Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More

Monday opened with a trust problem. A mail server flaw entered active exploitation. A network control system was targeted by a persistent threat actor. Trusted packages were poisoned across three ecosystems in 48 hours. A fake model repository pushed a Rust-based infostealer to unsuspecting developers. Then came the familiar ransom claim — and the familiar resolution.

The pattern is clear: one weak dependency can compromise an entire organization. Here's the full picture for the week of May 18, 2026.

Critical: Microsoft Exchange Server Zero-Day

CVE-2026-42897 is a critical cross-site scripting vulnerability in on-premises Exchange Server that has entered active exploitation. Rated CVSS 8.1, the spoofing flaw allows attackers to forge requests in a way that could lead to privilege escalation or credential theft within Exchange environments.

Microsoft is providing emergency mitigations while a permanent patch is developed. Organizations running on-premises Exchange should:

• Apply the published mitigation immediately
• Monitor Exchange server logs for unusual authentication patterns
• Prioritize migration to Exchange Online where feasible — cloud-hosted Exchange receives patches automatically

This is the second Exchange zero-day exploited in attacks in 2026, following the Pwn2Own Berlin disclosures. On-premises Exchange continues to be a high-value target for nation-state and ransomware actors.

Cisco SD-WAN: UAT-8616 Continues Persistent Access Campaign

Threat actor UAT-8616 exploited CVE-2026-20182, an authentication bypass in the Cisco Catalyst SD-WAN Controller, to gain unauthorized administrative access. The actor added SSH keys, modified routing configurations, and escalated privileges — establishing persistent access rather than immediately monetizing the foothold.

This follows the same actor's exploitation of CVE-2026-20127 earlier in 2026, establishing a pattern of targeting Cisco network infrastructure for long-term access. The behavior suggests intelligence collection or pre-positioning for future disruption rather than immediate ransomware deployment.

Cisco SD-WAN administrators should:

1. Apply patches for both CVE-2026-20182 and CVE-2026-20127 immediately
2. Audit SSH authorized_keys entries on SD-WAN controllers for unauthorized additions
3. Review routing configuration changes in the past 90 days
4. Enable enhanced logging on SD-WAN management interfaces

Supply Chain: TeamPCP Mini Shai-Hulud Worm Expands

The TeamPCP threat group's Mini Shai-Hulud worm campaign claimed new victims across the software supply chain this week, compromising packages in npm, PyPI, and Docker Hub within a 48-hour window. Affected ecosystems included:

• TanStack packages (JavaScript)
• Mistral AI pip packages
• OpenSearch Python client packages
• Multiple Docker Hub base images

In each case, the malicious packages deployed credential-harvesting code targeting:

• API keys and cloud credentials (AWS, GCP, Azure)
• SSH private keys
• .env file contents
• Git credentials and tokens
• CI/CD pipeline secrets

Stolen credentials were exfiltrated to TeamPCP infrastructure and in several cases used to establish persistent access in cloud environments. The group has been linked to ransomware deployment partnerships where stolen cloud access is handed to ransomware operators.

Fake AI Repository on Hugging Face

A malicious repository on Hugging Face impersonated OpenAI's Privacy Filter model to distribute a Rust-based information stealer. The attack exploited developer trust in public AI model registries — a relatively new but rapidly growing attack surface.

The fake repository mimicked the naming conventions, README format, and model card structure of legitimate OpenAI repositories. Users who downloaded and executed the "model" received a credential-stealing payload instead.

Key takeaway: Public AI model registries are emerging as a new software supply chain vector analogous to typosquatting on npm and PyPI. Verify model publishers before downloading, check commit history, and treat model loading code with the same scrutiny as package installation scripts.

Instructure/Canvas: Ransom Agreement Reached

Instructure (Canvas LMS) reached an agreement with ShinyHunters following the breach that disrupted thousands of schools and universities. The resolution came after ShinyHunters threatened to release 365TB of student, educator, and institutional data.

The agreement highlights ongoing concerns about:

• Verification — Organizations paying ransoms or reaching data-destruction agreements have no reliable way to verify that data has been deleted
• Regulatory exposure — The breach triggered government investigations in multiple jurisdictions; a ransom agreement does not resolve regulatory liability
• Student data — FERPA protections apply to much of the affected data; institutions should be prepared for regulatory scrutiny

AI-Powered Vulnerability Discovery Accelerates

Two significant developments in AI-assisted security research emerged this week:

• OpenAI's Daybreak system has been used to discover vulnerabilities in production software at scale
• Microsoft's MDASH system has already contributed to patching over 500 flaws in 2026, a pace that would set a new annual record

The acceleration is real: AI systems are identifying vulnerabilities that would have taken human researchers months to find. This cuts both ways — defenders can patch faster, but attackers with similar tools can develop exploits faster. The window between disclosure and exploitation continues to narrow.

Critical CVEs Requiring Immediate Attention

The Week's Lesson

"Trust less, check more."

Rotate credentials. Review production dependencies. Treat AI model downloads with the same scrutiny as package installations. The attack surface has expanded to include every tool developers use — not just the software they produce.

References

• The Hacker News — Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More
• CosmicBytez Labs — Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited
• CosmicBytez Labs — Mini Shai-Hulud Worm Compromises Supply Chain Packages
• CosmicBytez Labs — Microsoft Exchange Zero-Day Actively Exploited