🟢 Operation Highland 10-Year Air-Gap Breach, 🔵 Anthropic Fable 5 Jailbreak Dispute, 📦 NPM 12 Supply Chain Fix

Operation Highland is the day's defining story: Sygnia details how the Chinese Velvet Ant cluster maintained undetected access to an air-gapped critical infrastructure network for a decade, from 2016 to 2026, by hijacking the organization's entire authentication stack. The campaign replaced pam_unix.so with nine distinct backdoored variants and trojanized OpenSSH components to harvest credentials and log every administrative session, while a modified Nginx server proxied crafted POST requests through fcgiwrap to bridge the isolated network. Password changes and session terminations changed nothing, and remediation required a testing lab just to validate replacement binaries without locking out legitimate administrators.

The Fable 5 export control dispute sharpened: the Commerce Department's directive cited a jailbreak technique that Amazon allegedly flagged, and Anthropic counters that the demonstrated capabilities were already available in OpenAI's GPT-5.5, warning that the standard would stall new model deployments across the industry. GitHub finalized npm 12's security architecture, blocking dependency install scripts by default and gating remote tarballs behind an explicit flag, a direct response to the Shai-Hulud and Miasma campaigns that weaponized package install hooks.

Watchlist: treat PAM, OpenSSH, and authentication binaries as critical assets with file integrity monitoring, and start the npm 11.16 approval workflow now to smooth the v12 migration.