The Lyceum: Cyber Intelligence Daily — Jul 12, 2026

The through-line this week is uncomfortable: your own tools are the attack surface. A JavaScript security product shipped malware through five poisoned npm releases, GitHub's AI coding assistant was tricked into leaking private repositories, and fake 7-Zip installers are quietly conscripting machines into a criminal proxy network. Underneath all of it, a Ryuk operator just pleaded guilty in a U.S. court — proof that the enforcement side moves too, only slower.

• CVE-2026-43867 — Apache Camel PQC component: deserialization of untrusted data, CVSS 9.8, no confirmed exploitation yet. Crafted message could lead to server-side code execution.
• CVE-2026-46454 — Apache Camel Cometd component: improper input validation, CVSS 9.8, no confirmed exploitation. Part of a cluster of new Camel critical flaws published this week.
• CVE-2026-46456 — Apache Camel AWS2-SQS component: improper input validation, CVSS 9.8, no confirmed exploitation.
• CVE-2026-46455 — Apache Camel Keycloak component: insufficient session expiration, CVSS 9.8, no confirmed exploitation.
• CVE-2026-24014 — Apache IoTDB DataNode internal RPC: CVSS 9.8, no confirmed exploitation. Trigger-instance creation flaw.
• jscrambler npm compromise: malicious versions 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0 were published via a stolen credential; actively distributed. Upgrade to 8.22.0.
• Fake 7-Zip installers: threat actor "Lurking Lizard" seeds trojanized utility installers that enroll victim machines into a residential proxy network; live campaign.

The promise of an AI coding agent is that it reads your codebase and helps you move faster. The risk, per new research, is that it can be talked into handing that codebase to someone else.

Noma Security published a technique it calls "GitLost" — a prompt injection attack (hidden instructions buried in content the AI reads) that manipulates GitHub's Copilot Workspace agent into exfiltrating private repository contents. The method is disarmingly simple: plant a malicious instruction in a README, an issue, or a pull request; the agent ingests it as context and follows it instead of the user's actual intent. The research hit #2 on Hacker News with over 500 points, and CrowdStrike separately published new prompt-injection research the same day. (GitLost: GitHub's AI Coding Agent Tricked Into Leaking Private Repository Conten)

If this holds up, it changes the trust calculus for every agentic tool: the attack surface of "things an AI agent can be tricked into doing" is now the same as the attack surface of a compromised senior developer. The winning path is GitHub responding with permission scoping — least-privilege for agents. The failure signal is silence, followed by the first supply-chain incident that weaponizes this against a repo processing external contributions. Watch for GitHub's official mitigation guidance. Until it lands, treat any agent with repo access as a potential exfiltration channel.

Saturday's story about a single poisoned npm package worsened overnight. jscrambler — a tool that obfuscates JavaScript to protect it from reverse engineering — turns out to have five compromised releases, not one.

Socket confirmed that versions 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0 were all published using a stolen maintainer credential, per Socket's analysis reported by The Hacker News. The attacker didn't hit one release and vanish; they kept publishing. Worse, later versions moved the malicious code out of the preinstall script — meaning the standard defensive advice of running npm install --ignore-scripts would not have blocked them. The clean version is 8.22.0.

If your build pipeline touches jscrambler, audit your lockfiles now for any of those five version numbers. If you find one, treat any CI/CD system that ran a build with it as potentially compromised — the code executed at install time, with whatever privileges your pipeline held. The observable next step: whether Socket or jscrambler publishes indicators of compromise, which will tell you whether this was credential theft, a backdoor, or something worse.

If you've ever grabbed 7-Zip from somewhere other than 7-zip.org, read this one carefully.

The Hacker News reported on a newly named actor, Lurking Lizard, running an end-to-end malicious residential proxy business. Fake installers for popular utilities — 7-Zip is the documented example — are seeded across download sites and search results. Run one, and your machine is silently enrolled in a residential proxy network, meaning your connection gets rented out to other criminals who route traffic through it to obscure their origins. Your machine becomes infrastructure for someone else's attacks, and you never know.

Residential proxies are valuable precisely because traffic through them looks like a real home user, not a data center — which defeats most fraud-detection heuristics. If this is a full commercial operation rather than a one-off, expect the infrastructure to keep growing. The action is boring but effective: download only from official vendor sites, and check endpoint proxy logs for persistent low-volume connections to unfamiliar IPs. The signal to watch: whether threat-intel firms map this infrastructure and find overlap with existing proxy networks — which would mean expansion, not a new player.

Ransomware prosecutions move slowly, but they do move. Armenian national Karen Serobovich Vardanyan, 34, pleaded guilty in a U.S. court to charges tied to deploying Ryuk ransomware against American organizations; he faces up to 15 years in prison, according to Security Affairs. (A Ryuk Ransomware Operator Just Pleaded Guilty in the U.S.)

Ryuk was among the most destructive operations of the 2019–2021 era, notorious for hitting hospitals and local governments — targets that couldn't afford downtime — and demanding ransoms in the millions. The plea is a reminder that the legal exposure of ransomware work doesn't expire, even years later. It follows a broader pattern of delayed accountability, as U.S. prosecutors grind through cases built during the peak years. The path to watch: whether Vardanyan's cooperation surfaces new intelligence on Ryuk's infrastructure or its remaining operators — the difference between one conviction and a thread that unravels a network. (A Ryuk Ransomware Operator Just Pleaded Guilty in the U.S.)

A security tool that shipped the malware it was built to prevent, an AI assistant chatting your private repos to a stranger who left a note in a pull request, and a bootleg 7-Zip quietly renting out your internet connection to people you'd cross the street to avoid. The Ryuk guy, meanwhile, waited seven years for the other shoe to drop — a useful reminder that in this business the statute of limitations on being clever runs out eventually, just not on anyone's preferred schedule. (A Ryuk Ransomware Operator Just Pleaded Guilty in the U.S.)

Stay paranoid about your own toolchain.

If you know someone who still downloads utilities off the second Google result, forward this before they install their next "7-Zip." (A Ryuk Ransomware Operator Just Pleaded Guilty in the U.S.)