April 2026 Summaries

A recent security breach involved the compromise of the intercom/intercom-php package version 5.0.2 on Packagist, following an earlier attack on the Lightning package on PyPi, with attackers injecting malicious code that converts the package into a Composer plugin. This plugin activates during installation to download the Bun JavaScript runtime and execute an obfuscated payload that steals credentials like GitHub tokens, SSH keys, and cloud provider credentials, subsequently encrypting and exfiltrating the data. This incident is part of the expanding Mini Shai-Hulud campaign, which has shifted from targeting npm to the PHP ecosystem by exploiting Composer's plugin system for executing malicious code at installation. The attack also affected the npm package intercom-client, exposing users to risk even before the package was used. This highlights a significant vulnerability in the PHP package ecosystem, particularly due to the absence of a pre-publish quarantine, allowing malicious updates to be served quickly after a GitHub account compromise. Semgrep, a security tool, provides advisories and scanning capabilities to detect and mitigate such vulnerabilities, although it requires composer.lock for PHP projects to function effectively. The breach underscores the importance of proactive detection and rapid response to protect against such threats in software supply chains.

The PyPI package 'lightning', a popular deep learning framework, was compromised in a sophisticated supply chain attack impacting versions 2.6.2 and 2.6.3, released on April 30, 2026. The attack embedded a hidden directory with obfuscated JavaScript code that activates upon module import to steal credentials, authentication tokens, environment variables, and cloud secrets, while attempting to poison GitHub repositories with Dune-themed commit messages and public repositories. This attack appears to be linked to the same threat actor behind the mini Shai-Hulud campaign, using similar tactics to spread malware across ecosystems from PyPI to npm. The malicious payload is designed to propagate through npm by injecting and executing a setup.mjs dropper and router_runtime.js into packages, stealing credentials, and committing these to public and victim repositories. The malware targets various credential sources, including local files, CI/CD pipelines, and major cloud providers, and plants persistence hooks in developer tools like Claude Code and VS Code. Organizations using the affected package versions are advised to run security scans, audit repositories for injected files, and rotate credentials as a precaution.

A recent coordinated npm supply chain attack has targeted packages within the SAP development ecosystem, notably affecting mbt, @cap-js/sqlite, @cap-js/postgres, and @cap-js/db-service. The attackers employed preinstall hooks to deploy a malicious payload through the Bun JavaScript runtime, leading to credential theft from developer machines, indicated by the creation of GitHub repositories with the description "A Mini Shai-Hulud has Appeared." Semgrep has issued an advisory and rules to help check for these compromised packages, urging users to scan projects for the presence of these dependencies and advising on further remediation steps if detected. The attack primarily focuses on stealing a variety of secrets, including GitHub tokens and cloud service secrets, by exfiltrating data encrypted with AES-256-GCM and stored in specific file paths. Users are advised to rotate secrets widely and review GitHub activity for any signs of unauthorized access or data exfiltration.

On April 15th, NIST announced significant changes to the National Vulnerability Database (NVD) management of software vulnerabilities, citing an inability to keep up with increased CVE submissions. This shift means the NVD will stop enriching most open source vulnerabilities, impacting the Software Composition Analysis (SCA) market and forcing vendors to reconsider their vulnerability management strategies, which have traditionally relied on NVD's CVSS scores. Semgrep has already adapted by using GitHub Security Advisories as a data source, focusing on reachability and detailed metadata for prioritization. Security leaders are advised to update compliance documents referencing NVD CVSS scores, prioritize beyond raw CVSS, and query vendors on their data sources in response to NVD's changes. These adjustments present an opportunity for security teams to adopt reachability-based approaches, reducing noise and enhancing risk management by focusing on impact-based prioritization for a more secure future in application security.

As AI agents increasingly take on coding tasks, the focus for security teams is shifting to ensuring these agents write secure code from the beginning, rather than addressing issues post-development. This is achieved through "skills," structured prompts that guide AI agents in handling specific security challenges, such as user input sanitization and vulnerability avoidance, in a contextual manner. Unlike broad prompts, which often fail to provide the necessary guidance, skills are detailed, include real-world examples, and are tightly scoped to specific frameworks and languages, aiding agents in making informed security decisions. Additionally, skills must be regularly updated and tested to remain effective, complemented by AI detection tools that identify AI-generated code in production, allowing for targeted security reviews. The integration of skills and detection creates a feedback loop that helps security teams manage the unique risks of AI-generated code, ensuring that the code remains secure and compliant with organizational standards.

