The Lyceum: Cyber Intelligence Daily — Jun 29, 2026

• Patch and hunt for libssh2 everywhere it hides: a public PoC now exists for CVE-2026-55200, a pre-auth heap overflow enabling RCE in any client connecting to a malicious or MitM SSH server — and libssh2 is statically bundled inside curl, Git, PHP, backup agents, and embedded appliances.
• Audit your developers' VS Code workspaces today: hijacked npm and Go packages now hide execution in folder-open tasks that deploy a Python infostealer the instant a project opens — no phishing, no click required.
• Push Microsoft's out-of-band Office patch now: CVE-2026-21509, an APT28-weaponized zero-day, got an emergency fix Microsoft refused to delay — a signal exploitation has broadened beyond the initial Ukrainian/EU targeting.

CVE-2026-55200 is a heap overflow in libssh2 (all versions through 1.11.1) enabling pre-auth RCE; the flaw lives in ssh2_transport_read(), which fails to validate packet_length, allowing an integer overflow and out-of-bounds heap write. A malicious or MitM SSH server can hit a vulnerable client with no credentials and no user interaction — the victim just connects. A public PoC (including a malicious Python SSH server) is now circulating via the "exploitarium" repo; press rates this CVSS 9.2, no NVD score yet. Patch what you can and hunt static linkage: dpkg -l | grep libssh2, rpm -qa | grep libssh2, and network-restrict anything that can't update. Details

JFrog confirmed two hijacked npm packages — html-to-gutenberg 4.2.11 and fetch-page-assets 1.2.9 — sidestep npm's hardened lifecycle checks by hiding execution in a VS Code task that runs on folder open. The payload pulls encrypted JavaScript from blockchain transaction data, opens a socket.io backdoor, and deploys a Python infostealer; named targets include VS Code, Cursor, Discord, GitHub Desktop, and the npm CLI. Nextron found 16 additional Go packages carrying the same malware, some still live. Check .vscode/tasks.json for runOn: folderOpen entries you didn't write, and update to VS Code 1.109+, which defaults automatic tasks off. Details

RedPacket Security confirmed four new Qilin leak-site entries in 24 hours: NASCO (US agriculture/food), 1-800-Dentist (US healthcare), Transcore (US transportation), and Axionlog (logistics). The dental network is the most sensitive — insurance records, SSNs, and health data across hundreds of practices. Separately, ShinyHunters claims it stole 61M Salesforce records from Sysco weeks after Qilin hit the same firm, a recognizable encrypt-then-separately-extort double-tap. Qilin was 2025's most active RaaS group and has claimed over 500 victims in 2026. Context

An anonymous GitHub account ("bikini") published 130+ unreported PoCs across 22 projects — the same repo hosting the libssh2 exploit — with a note inviting others to "report them yourself and take credit for the CVE." A darkforums.ru actor is already claiming to sell exploits for Gitea, libssh, and c-ares sourced from it. Separately, Gitea's act_runner carries CVE-2026-58053 (CVSS 9.9), passing a workflow's container.options straight into Docker's HostConfig — so --pid=host survives the no-privileged safeguard and hands host root to anyone who can trigger a workflow; NVD-listed June 28, no public exploitation yet. Exploitarium | Gitea CVE

• Coverage note: Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation — This is a required major-headline item for reader awareness; monitor vendor guidance, exploitation reports, and any emergency patch timeline. Key terms: Microsoft Office, zero-day, emergency patch, active exploitation. Source: The Hacker News.

• If GreyNoise reports scanning spikes against SSH infrastructure targeting libssh2 fingerprints, it means the CVE-2026-55200 PoC has moved from research to active campaign — and every unpatched backup agent and embedded appliance is a live target, made worse by curl's maintainer refusing vulnerability reports through July.
• If the VS Code folder-open technique appears inside a CI/CD pipeline, it means the payload no longer needs a human to open anything — automated folder-open behavior fires the infostealer silently with no developer in the loop.
• If a CISA KEV entry lands for CVE-2026-21509 this week, it means exploitation has scaled past APT28 — and any organization that hasn't pushed the emergency Office patch is running with a known front door open.