critical

CVE

CVE-2026-46242, CVE-2026-12481, CVE-2026-55407, CVE-2026-25707

CWE

CWE-506, CWE-94, CWE-494, CWE-200, CWE-416, CWE-362, CWE-502, CWE-400, CWE-770, CWE-22

Affected Surface

  • Developer workstations, CI runners, and software supply-chain tooling that resolved PolinRider, Rollup polyfill impostors, or TeamPCP-linked artifacts during 1-7 July 2026
  • Linux hosts on vulnerable eventpoll implementations where attackers can first gain local code execution and then escalate through CVE-2026-46242
  • Python and Rust services that deserialize lower-trust Keras Lambda configs or protobuf messages with vulnerable `buffa` or `connectrpc` releases
  • SUSE and openSUSE hosts, mirrors, and image-build pipelines that refreshed less-trusted repositories through vulnerable `libzypp` builds

Welcome to Corgea’s weekly briefing. The briefing covers the most important security findings and research from the week.

This edition covers research published from Wednesday, 1 July through Tuesday, 7 July 2026, excluding items already covered in the 30 June briefing.

Top Article

PolinRider expands from npm into Go, Packagist, and Chrome extension supply-chain poisoning

This week’s most important story is PolinRider’s cross-ecosystem expansion, because it shows how little the attacker now cares about the packaging boundary once maintainer or repository control is available. Socket deserves first public-disclosure credit for the July expansion count and named artifact set, while OpenSourceMalware deserves credit for the deepest public technical dossier on the loader, the VS Code folderOpen task abuse, the blockchain-backed dead-drop staging, and the Git-history rewrite tradecraft. In practical terms, this belongs in the same trust-boundary bucket as the TanStack worm wave, the roberts/leads Packagist compromise, the art-template npm iOS exploit-kit incident, and this week’s Rollup polyfill impostor cluster: the dangerous code runs inside developer tooling and repository workflow paths that teams still instinctively treat as “normal project setup.”

The key thing to remember is not just the 162 malicious artifacts. It is that the same loader and anti-forensics strategy now move fluidly between npm packages, Go modules, Packagist releases, and editor automation. That makes PolinRider a broader lesson than a single npm campaign, and it is why the story reads naturally alongside the week’s FBI TeamPCP alert, the Rollup import-time RAT chain, and even Bad Epoll: once the first foothold lands on a trusted developer or CI host, every adjacent trust boundary gets easier to cross.

More news

Rollup polyfill lookalikes on npm hide an import-time loader, JSONKeeper stage, and 216.126.236.244 RAT

The second story that deserves close attention is the Rollup polyfill cluster, because it bypasses the increasingly common “we already hardened postinstall” mental model. JFrog deserves first public-disclosure and reverse-engineering credit for showing that the real trigger sat in the CommonJS plugin entrypoint, that require() kicked off a silent second-stage npm install, and that the follow-on chain pulled mutable code through JSONKeeper before decrypting a RAT from 216.126.236.244. That makes the incident a close cousin to PolinRider’s off-screen config tails and VS Code task triggers, the earlier GlassWASM Open VSX extension attack, and the GitHub workstation breach via poisoned VS Code extension.

What stands out operationally is that the dangerous moment was ordinary build-tool import, not package-manager lifecycle execution. If your build, local config, or CI job loaded the fake plugin, the attacker landed inside the same host context that already holds browser data, cloud credentials, source history, and AI-assistant state. That is the same developer-trust boundary PolinRider keeps exploiting and the same kind of privileged foothold that later makes host-level bugs like Bad Epoll much more consequential.

CVE-2026-46242: Bad Epoll turns Linux eventpoll cleanup into local root

The most important pure vulnerability disclosure in this window is CVE-2026-46242, because the public exploit materials moved it from “serious kernel bug” into a reliable post-compromise privilege-escalation path on real Linux targets. Jaeyoung Chung deserves public disclosure and exploit-engineering credit for the Bad Epoll write-up and repository, while upstream Linux maintainers deserve credit for landing and backporting the fix set. For AppSec teams, the real lesson is that Bad Epoll pairs too well with the week’s supply-chain stories: a malicious dependency, editor automation trick, or CI foothold from PolinRider, the Rollup polyfill RAT, or the broader TeamPCP playbook may only need unprivileged code execution to start.

That is why local-root research belongs in the same weekly briefing as package and CI compromises. On vulnerable workstations, runners, containers, and multi-tenant Linux hosts, Bad Epoll can turn what looked like “just a user-mode foothold” into root. Defenders should read it as a privilege amplifier for the same developer and build environments already targeted by the other stories in this roundup.

Other news:

From research to remediation

Check whether this pattern exists in your codebase

Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.

Explore dependency scanning Get Demo