The TeamPCP campaign highlights the persistent challenge of supply chain security in the software industry, affecting reputable organizations like Trivy, Checkmarx, and Bitwarden despite their strong security measures. Beginning in February, attackers exploited a common CI vulnerability, a misconfiguration in GitHub Actions workflows, to gain unauthorized access and expand their reach by compromising various platforms, including npm packages, Docker Hub, and VS Code extensions. The attackers used stolen credentials to infiltrate CI/CD pipelines, with significant incidents involving malicious code injection that harvested sensitive data. The campaign underscores the importance of structural controls, such as pinning GitHub Actions to immutable SHAs and implementing package cooldowns, to mitigate risks. Security teams are advised to scrutinize their CI environments and credential access points to better prepare against potential breaches, as the campaign continues to evolve with no clear end in sight.

Recent security alerts have highlighted the ongoing threat posed by malicious open-source packages that exploit vulnerabilities in software supply chains. Several packages, including pgserve, fairwords, and openwebconcept from npm, as well as xinference from PyPI, have been identified as threats, engaging in behaviors such as acting as remote access trojans or executing subprocesses upon installation. These incidents underscore the need for robust incident response workflows to address the fundamental causes rather than just the symptoms of such attacks. Effective responses involve verifying exposure, conducting comprehensive dependency searches, and rotating potentially compromised credentials. Security advisories emphasize the importance of pinning dependencies to exact versions to mitigate risks. Tools like Semgrep aid in managing these tasks by facilitating scans, providing advisories, and offering automated fixes for secure dependency management, allowing teams to focus on developing secure code.

Anthropic's Mythos has sparked a debate among security professionals, exploit developers, and AI enthusiasts about its achievements and implications, particularly concerning the advanced capabilities it offers in finding and exploiting software vulnerabilities. While some dismiss its significance, arguing that humans can also locate these vulnerabilities, the ability of AI models to automatically discover and exploit thousands of new bugs represents a notable advancement in the field. The trend towards AI-driven vulnerability detection poses challenges for defenders, who may need to increase their application security expenditure to keep up with the offensive capabilities now potentially available to attackers. Although Anthropic's Mythos has been criticized for its cost and the nature of its findings, the broader trend it represents suggests a shift in the balance of power towards offense, necessitating a reevaluation of security strategies. As AI models become cheaper and more sophisticated, they could significantly lower the cost of exploiting software, highlighting the need for robust defenses. While there is hope that this technology might eventually lead to a decrease in vulnerabilities, it remains unclear whether this will materialize, as attackers only need to find unique vulnerabilities to succeed. As such, the nature of security, open-source contributions, and vulnerability discovery may change, with human vulnerability research becoming more specialized and artisanal.

The study investigates the capability of several flagship and open-source models to identify security vulnerabilities, specifically those described in the Mythos blog post, and finds that none could successfully discover two key vulnerabilities without significant hints. The research highlights that discovery is much more challenging than verification, akin to the difference between undergraduate and PhD-level work. Through experiments evaluating models like Opus 4.6, GPT 5.4, Gemini 3.1-pro, Deepseek R1-0528, and Qwen 3.6-plus, it was observed that model performance varied significantly based on whether they were analyzing entire files or individual functions. No "magic bullet" was found for full-file assessments, but some models demonstrated better results in function-level analyses. The findings emphasize the importance of model diversity and suggest that using LLMs for vulnerability discovery is promising yet still developing, with iterative improvements ongoing. A notable conclusion is that LLMs paired with deterministic pre-filtering to identify key targets outperform naive whole-file prompts, indicating a strategic shift that could enhance vulnerability detection processes.

