NexusRiver · Issue 29 · May 21, 2026

TLP:AMBER  ·  Limited Distribution  ·  Do Not Post Publicly

Issue 29 · Vol. II · Wednesday, May 21, 2026Threat Tempo: Elevated  ·  4 Active Exploit Chains  ·  KEV +2

NexusRiver

AI Agent Governance & Threat Intelligence for Enterprise Security Leaders

Eric Yehle  ·  Founder, Software Armor LLC  ·  O’Fallon, MO

01 Executive Brief

The Trusted Surface Is the Attack Surface

Four simultaneous exploit chains — email, developer tooling, web infrastructure, and CMS — share a single root cause: attackers aren’t breaking past authentication. They’re weaponizing what’s already trusted.

This week, defenders watched four independent attack vectors fire at once. A crafted email triggers JavaScript execution inside an authenticated Exchange OWA session. A malicious npm package rides developer trust to hit OpenAI, Grafana, and Mistral AI in a single campaign — and GitHub’s own internal repositories are now compromised. A 9.2-severity heap overflow turns NGINX — the world’s most deployed web server — against its operators. And Drupal’s security team issues an emergency advisory for a highly critical SQL injection in its core database layer, severity 20/25, zero authentication required.

These aren’t four separate stories. They’re four readings of the same instrument. In each case, the attack surface is the trusted surface — the email client, the package registry, the web server, the CMS. Authentication was already present. What was absent was continuous authority validation at execution time.

This is the authority gap in live operation. Not a theoretical framework. Four simultaneous case studies, running right now, against enterprise infrastructure you are almost certainly running.

Signal

“Authenticated once” is not a security posture. It is an assumption — and this week, attackers are cashing it in across four vectors simultaneously.

02 Active Threat Intelligence

Mini Shai-Hulud / TeamPCP Supply Chain Campaign

OpenAI  ·  Grafana Labs  ·  Mistral AI  ·  UiPath  ·  GitHub

Supply ChainActive

CAMPAIGN  ·  TanStack npm / PyPI  ·  Threat Actor: TeamPCP (aka UNC6780)  ·  Initial Detection: May 11, 2026

The week’s most consequential campaign — and it is still expanding. TeamPCP (tracked by Google Threat Intelligence as UNC6780) poisoned 169 npm package names and 2 PyPI packages across the TanStack, Mistral AI, UiPath, OpenSearch, and Guardrails AI namespaces, using supply chain trust to move laterally into developer environments with no perimeter signal. The attack leveraged hijacked GitHub Actions OIDC tokens, allowing malicious code to be published through the legitimate release pipelines of trusted maintainers. The campaign produced 373 malicious package-version entries in a six-minute window between 19:20 and 19:26 UTC on May 11. Notably, the malicious packages generated valid SLSA Level 3 attestations — they appeared legitimate to standard provenance checks.

OpenAI confirmed two employee devices were compromised. Credential material stored in internal source code was exfiltrated, including macOS application signing certificates — forcing a full certificate rotation. macOS users must update OpenAI applications (ChatGPT, Codex, Atlas) before June 12 or face loss of functionality. Grafana Labs confirmed a missed GitHub workflow token allowed attackers to download the company’s full codebase and internal operational repositories. Grafana received an extortion demand May 16 and declined to pay. Mistral AI confirmed temporary compromise of a codebase management system; packages were contaminated before the attack was neutralized. GitHub is now investigating a separate breach in which TeamPCP exfiltrated approximately 3,800 internal repositories via a compromised VS Code extension and listed the data for sale on a cybercrime forum at $50,000.

Defenders should check lockfiles and CI logs for any @tanstack package versions installed on May 11, 2026. Payload files (router_runtime.js, setup.mjs) survive npm uninstall and persist in .claude/ and .vscode/ directories.

Trust in a package is not continuous authority validation. Developer credentials are not runtime governance. The session running your CI/CD pipeline needs the same scrutiny as the session that touches production. This campaign made that theoretical point into a $50,000 sales listing.

CVE-2026-42897 — Microsoft Exchange Server XSS Zero-Day

Exchange Server SE / 2019 / 2016  ·  OWA Component

CVSS 8.1KEV · Due May 29

CVE-2026-42897  ·  Disclosed: May 14, 2026  ·  No Permanent Patch  ·  Active Exploitation Confirmed

Emerged 48 hours after May Patch Tuesday — which patched 138 vulnerabilities and disclosed zero zero-days. An attacker sends a crafted email. The target opens it in Outlook Web Access. Under specific interaction conditions, arbitrary JavaScript executes inside the authenticated browser session. No authentication required on the attacker’s side. The attack path starts with an inbox.

Microsoft confirmed active exploitation in the wild and deployed emergency Exchange Emergency Mitigation Service (EEMS) mitigations (M2.1.x) automatically where the service is enabled. On-premises Exchange Server 2016, 2019, and SE are affected. Exchange Online is not. CISA added CVE-2026-42897 to the KEV catalog May 15; Federal Civilian Executive Branch agencies must remediate by May 29. No permanent patch timeline has been disclosed. Attribution for exploitation remains unconfirmed — TTPs are consistent with both targeted espionage and opportunistic cybercrime.

