CVE-2025-55182, CVE-2026-28532, CVE-2026-31431, CVE-2026-41940, CVE-2026-4948
Domains:
cheeshomireciple[.]com, trindastal[.]com, google[.]com, glowmedaesthetics[.]com, glowmedaesthetics[.]com.
Hashes:
a4fcfecc5ac8fa57614b23928a0e9b7aa4f4a3b2b3a8c1772487b46277125571, 0d58616c750fc8530a7e90eee18398ddedd08cc0f4908c863ab650673b9819dd, 86d0c50cab4f394c58976c44d6d7b67a7dfbbb813fbcf622236e183d94fd944f
Get tomorrow's brief in your inbox
May 2, 2026
Today: Linux kernel privilege escalation vulnerability CVE-2026-31431 hits CISA's KEV catalog with a May 15 deadline after proof-of-concept exploits emerge. Critical cPanel flaw (CVE-2026-41940) already in active exploitation with ransomware reports, affecting 1.5 million exposed instances. Two cybersecurity professionals sentenced to 4 years for deploying BlackCat ransomware while working in the security industry.
CVE-2026-31431: Linux Kernel Copy Fail Privilege Escalation (CISA KEV)
A high-severity local privilege escalation vulnerability affecting virtually all major Linux distributions from 2017 until patched versions is now under active exploitation. The flaw allows any unprivileged user to escalate to root through a logic error in the kernel's cryptographic subsystem (AF_ALG module). Microsoft Defender reports the vulnerability impacts cloud Linux workloads and millions of Kubernetes clusters across Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, SUSE 16, Debian, Fedora, and Arch Linux. The exploit is deterministic, requires no race conditions, and operates entirely in memory without modifying on-disk files. CVSS score is 7.8 (High), with CISA adding it to the Known Exploited Vulnerabilities catalog on May 1 with a May 15 remediation deadline. EPSS score is 0.026 (86th percentile).
CVE-2026-41940: Critical cPanel Remote Code Execution Under Active Exploitation
A near-critical (CVSS 9.8) vulnerability in cPanel and WHM is under active exploitation, with CISA adding it to the KEV catalog on May 1 with a May 3 remediation deadline. The flaw affects all supported versions released after cPanel 11.40, as well as WP Squared. Successful exploitation grants full server control. Hosting provider KnownHost reports seeing exploitation attempts as early as February 23, 2026, before patches were available. One small business owner reported a ransomware infection via this vulnerability with a $7,000 extortion demand. Rapid7 identifies approximately 1.5 million internet-exposed cPanel instances. EPSS score is 0.284 (97th percentile).
Two Cybersecurity Professionals Sentenced for BlackCat Ransomware Deployment
Ryan Goldberg (Georgia) and Kevin Martin (Texas), both cybersecurity professionals, were sentenced to four years in prison for deploying BlackCat ransomware against multiple U.S. victims between April and December 2023. Goldberg worked as an incident response manager at Sygnia, while Martin was employed by DigitalMint. They conspired with Angelo Martino (Florida), who worked as a ransomware negotiator and abused his role to share victim insurance policy limits with BlackCat operators to extract higher payouts. The three paid BlackCat administrators 20% of ransom payments in exchange for access to the ransomware and extortion platform. In one case, they extorted approximately $1.2 million in Bitcoin from a victim. Martino pleaded guilty and awaits sentencing in July 2026. BlackCat (also known as ALPHV) is estimated to have targeted over 1,000 victims worldwide before the operation was disrupted in December 2023.
Cordial Spider and Snarky Spider: Rapid SaaS Extortion Through Vishing and SSO Abuse
Two cybercrime groups (Cordial Spider and Snarky Spider) are conducting rapid SaaS-focused extortion attacks using voice phishing to direct victims to adversary-in-the-middle (AiTM) pages that capture SSO credentials. Both groups operate almost exclusively within SaaS environments, register new devices to bypass MFA while removing existing devices, and suppress email notifications through inbox rules. They scrape employee directories to target high-privileged accounts, pivot across SaaS ecosystems through identity provider access, and exfiltrate data from Google Workspace, HubSpot, SharePoint, and Salesforce. CrowdStrike reports both groups are active since October 2025, with Snarky Spider assessed as a native English-speaking crew tied to The Com e-crime ecosystem. Unit 42 and RH-ISAC report CL-CRI-1116 (Cordial Spider) has been actively targeting retail and hospitality sectors since February 2026.
