Daily Threat Briefing
← All briefings

picklescan · n8n · Unity Parsec for Windows

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-07-05 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

Today’s intelligence volume is low, with no new CISA KEV additions, no new BSI or CERT-EU advisories, and no new threat campaign reports from major vendors. The most notable new items are a cluster of picklescan security scanner bypass vulnerabilities affecting ML/AI pipeline tooling, a data-extortion payment by a U.S. government entity to the Kairos group, a North Korean supply chain campaign (PolinRider) expanding to 108 malicious packages across multiple ecosystems, and the first documented AI-agent-automated ransomware operation (JadePuffer).

CRITICAL VULNERABILITIES

NEW

CVE-2025-71364 (picklescan — asyncio subprocess gadget bypass)

  • Affected products: picklescan before 0.0.30
  • Severity: CVSS 7.6
  • EPSS: 0.56 — moderate-to-high exploitation probability
  • Technical detail: picklescan fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function when used in pickle __reduce__ methods, allowing an attacker to craft a malicious pickle file that executes arbitrary code on load while bypassing the scanner’s safety checks. This is particularly relevant to ML/AI pipelines that rely on picklescan to gate model file ingestion from external or untrusted sources. An attacker who can supply a model file — via a compromised repository, a poisoned dataset, or a social engineering lure — can achieve remote code execution on the system loading the file. This is the highest-EPSS entry in a large batch of picklescan bypass CVEs published simultaneously.
  • Exploitation status: No confirmed in-the-wild exploitation; EPSS 0.56 indicates meaningful predicted exploitation probability.
  • Remediation: Upgrade picklescan to 0.0.34 (the latest release, which addresses the broadest set of bypass CVEs in this batch). Treat all externally sourced pickle files as untrusted regardless of scanner results. Consider supplementing picklescan with sandboxed deserialization environments for high-risk ingestion pipelines.

picklescan — Consolidated Batch of Bypass CVEs (CVE-2025-71373, CVE-2025-71372, CVE-2025-71369, CVE-2025-71367, CVE-2025-71366, CVE-2025-71362, CVE-2025-71360, CVE-2025-71359, CVE-2025-71356, CVE-2025-71353, CVE-2025-71347, CVE-2025-71345, CVE-2025-71343, CVE-2025-71342, CVE-2025-71375)

  • Affected products: picklescan versions ranging from before 0.0.28 through before 0.0.34 depending on CVE
  • Severity: CVSS 7.6 across all entries; EPSS range 0.30 to 0.45
  • Technical detail: Fifteen additional CVEs published simultaneously describe distinct gadget-based bypasses of picklescan’s denylist. Each exploits a different Python standard library, NumPy, PyTorch, or idlelib function that picklescan fails to flag in pickle __reduce__ methods. The practical impact is identical across all entries: a malicious pickle file passes the scanner and executes arbitrary code on deserialization. The breadth of bypasses suggests systematic research into picklescan’s denylist coverage gaps. Organizations using picklescan as a primary or sole control for ML model vetting are exposed across all affected versions.
  • Exploitation status: No confirmed exploitation; moderate EPSS scores across the batch.
  • Remediation: Upgrade picklescan to 0.0.34. Do not rely on picklescan as a sole control; apply defense-in-depth for pickle file ingestion (see CVE-2025-71364 entry above).

CVE-2025-71380 (n8n — Authenticated OS Command Execution)

  • Affected products: n8n versions up to and including 1.114.4
  • Severity: CVSS 8.7
  • EPSS: 0.41
  • Technical detail: The Execute Command node in n8n allows any authenticated user to run arbitrary OS commands on the host system. In environments where n8n is deployed with broad user access or where credentials have been compromised, this provides a direct path to full host compromise. n8n is widely used for workflow automation in SME and enterprise environments, often with access to sensitive API keys, database credentials, and internal services stored as workflow variables. Compromised credentials or a malicious insider can leverage this to pivot from the automation platform to the broader infrastructure.
  • Exploitation status: No confirmed exploitation; EPSS 0.41 and the broad deployment of n8n in European organizations warrant attention.
  • Remediation: Restrict the Execute Command node via n8n’s node access controls or disable it entirely if not required. Enforce strong authentication and MFA on n8n instances. Audit which users have access to workflow editing and review existing workflows for unauthorized Execute Command nodes. Ensure n8n is not exposed directly to the internet.

CVE-2026-54424 (Unity Parsec — Windows Privilege Escalation)

  • Affected products: Unity Parsec for Windows through version 2026-05-04.0
  • Severity: CVSS 8.4
  • EPSS: 0.25
  • Technical detail: An incorrect use of privileged APIs in Unity Parsec on Windows hosts allows a local attacker to escalate privileges. Parsec is a remote desktop and game streaming application used in creative and enterprise environments. The flaw requires local access but no special privileges, making it relevant to shared workstations, VDI environments, and any system where Parsec is installed alongside untrusted user accounts. The patched version is available.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Update Unity Parsec to the version released after 2026-05-04.0. Audit Parsec installations across the estate, particularly on shared or multi-user systems.

ONGOING

  • CVE-2026-20896 / CVE-2026-22874 / CVE-2026-58424 / CVE-2026-58426 (Gitea): critical cluster; upgrade to 1.26.3 if not yet done.
  • CVE-2026-46242 (Linux Kernel “Bad Epoll”): apply distribution vendor patches as available.
  • CVE-2026-58289 et al. (Microsoft Edge): update to 150.0.4078.48 or later.
  • CVE-2026-45659 (Microsoft SharePoint): CISA KEV deadline passed 2026-07-04; verify patch applied.
  • CVE-2026-8037 (Progress Kemp LoadMaster): actively exploited; patch or isolate management interface.
  • CVE-2026-48558 (SimpleHelp): CISA KEV deadline passed; hunt for Djinn Stealer indicators.
  • CVE-2026-46817 (Oracle E-Business Suite): actively exploited; patch immediately.
  • CVE-2026-10109 (IBM Db2): pre-auth RCE; patch and restrict port 50000.
  • Adobe ColdFusion (CVE-2026-48283 et al.): CVSS 10.0 unauthenticated RCE; patch if not yet done.
  • BlueHammer (Windows Defender privilege escalation): actively exploited by ransomware gangs; verify patch applied.

