A Day of Convergence: Critical Infrastructure Burns While Supply Chain Worms Spread
We're witnessing the collision of every threat vector at once today. As we publish this, SolarWinds Serv-U vulnerabilities are being actively exploited to crash servers across enterprise networks. Cisco's SD-WAN Manager is under attack with no patch available. Over 900 automatic tank gauge systems controlling fuel and chemical storage at U.S. critical infrastructure sites sit exposed online. And beneath all of this, self-replicating supply chain worms are quietly infecting development environments while AI systems discover vulnerabilities at speeds we're only beginning to understand.
This isn't a bad week. This is a turning point.
The immediate crisis is unambiguous: CISA is watching active exploitation of the SolarWinds Serv-U DoS flaw, and Cisco has warned that its Catalyst SD-WAN Manager vulnerability is being exploited with zero patch availability. These aren't theoretical risks—they're happening now. For organizations running either platform, the options are binary: defend aggressively or accept compromise. Meanwhile, the discovery that over 900 automatic tank gauge systems controlling fuel storage across the country are exposed online should terrify anyone responsible for critical infrastructure resilience. These aren't consumer devices—they're the nervous system of fuel distribution, chemical storage, and industrial operations.
But the day's real story unfolds one layer deeper, in the supply chain itself. The Miasma self-replicating worm didn't just hit a handful of repositories—it infected 73 Microsoft GitHub repositories across Azure, Azure-Samples, Microsoft, and MicrosoftDocs. Think about what that means: a worm with reproductive capability running through the centralized development infrastructure of one of the world's largest software companies. Simultaneously, IronWorm and a new Miasma variant hit npm with 50+ poisoned legitimate packages, distributing a Rust information stealer and self-spreading capability. The npm ecosystem—where millions of JavaScript projects pull dependencies—is actively being weaponized. And in WordPress, a critical flaw in Everest Forms Pro is being exploited to take over sites. This isn't coordinated by a single actor; it's a convergent realization that supply chains are the path of least resistance.
What's driving this convergence is a tool that simultaneously terrifies and excites the security research community: AI-powered vulnerability discovery. This week, a security startup reported 21 previously unknown vulnerabilities in FFmpeg found by an autonomous AI agent. Google Chrome's 149 release this week patched 429 vulnerabilities—a record, many surfaced by the same class of tools. The promise here is clear: AI can find what humans miss. But so can the adversaries using identical techniques. The same week we're seeing discussion of adaptive, agentic AI worms as an emerging enterprise threat, the principle is no longer theoretical. When vulnerability discovery is democratized through AI, the attack surface expands for everyone. The defense-to-offense ratio tips further toward offense.
The human element remains potent, though. Intelligence agencies from the Five Eyes coalition are warning that Chinese spies are running sophisticated LinkedIn recruiter operations to target government and military personnel, and the FBI and MI5 are explicitly cautioning about out-of-the-blue recruiter messages. Meanwhile, the 2026 Verizon DBIR confirms what defenders have suspected: attacks are increasingly living in the browser itself—through phishing, malicious extensions, shadow AI, and credential theft. The browser has become the battleground because it's where users live. And we're learning that only 10% of SOCs report getting excellent value from AI security tools, suggesting the second wave of AI-native defense systems will be critical to survival.
The consumer-facing risks are no less alarming. Free apps on the iOS App Store are turning smart TVs into web-scraping proxies for AI training—a brilliant arbitrage attack that monetizes always-on infrastructure. Android spyware called Asin is targeting Arabic-speaking users through fake news, PDF, and war map applications. And with the FIFA World Cup just days away on June 11, scammers are already operating fake sites, distributing banking malware through pirate streaming apps, and reselling stolen logins. These aren't sophisticated attacks—they're prey on behavioral patterns and leverage existing infrastructure. They work because they're simple.
The breach calendar continues its grim march: DentaQuest had 2.6 million records leaked by ShinyHunters, RCI nightclub chain reported 40,000 individuals affected. But these barely crack the noise now. We're at a moment where individual breaches are symptoms of systemic failure, not exceptional events.
What should you pay attention to starting Monday? First, if you operate SolarWinds Serv-U or Cisco SD-WAN, assume compromise is possible and act accordingly. Second, audit your supply chain—not your vendors' supply chains, but your supply chain. Where does your code come from? What npm packages are you pulling? Are you signed up for CVE Lite CLI or similar dependency scanning tools that can surface risk at scale? Third, assume your users are targets of nation-state recruiting and social engineering. LinkedIn recruiter messages are now a front. Fourth, watch the browser as the new frontier. Extensions, JavaScript injection, credential interception—the browser layer is where the next year of attacks lives.
The coming weeks will tell us if this is a bad news cycle or a inflection point.
Key Takeaways
- Critical infrastructure is burning now: SolarWinds and Cisco vulnerabilities are actively exploited with live attacks occurring; 900+ fuel storage systems are exposed online. This requires immediate defensive action, not risk assessment.
- Supply chain attacks are systemic: Miasma worms in Microsoft and npm, poisoned packages, and WordPress exploits reveal that dependencies are the path of least resistance for coordinated attacks.
- AI is weaponizing vulnerability discovery: As AI agents find 21 zero-days in FFmpeg and Chrome patches record 429 bugs, defenders must assume attackers have identical tools and prepare for faster exploit timelines.
- The browser and social engineering remain high-yield targets: Nation-state LinkedIn recruiter campaigns, browser-based phishing, and malicious extensions continue to work because humans remain the slowest link in the chain.
The Wire is HackWire's daily editorial briefing, published every morning.