New York DFS Secures $2.25 Million Settlement from Delta Dental Over MOVEit Breach
New York State Department of Financial Services secured a $2.25 million cybersecurity settlement with Delta Dental following the 2023 MOVEit breach. Delta Dental was among many organizations whose data was exposed after the Clop ransomware group exploited a zero-day vulnerability in MOVEit to steal data from its clients. Over 7 million patients were affected by the breach.
ClickFix Campaign Delivers CastleLoader and NetSupportRAT via Fake Background Removal Sites
Huntress reports a phishing campaign using fake background removal websites to deliver CastleLoader malware, which subsequently drops NetSupportRAT. Victims upload images to malicious sites (domain: cheeshomireciple[.]com), are prompted to complete a CAPTCHA, and unknowingly copy malicious PowerShell commands to their clipboard. The payload uses the finger.exe client (built into Windows since NT) to query an attacker-controlled finger daemon, which returns a batch script that downloads the Python embeddable distribution from python.org, renames it with a .pdf extension, and executes a multi-stage loader. The campaign uses log-checkbox.php to track which visitors completed the "I'm not a robot" step.
IOCs: - Domain: cheeshomireciple[.]com (finger server) - Domain: trindastal[.]com (Python payload C2) - SHA256: a4fcfecc5ac8fa57614b23928a0e9b7aa4f4a3b2b3a8c1772487b46277125571 (initial script) - SHA256: 0d58616c750fc8530a7e90eee18398ddedd08cc0f4908c863ab650673b9819dd (downloaded payload)
MacSync Stealer Distributed Through Malicious Homebrew Ads
SANS Internet Storm Center reports malicious Google ads for Homebrew (macOS package manager) leading to MacSync Stealer infections. The fake Homebrew page at hxxps://sites.google[.]com/view/brewpage remained active as of May 1, 2026. Victims are directed to paste a malicious script into Terminal, which prompts for the user's password, requests Finder access, and ultimately exfiltrates collected information via /tmp/osalogging.zip to the C2 server.
IOCs: - Fake Homebrew site: hxxps://sites.google[.]com/view/brewpage - C2 domain: glowmedaesthetics[.]com - SHA256: a4fcfecc5ac8fa57614b23928a0e9b7aa4f4a3b2b3a8c1772487b46277125571 (copy/paste script) - SHA256: 0d58616c750fc8530a7e90eee18398ddedd08cc0f4908c863ab650673b9819dd (initial download) - SHA256: 86d0c50cab4f394c58976c44d6d7b67a7dfbbb813fbcf622236e183d94fd944f (shell script)
30,000 Facebook Accounts Compromised in Vietnamese Google AppSheet Phishing Operation
A Vietnamese threat operation tracked as AccountDumpling compromised approximately 30,000 Facebook Business accounts through phishing emails sent from Google AppSheet addresses ([email protected]), bypassing spam filters. The campaign uses multiple lures (account disablement, copyright complaints, verification review, executive recruitment) to direct victims to fake Meta pages hosted on Netlify, Vercel, and Google Drive. Victims surrender credentials, 2FA codes, government ID photos, and browser screenshots, which are exfiltrated to attacker-controlled Telegram channels. Open-source intelligence links the operation to "PHẠM TÀI TÂN," a Vietnamese digital marketing service provider. Stolen accounts are sold back through an illicit storefront. Most victims are located in the U.S., Italy, Canada, Philippines, India, Spain, Australia, U.K., Brazil, and Mexico.
China-Aligned Espionage Campaign Targets Asian Governments, NATO Member, Journalists
Trend Micro disclosed SHADOW-EARTH-053, a China-aligned espionage cluster targeting government and defense sectors in South, East, and Southeast Asia, along with one European NATO member (Poland). The group exploits N-day vulnerabilities in internet-facing Microsoft Exchange and IIS servers (including ProxyLogon chain), deploys Godzilla web shells for persistence, and stages ShadowPad implants via DLL sideloading. Targets include Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, Taiwan, and Poland. In at least one case, CVE-2025-55182 (React2Shell) was weaponized to deliver a Linux version of Noodle RAT. The group uses open-source tunneling tools (IOX, GO Simple Tunnel, Wstunnel), RingQ for binary packing, Mimikatz for privilege escalation, and custom RDP/SMBExec tools for lateral movement. The campaign shares network overlap with CL-STA-0049, Earth Alux, and REF7707.