Mitigations: Verify EEMS is enabled and that mitigation M2.1.x has been applied. On-premises Exchange administrators without EEMS should apply Microsoft’s manual mitigation guidance published May 14. The EEMS service was released September 2021 and is enabled by default; confirm this is active in your environment.

The email session is the trusted surface. OWA inherits that trust. JavaScript runs in context. Authority was granted at authentication — never validated at execution. This is authority drift in a 25-year-old architecture, firing in 2026. “XSS still owns enterprise mail,” as one researcher noted this week — because the boring vulnerabilities are the ones that keep working.

CVE-2026-42945 — NGINX Rift · Critical RCE / Worker Crash

NGINX Plus + Open Source · Versions 0.6.27 – 1.30.0

CVSS 9.2Active Exploit

CVE-2026-42945  ·  ngx_http_rewrite_module heap buffer overflow  ·  Advisory: May 13, 2026  ·  18-year-old codebase flaw

A heap buffer overflow in NGINX’s rewrite module covering 18 years of releases — actively exploited within days of public disclosure. CVSS 9.2. Dubbed “NGINX Rift,” the vulnerability was introduced in 2008, responsibly disclosed April 21, confirmed by F5 on April 24, and publicly disclosed in a coordinated advisory May 13. NGINX powers approximately one-third of all websites globally; this is not a niche exposure.

The flaw is triggered when a rewrite directive uses unnamed PCRE captures (such as $1 or $2) combined with a replacement string containing a question mark, followed by another rewrite, if, or set directive in the same scope. An unauthenticated attacker can cause worker process crashes and denial of service via crafted HTTP requests over the public internet. Remote code execution has been demonstrated in lab conditions but requires ASLR to be disabled — organizations should assess their configurations accordingly. Researchers demonstrated a sustained DoS in which three exploit requests killed multiple NGINX workers simultaneously. The Kubernetes project retired Ingress NGINX in March 2026; the final version (v1.15.1) ships the same vulnerable code with no upstream patch path.

Immediate action: Patch to NGINX 1.30.1 or later. If NGINX configuration uses rewrite rules with unnamed captures and question marks in replacement strings, treat exploitation as a near-term certainty for internet-facing deployments.

Infrastructure that serves trust to everything else doesn’t get treated as a trust boundary itself. Every session routed through an unpatched NGINX instance is a potential authority gap — one that attackers are already measuring.

CVE-2026-9082 — Drupal Core SQL Injection · Emergency Release

SA-CORE-2026-004  ·  All Supported Branches  ·  PostgreSQL Environments

Highly CriticalPatch Now

CVE-2026-9082  ·  SA-CORE-2026-004  ·  Severity 20/25  ·  Patched May 20, 2026  ·  No Auth Required

Drupal’s security team issued an extraordinary advance warning for what is now confirmed as CVE-2026-9082: a SQL injection vulnerability in Drupal core’s database abstraction API affecting sites running PostgreSQL. The flaw allows an unauthenticated attacker to send specially crafted requests that bypass the API’s query sanitization, resulting in arbitrary SQL injection. Successful exploitation can lead to information disclosure and, in some configurations, privilege escalation or remote code execution. The advisory carries a severity score of 20/25 on Drupal’s model — Access Complexity: None, Authentication: None.

Patches were released May 20 for all supported branches (11.3.x, 11.2.x, 10.6.x, 10.5.x, 10.4.x). For organizations still running Drupal 8.9 or 9.5 — both end-of-life — the security team made an unusual exception and provided manual patch files, explicitly noting they may introduce regressions but are preferable to remaining exposed. The advisory noted that working exploits could be developed within hours of patch release, collapsing the defender response window. This advisory is separate from SA-CORE-2026-003, a moderately critical XSS released the same day.

Immediate action: Assess Drupal environment now. If running PostgreSQL, treat this as urgent. Organizations still on Drupal 8 or 9 should apply manual patches immediately and accelerate migration planning to supported branches.

CMS platforms are trusted content delivery infrastructure, and database layer vulnerabilities at this severity level expose everything above them. Zero authentication. Zero access complexity. The emergency window for unpatched environments is already closing.

03 Secondary Intelligence

Nation-State

Turla / Kazuar → Modular P2P Botnet

Microsoft published analysis this week on Turla (Secret Blizzard / FSB Center 16) evolving the Kazuar backdoor into a three-module P2P botnet: Kernel (coordinator), Bridge (communications), and Worker (execution). The decentralized architecture eliminates centralized C2, dramatically complicating detection and takedown. Kazuar has been active since 2017 and supports AMSI bypass, ETW bypass, and multiple comm protocols including Exchange Web Services to blend with legitimate traffic. Historical targets: government, diplomatic, and defense sectors across Europe, Central Asia, and Ukraine.