EUROPEAN ADVISORIES

No new BSI WID or CERT-EU advisories were published in the last 24 hours.

Previously reported BSI advisories remain actionable: WatchGuard Firebox (WID-SEC-2026-2193), Microsoft Exchange Online (WID-SEC-2026-2191), Microsoft Azure and Entra (WID-SEC-2026-2184), Microsoft 365 Copilot (WID-SEC-2026-2185), and Dell PowerProtect Data Domain (WID-SEC-2026-2189). Apply vendor patches and follow hardening guidance from yesterday’s report. Updated advisories for Adobe ColdFusion, PHP, dnsmasq, OpenSSL, Splunk, and Linux kernel components remain open — apply current vendor patches.

ACTIVE THREATS AND CAMPAIGNS

NEW — PolinRider: North Korean Supply Chain Campaign Expands to 108 Packages Threat actors linked to the North Korean Contagious Interview campaign have published 108 malicious packages and browser extensions across npm, Packagist, Go, and Google Chrome as part of the PolinRider campaign. Attackers are compromising legitimate maintainer accounts to publish malicious versions, significantly increasing the credibility of the poisoned packages. The campaign is assessed as ongoing with further packages expected. Development and security teams should audit all four affected ecosystems for recently published or updated packages from known maintainers, enforce lockfile integrity, and deploy software composition analysis tooling. This extends the previously reported North Korean npm activity to a substantially broader scope.

NEW — JadePuffer: First Documented AI-Agent-Automated Ransomware Operation Researchers have documented what is assessed to be the first ransomware operation conducted end-to-end by a large language model agent, attributed to the JadePuffer group. The LLM agent autonomously handled reconnaissance, lateral movement, and ransomware deployment without human operator intervention during the attack chain. This represents a qualitative shift in attacker capability and operational tempo. Defenders should not assume that attack timelines will follow historical human-operator patterns; detection and response playbooks should account for accelerated dwell-time compression. This is distinct from the previously reported JADEPUFFER/Langflow RCE campaign — confirm whether these represent the same or related actors.

NEW — Kairos Group: U.S. Government Entity Pays $1 Million in Data-Theft Extortion A U.S. government entity paid approximately $1 million to the Kairos group to prevent publication of stolen files, according to a Ransom-ISAC case study based on leaked negotiation chat and blockchain payment trail. Notably, Kairos shows no evidence of deploying ransomware encryption — it operates as a pure data-theft extortion group. This is operationally relevant to European public sector and government-adjacent organizations: pure extortion groups require a different response posture than ransomware operators, as there is no decryption leverage and payment does not guarantee non-publication.

ONGOING — Avalon/CrownX ransomware framework: update email filtering; isolate backups. ONGOING — ARToken PhaaS targeting Microsoft 365: enforce Conditional Access; audit OAuth grants. ONGOING — Pegasus against MEP/civil society: review mobile device security posture. ONGOING — PamStealer macOS infostealer: enforce Gatekeeper; warn users against unofficial downloads. ONGOING — Armored Likho BusySnake stealer, ToddyCat Umbrij OAuth abuse, Anubis ransomware (CVE-2025-5777), FortiBleed campaign: no new developments.

SECURITY NEWS AND CONTEXT

JadePuffer’s AI-agent ransomware operation (Bleeping Computer) and the Kairos extortion payment (The Hacker News) are covered in Active Threats above. The PolinRider North Korean package campaign is also covered above.

No additional security news items with material new developments were identified in the last 24 hours.

RECOMMENDED ACTIONS

  1. Upgrade picklescan to version 0.0.34 immediately — sixteen CVEs published simultaneously expose ML/AI pipelines to arbitrary code execution via scanner bypass; supplement with sandboxed deserialization.
  2. Restrict or disable the n8n Execute Command node (CVE-2025-71380, CVSS 8.7) — audit existing workflows and enforce MFA on all n8n instances.
  3. Update Unity Parsec on all Windows hosts to the post-2026-05-04.0 release — local privilege escalation, relevant to shared and VDI environments.
  4. Audit npm, Packagist, Go, and Chrome extension dependencies for PolinRider campaign packages — focus on recently updated packages from known maintainers; enforce lockfile integrity.
  5. Review ransomware and extortion response playbooks to account for AI-agent attack tempo (JadePuffer) and pure data-theft extortion without encryption (Kairos).
  6. Verify CVE-2026-45659 (SharePoint) patch is applied — CISA KEV deadline passed 2026-07-04.
  7. Apply Linux kernel patches for CVE-2026-46242 (Bad Epoll) as soon as available from distribution vendors.
  8. Ensure Gitea is upgraded to 1.26.3 if not completed yesterday — CVE-2026-20896 (CVSS 9.8) remains unpatched in many environments.
  9. Apply WatchGuard Firebox, Microsoft Exchange Online, Azure, Entra, and M365 Copilot patches from BSI advisories if not yet actioned.
  10. Continue remediation of previously reported items: Kemp LoadMaster (CVE-2026-8037), SimpleHelp (CVE-2026-48558), Oracle EBS (CVE-2026-46817), Adobe ColdFusion, IBM Db2, BlueHammer, Microsoft Edge.