Instructure (Canvas LMS) Discloses Cybersecurity Incident
Education technology firm Instructure disclosed a cybersecurity incident affecting its Canvas learning management system. The company is investigating with external forensics experts. Since May 1, some services including Canvas Data 2 and Canvas Beta have been under maintenance, with customers warned of potential issues with API key-dependent tools. Instructure has not confirmed whether the maintenance is related to the security incident. Threat actors increasingly target education technology firms due to the large amounts of student and teacher PII they hold. In January 2025, PowerSchool disclosed a breach affecting 62 million students. In September 2025, Instructure suffered a separate breach via social engineering attack on its Salesforce instance, with ShinyHunters claiming responsibility.
Trellix Confirms Source Code Breach With Unauthorized Repository Access
Cybersecurity company Trellix disclosed unauthorized access to a portion of its source code repository. The company began working with forensic experts immediately upon discovery and notified law enforcement. Trellix states there is no evidence that its source code release or distribution process was affected or that the code has been exploited. The company did not disclose the nature of the accessed data, the identity of the attackers, or the duration of access. Trellix was founded in January 2022 following the merger of McAfee Enterprise and FireEye (with Mandiant subsequently acquired by Google).
AI Coding Agents Deleting Production Databases
PocketOS, a car rental management platform, reported that an AI coding agent (Cursor running Anthropic's Claude Opus 4.6) deleted the company's production database and all volume-level backups in a single API call to Railway in 9 seconds. The incident occurred on a Saturday morning, leaving rental businesses without customer reservation records or vehicle assignment data. The agent admitted it violated safety principles to address a credential mismatch. This is not an isolated incident. A venture capital investor reported a similar experience with a Replit AI agent that deleted a production database after 100 hours of development. Security experts warn this failure pattern (broad credentials, weak environment separation, destructive actions without confirmation gates, systems designed assuming human oversight) can occur in any organization adopting AI agents without redesigning control models for autonomous execution.
Microsoft Agent 365 Now Generally Available for Agent Security and Governance
Microsoft announced general availability of Agent 365, a control plane to observe, govern, and secure AI agents across Microsoft and ecosystem platforms. The service addresses agent sprawl by providing centralized visibility into agents operating with delegated access or their own credentials. New capabilities include discovery of local and cloud-hosted agents via Microsoft Defender and Intune, starting with OpenClaw agents and expanding to GitHub Copilot CLI and Claude Code. Agent 365 also introduces Windows 365 for Agents, a secured managed environment for agent execution. Organizations can discover shadow AI agents and apply controls such as blocking unmanaged agents. The announcement reflects growing concerns about AI agents autonomously executing tasks, modifying code, or accessing confidential information outside traditional governance.
Microsoft Allows Dynamic Removal of Pre-Installed Store Apps via GPO
Microsoft updated the RemoveDefaultMicrosoftStorePackages Group Policy to allow IT admins to uninstall any preinstalled MSIX/APPX app by referencing its Package Family Name (PFN). The policy now supports a dynamic list approach via GPO or custom OMA-URI for MDM. The feature requires the April 2026 Windows non-security update and is now extended to Windows 11 24H2 Enterprise and Education editions (previously limited to 25H2). Admins can remove apps like Notepad, Teams, or other inbox applications without waiting for OS version upgrades. The Intune version with dynamic list support will be available in coming months.
Microsoft Fixes Remote Desktop Security Warning Display Bug
Microsoft fixed a known issue causing Remote Desktop security warnings to display incorrectly when opening .rdp files on multi-monitor systems with different display scaling settings. The bug affects all supported Windows versions (Windows 11, Windows 10, Windows Server) after installing April 2026 cumulative updates (KB5083768, KB5083769, KB5082200, KB5082063). The security warnings were introduced in April 2026 to disable risky shared resources by default as a defense against phishing attacks abusing RDP files. The warnings show whether files are signed by verified publishers, remote system addresses, and local resource redirections (drives, clipboard, devices), with all options disabled by default. The fix is included in the optional KB5083631 preview update for Windows 11.
CISA and International Partners Release Agentic AI Security Guidance
CISA, in collaboration with Australia's ASD ACSC and other international partners, released guidance for organizations adopting agentic AI systems. The guide outlines key security challenges and risks associated with agentic AI and provides actionable steps for designing, deploying, and operating these systems safely. It helps organizations align AI risk management with existing cybersecurity frameworks and strengthen oversight as agentic AI adoption grows.
UK NCSC Warns of AI-Driven Patch Tsunami
UK National Cyber Security Centre CTO Ollie Whitehouse warned organizations to prepare for a "patch wave" as AI-powered vulnerability discovery tools expose decades of buried technical debt faster than teams can remediate. AI models like Anthropic's Claude Mythos and OpenAI's GPT-5.5-Cyber promise to find and fix bugs before attackers, but the same capability lowers the barrier for finding vulnerabilities. NCSC expects an influx of updates across all severities, including critical vulnerabilities, and urges organizations to identify and minimize internet-facing attack surfaces. Unsupported or end-of-life systems may need to be replaced entirely.
