting August 17, npm removing 2FA-bypass publish rights in early 2027:</strong> <a href="http://NuGet.org" target="_blank" rel="noopener nofollow">NuGet.org</a> will enforce a 30-day maximum API key lifetime starting August 17; npm is restricting 2FA-bypass tokens now and will fully remove direct publish rights in early 2027, per the package management roundup covering pnpm 12.0.0-rc.1 and uv 0.12.2’s new vulnerability audit command. <a href="https://daily.dev/posts/0MEuY9IfL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub npm and Actions supply chain hardening: 72-hour freeze on high-impact accounts, npm v12 disables install scripts by default:</strong> GitHub’s March–July 2026 supply chain changes include a 72-hour read-only freeze after email or 2FA recovery changes on high-impact npm accounts, npm v12 disabling install scripts and remote-URL dependencies by default, and actions/checkout blocking untrusted fork code — though staged and trusted publishing remain opt-in and unevenly adopted. <a href="https://daily.dev/posts/VeLRggPFA" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI bot Sashiko found most of the critical/high bugs fixed in Linux 7.2-rc7 HWMON:</strong> The Linux kernel’s HWMON subsystem received a batch of fixes for the 7.2-rc7 release, with maintainer Guenter Roeck noting most address critical or high severity bugs — the majority discovered by Sashiko, an AI/LLM-based scanner finding race conditions, out-of-bounds accesses, and integer overflows in C code. <a href="https://daily.dev/posts/p0m5e4bxD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Eufy doorbell: hardcoded AES-128-ECB key exposes hidden OCEAN network credentials, grants full home network access:</strong> Security research on the Eufy Video Doorbell found the hidden OCEAN_XXXXXX management network credentials stored in flash memory encrypted with AES-128-ECB using a hardcoded key derived from a fixed string XORed with a repeating 3-byte pattern and MD5-hashed — connecting to the OCEAN network grants full internet access through the home network and access to the router’s admin interface. <a href="https://daily.dev/posts/XbYPVw6QR" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


CVE disclosures, supply-chain attacks, security incidents, and developer-facing security tooling.

Security Digest

A new KVM guest-to-host escape called Zapscape was patched July 21, with a proof-of-concept already public and RHEL systems additionally exposed to unprivileged local escalation via world-writable /dev/kvm. The skills.sh supply chain attack from yesterday's digest has more detail worth absorbing: progressive discovery hid payloads in secondary setup files, and over 30% of malicious skills abused Claude Code to drop additional malware. CERT Polska's supplementary report on Poland's December 2025 energy sector attack reveals a second CHP plant was hit and a novel OT access vector via misconfigured private APN — details presented at DEF CON. Google's threat intelligence group has retired APT numbering in favor of a named-plus-country-initial scheme, now tracking over 5,000 clusters.

Zapscape KVM escape lands while skills.sh supply chain attack details deepen