Healthcare

Multi-Breach HHS Tracker Update

Several healthcare data breaches affecting hundreds of thousands to millions of individuals were added to the HHS breach portal this week. Healthcare remains the highest-value target sector for ransomware and data extortion. HIPAA breach notification timelines are a lagging indicator — organizations should assume active compromise periods of weeks to months before formal disclosure. The HHS portal reflects confirmed, disclosed breaches; the operational picture is larger.

Infrastructure

Cisco SD-WAN CVE-2026-20182 — 6th Zero-Day of 2026

Cisco Catalyst SD-WAN Controller authentication bypass (CVE-2026-20182, CVSS 10.0) is under active exploitation by threat actor UAT-8616. Disclosed May 15, CISA added to KEV with a two-day remediation deadline. The flaw targets the vdaemon DTLS peering mechanism, allowing unauthenticated attackers to obtain admin-level access. This is the sixth exploited SD-WAN zero-day in 2026 — a pattern requiring structural review of network edge trust models, not sequential patching. CISA has issued Emergency Directive 26-03 mandating federal agency SD-WAN inventory and remediation.

Windows

YellowKey + GreenPlasma Zero-Days

Researcher Chaotic Eclipse (Nightmare-Eclipse) released two new Windows zero-days on May 13, one day after Patch Tuesday, with working PoCs and no CVEs. YellowKey enables BitLocker bypass via the Windows Recovery Environment (WinRE) using specially crafted USB-delivered FsTx files — requires physical access, defeats TPM-only configurations without a pre-boot PIN. GreenPlasma targets CTFMON for privilege escalation from unprivileged user to SYSTEM; the released PoC is intentionally incomplete. Microsoft has not issued patches. The same researcher has announced “a big surprise” timed to June Patch Tuesday.

04 Week in Numbers

Metric	This Week	Context
KEV Additions	2 Confirmed	Exchange CVE-2026-42897 (due May 29) · Cisco SD-WAN CVE-2026-20182 (due May 17)
Active Zero-Days	4 Unpatched	Exchange · NGINX · YellowKey · GreenPlasma (Drupal patched May 20)
Supply Chain Targets	6+ Organizations	OpenAI · Grafana · Mistral · UiPath · GitHub (3,800 repos) · Checkmarx / SailPoint
Malicious npm Entries	373 Package Versions	169 package names · 2 PyPI packages · 6-minute deployment window · SLSA L3 bypass
Cisco SD-WAN 0-Days (2026 YTD)	6	Pattern, not incidents — CISA Emergency Directive 26-03 now active
May Patch Tuesday CVEs	138	Plus 1 post-Tuesday zero-day (Exchange) disclosed 48 hours later
NGINX Affected Versions	18 Years	NGINX 0.6.27 – 1.30.0 · ~⅓ of all websites globally · Active exploitation confirmed
OpenAI macOS Deadline	June 12, 2026	ChatGPT, Codex, Atlas apps require update; prior certificates being revoked

05 Analyst Note

Authority Drift · What This Week Is Actually Telling You

CISOs running post-incident reviews this week will find a consistent root cause across four unrelated threat actors and four unrelated attack surfaces: execution was trusted because authentication had already occurred. The OWA JavaScript ran in an authenticated session. The malicious npm package executed with authenticated CI/CD credentials. The NGINX worker process inherited trusted infrastructure status. The Drupal CMS served content from a trusted system connected to a database whose abstraction layer assumed sanitized inputs.

The TeamPCP campaign adds a detail that deserves specific attention: the malicious packages generated valid SLSA Level 3 attestations. This means provenance checks passed. The package appeared to come from the legitimate TanStack release pipeline — because it did. The attacker hijacked the pipeline mid-workflow. This is not a failure of identity verification. It is a failure of authority validation at execution time. The pipeline was authenticated. Its authority to deploy to downstream environments was never re-evaluated in context.

This is the authority gap at enterprise scale. Your agentic stacks — the AI agents now running in your pipelines, customer-facing systems, and security tooling — inherit the same architectural assumption. They are authenticated at deployment. Their authority is rarely validated at execution. Every action they take operates inside a session that was trusted once and is assumed continuously. The TeamPCP campaign ran inside legitimate, attested, OIDC-verified pipelines. Your agentic workflows run inside similarly trusted sessions.

The question your board will ask after the next breach isn’t “were we authenticated?” It’s “why did we allow that action in that context at that moment?” Right now, most enterprise environments — and virtually all agentic deployments — have no answer to that question.

Assessment Tool · Software Armor LLC

What Is Your Authority Gap Score?

The AGS Score assessment maps the distance between your AI agents’ granted authority and their validated authority at runtime — the gap attackers are already exploiting in human-operated systems, and will exploit in agentic systems next.Take the AGS Assessment → authoritygap.ai

5-minute assessment · No account required · Discovery Engagements available for Tier 1 enterprises

NexusRiver Intelligence Brief
Published by Software Armor LLC · O’Fallon, Missouri
Issues: Tuesday & Thursday · Subscriber distribution only
© 2026 Software Armor LLC. All rights reserved.

TLP:AMBER Limited distribution
Do not post publicly

Issue 29 · Vol. II · May 21, 2026  ·  Sentinel Shield governance platform · authoritygap.ai