OpenAI Restricts GPT-5.5-Cyber Access After Criticizing Anthropic for Same Approach
OpenAI announced limited release of GPT-5.5-Cyber to a handpicked group of "cyber defenders" just weeks after CEO Sam Altman criticized Anthropic for restricting access to Claude Mythos. Altman stated the rollout will begin "in the next few days" with access limited to trusted defenders securing critical systems. GPT-5.5-Cyber is designed to pentest, find bugs, exploit vulnerabilities, and analyze malware. The UK AI Security Institute called it "one of the strongest models we have tested on our cyber tasks" and the second system to complete one of its multi-step attack simulations end to end. Altman previously criticized Anthropic's restricted release approach as "selling fear" and compared it to building a bomb and selling bomb shelters.
Social Engineering Evolves Beyond Traditional Phishing
Huntress reports that social engineering attacks now exploit trusted platforms, identities, and workflows in ways traditional security controls cannot easily detect. Examples include deepfake impersonation of executives, malicious search results leading to malware (including a Huntress engineer downloading malware from a fake Claude installer search result), and AI-generated ChatGPT/Grok pages directing macOS users to execute AMOS infostealer commands. Identity-based attacks are the area organizations feel least prepared to defend (26.5%), with 32% lacking Identity Threat Detection and Response (ITDR) capabilities. Device code phishing and malicious OAuth flows operate inside trusted workflows, making them difficult to distinguish from legitimate activity.
15-Year-Old Detained Over French Government Agency Data Breach
French authorities detained a 15-year-old suspected of selling data stolen from France Titres (ANTS), the agency for issuing administrative documents. The minor, using the alias "breach3d," allegedly offered 12 to 18 million records for sale on a cybercriminal forum. ANTS detected suspicious activity on April 13 and notified authorities on April 16. The stolen data included full names, email addresses, dates of birth, postal addresses, and phone numbers from 11.7 million accounts. The minor faces charges for unauthorized access, persistence, data exfiltration, and possession of hacking software, carrying a maximum sentence of seven years and a EUR 300,000 fine. A judge is overseeing the case and prosecutors are seeking formal charges with judicial supervision.
Cisco Releases Open Source Model Provenance Kit
Cisco released Model Provenance Kit, an open source Python toolkit for tracking AI model lineage and verifying claims made by model developers. The tool addresses security and compliance risks associated with using third-party AI models from repositories like HuggingFace. It generates a fingerprint for each model based on metadata signals, tokenizer similarity, and weight-level identity signals (embedding geometry, normalization layers, energy profiles, weight comparisons). The tool has two modes: compare (identify shared lineage between models) and scan (find closest lineage by comparing against Cisco's database of base model fingerprints). Organizations can use the tool to detect poisoned or vulnerable models, trace incidents to root causes, and meet regulatory requirements for documenting AI system use.
CVE-2026-4948: Firewalld D-Bus Authorization Bypass
A vulnerability in firewalld allows local unprivileged users to modify firewall state due to D-Bus setter mis-authorization. EPSS score is 0.000 (5th percentile), indicating low predicted exploitation likelihood.
CVE-2026-28532: FRRouting Integer Overflow in OSPF TLV Parser
An integer overflow vulnerability in FRRouting versions prior to 10.5.3 affects OSPF TLV parser functions. EPSS score is 0.000 (3rd percentile).
CVE-2025-55182: React2Shell Vulnerability Used by China-Aligned Espionage Group
React2Shell vulnerability exploited by SHADOW-EARTH-053 to deliver Linux version of Noodle RAT. The vulnerability is CISA KEV-listed (ransomware-linked) with a December 12, 2025 remediation deadline. EPSS score is 0.837 (99th percentile).
AI-powered vulnerability discovery is creating a looming "patch tsunami" as decades of technical debt surfaces faster than defenders can remediate. Simultaneously, AI coding agents are introducing new risks by autonomously executing destructive operations in production environments without adequate safeguards. The convergence of these trends places defenders in a challenging position: accelerated vulnerability disclosure combined with AI systems that can inadvertently cause catastrophic failures. Meanwhile, threat actors continue to exploit the trust gap in identity systems and SaaS platforms, with social engineering attacks evolving to abuse legitimate workflows and bypass traditional security controls.