Semgrep is leveraging advanced AI models like Mythos as a new form of penetration testing to enhance cybersecurity, despite the limitations of traditional Static Application Security Testing (SAST) tools. By collaborating with foundation labs, Semgrep has integrated cutting-edge models into its architecture, notably through its new Multimodal product, which combines multiple models with Semgrep's Pro Engine to improve vulnerability detection. This approach aims to reduce costs, increase accuracy, and enhance runtime efficiency, resulting in up to eight times more true positive detections and fewer false positives compared to using models alone. Semgrep emphasizes the importance of defense-in-depth strategies, which involve layered security measures to prevent critical failures, and highlights the need for AppSec teams to quickly address vulnerabilities exposed by AI-generated code, which often lacks security robustness. The company also offers plugins for tools like Claude, Cursor, and Codex to perform security checks at the code generation stage. Through its Semgrep Workflows, currently in private preview, the platform automates security engineering tasks beyond mere vulnerability identification, aiming to harden systems against supply chain attacks. Semgrep's proactive approach recently helped uncover and address vulnerabilities during a hacking attempt by TeamPCP, emphasizing the importance of solid security fundamentals and architecture in navigating the growing landscape of AI-accelerated cyber threats.

Security backlogs have long been a challenge for AppSec teams, exacerbated by the rapid pace of AI-driven coding tools that outstrip the ability of security measures to keep up. OpenAI has launched Trusted Access for Cyber, a program designed to enhance defensive security by providing vetted organizations access to advanced AI models with superior cyber reasoning. As part of OpenAI's Cybersecurity Grant Program, Semgrep is among the initial beneficiaries, receiving support to improve software supply chain security and vulnerability research. Semgrep Multimodal effectively combines AI reasoning with rule-based analysis, significantly increasing true positive detections while reducing false positives compared to using large language models alone. This capability has already identified critical zero-day vulnerabilities and enhances triage by streamlining the review process, as evidenced by a high user agreement rate. Additionally, Semgrep's Autofix tool offers contextual remediation guidance and upgrade assistance, crucial for managing breaking changes in code dependencies. The Trusted Access for Cyber initiative is backed by major security enterprises like Bank of America and Cisco, aiming to ensure that defenders have access to frontier AI capabilities to match those of potential attackers.

Security measures in software development often face resistance due to the friction they introduce, as developers prioritize functionality and speed over security, which is seen as secondary unless mandated. Many developers lack formal training in secure coding practices, leading to a reliance on tools that often overwhelm them with false positives and complex workflows, resulting in neglect or frustration. To encourage secure coding, security tools should be seamlessly integrated into existing workflows, offering immediate, clear, and actionable feedback without excessive alerts or complexity. AI can aid in identifying and prioritizing security issues but should not be solely relied upon, as it may lead to a passive approach to security. Cultivating a cooperative culture between developers and security teams, where security is a shared responsibility from the start, can help mitigate resistance, foster trust, and ensure security is integrated into the development lifecycle effectively.

Reachability analysis has emerged as a crucial tool for Application Security (AppSec) professionals to manage dependency upgrades by filtering out false positives based on the actual usage of vulnerable third-party packages within a codebase. This analysis requires a deep understanding of programming languages and is language-specific, with Semgrep being recognized for its extensive polyglot coverage. Recently, reachability analysis was introduced for Rust, a highly popular language known for its performance and safety features, used by major companies like Microsoft and Amazon. Rust's growing popularity, especially in critical systems, highlights the importance of such analysis to enhance security and reduce false positives. Semgrep's approach extends from package-level to function-level and dataflow reachability analysis, offering a detailed understanding of how data flows within applications to identify vulnerabilities more accurately. By distinguishing between conditional exploitability and outright vulnerabilities, Semgrep significantly reduces false positives, making it a preferred solution in the market. This comprehensive reachability analysis for Rust is part of Semgrep's offerings for 12 languages, aiding organizations in gaining better insights into their security posture.

Scanning code for vulnerabilities is a critical practice for software companies, and the decision to block or simply flag vulnerabilities can significantly impact how effectively they are addressed. Blocking policies, which prevent pull requests from merging until high-risk findings are resolved, tend to lead to higher remediation rates, as observed in Semgrep's Remediation at Scale report. The report highlights that top-performing organizations that implement blocking policies fix 12% more vulnerabilities compared to those that only monitor. The success of such policies depends on the organization's readiness to act on blocking signals, with a structured rollout strategy suggested to maintain developer trust. This strategy involves gradually introducing enforcement after initially monitoring and commenting on findings, focusing first on high-confidence, high-severity issues. It emphasizes the importance of reachability analysis for third-party dependencies to avoid unnecessary noise in the development process. Implementing blocking policies judiciously can prevent vulnerabilities from languishing in backlogs, thereby enhancing overall security posture.