Threat Newsletter May 11, 2026
This week’s threat intel underscores accelerating risk across perimeter infrastructure, software supply chains, and identity. Attackers—including suspected state-linked actors and organized cybercriminals—are exploiting high-value entry points such as firewall services, long-standing OS flaws, phishing-driven credential theft, and trusted developer tooling to gain access, escalate privileges, and steal sensitive data.
At the same time, incidents involving stolen code-signing certificates and vendor/source code exposure highlight how compromise of trusted systems can have outsized downstream impact. The overall takeaway: prioritize rapid patching, reduce external exposure, harden identity controls, and build resilience plans that assume intrusion is possible.
State-Sponsored Hackers Are Exploiting a Critical Palo Alto Flaw
A critical security flaw in Palo Alto Networks' PAN-OS software (CVE-2026-0300) is being actively exploited by a suspected state-sponsored hacking group.
Key Takeaways
What's vulnerable: Palo Alto Networks PAN-OS — specifically the User-ID Authentication Portal service.
How bad is it: Critical (CVSS 9.3/8.7). An attacker with no login credentials can execute code as root.
Who's behind it: A suspected state-sponsored group (likely China-linked) tracked as CL-STA-1132, using open-source tools to stay under the radar.
What attackers did: Gained remote access, covered their tracks by deleting crash logs, then spread laterally and harvested Active Directory data.
No patch yet: Fixes arrive May 13 — until then, restrict or disable the User-ID Authentication Portal.
Quick mitigations: Limit portal access to trusted zones, disable Response Pages on internet-facing interfaces, and if you have Advanced Threat Prevention, enable Threat ID 510019.
Bigger picture: Nation-state hackers are increasingly targeting edge devices like firewalls and VPNs because they're high-value but often have weaker monitoring than standard endpoints.
The Hacker News
A Decade-Old Linux Bug Lets Anyone Become an Admin
A newly discovered Linux vulnerability nicknamed "Copy Fail" (CVE-2026-31431) has been lurking in the Linux kernel for nearly a decade, affecting virtually every major Linux system built since 2017.
Key Takeaways
What's affected: Nearly every major Linux distro since 2017 — Ubuntu, Red Hat, Amazon Linux, SUSE, and more. That's the majority of the world's servers and cloud infrastructure.
How bad is it: CVSS 7.8. Any local user can escalate to full root/admin access. Cloud containers can also be escaped entirely.
Why it's sneaky: It tampers with a file's in-memory copy, not the file on disk — so antivirus and standard security tools see nothing wrong.
How old is it: The bug resulted from three separate, seemingly harmless kernel changes made in 2011, 2015, and 2017 — nobody noticed the dangerous combination for nearly a decade.
Not exploited yet: CISA has not added it to its known exploited vulnerabilities list, meaning no confirmed attacks in the wild — yet.
Patch status: A fix was committed April 1, but distribution to end users has been slow. An interim workaround exists but doesn't work correctly on all distros.
Action: Apply the kernel update as soon as your distro makes it available. Don't rely on the workaround alone.
Alexander Martin
Hackers Got Into Trellix's Source Code
Trellix — a major cybersecurity company born from the merger of McAfee Enterprise and FireEye — has confirmed that attackers gained unauthorized access to a portion of its source code repository
Key Takeaways
What happened: Attackers broke into Trellix's internal source code repository and accessed some of its code.
Who is Trellix: A major cybersecurity firm — formed from McAfee Enterprise and FireEye — that protects thousands of enterprise and government customers. This makes the breach particularly significant.
The irony: A company that sells security tools got breached. That alone raises trust questions for its customers.
Their claim: No evidence the code was exploited or that software releases were affected — but the investigation is ongoing.
What they won't say: Who did it, how they got in, what specific code was taken, or how long the attackers were inside.
Why the silence is concerning: Source code in the wrong hands could let attackers find undisclosed vulnerabilities in Trellix's own security products.
Still developing: Trellix says more details will come as the investigation progresses — so watch this space.
The Hacker News
The Hack That Cancelled Finals: How ShinyHunters Took Down a Platform Used by 30 Million Students
Instructure, the company behind Canvas — one of the world's most widely used learning platforms with over 30 million active users — was hit by a major cyberattack carried out by the notorious hacking and extortion gang ShinyHunters.
Key Takeaways
What was hit: Canvas by Instructure — used by 30+ million students, teachers, and staff at 8,800+ institutions globally.
Who did it: ShinyHunters, the same gang behind the massive Ticketmaster breach in 2024. This appears to be their second time breaching Instructure.
What was stolen: Names, email addresses, student ID numbers, and private messages. Instructure says passwords, financial data, and government IDs were NOT taken — but the investigation is ongoing.
The scale: ShinyHunters claims 280 million records from nearly 9,000 institutions. That number has not been independently verified.
How they got in: Attackers exploited a vulnerability in Instructure's Free-for-Teacher accounts, which have since been temporarily shut down.
Real-world impact: Exams cancelled, deadlines extended, and academic chaos during one of the busiest times of the school year.
The ransom threat: ShinyHunters is demanding schools negotiate settlements to prevent their data from being publicly released.
What Instructure says: The breach is "contained," access has been restored, and they've reissued API keys and revoked compromised credentials — but they haven't disclosed how many users are confirmed affected.
Ionut Arghire
60 Certificates Revoked After DigiCert Analyst's PC Was Infected Through a Support Chat
DigiCert — one of the world's most trusted certificate authorities, responsible for issuing the digital certificates that verify websites and software are legitimate — was hacked through a surprisingly simple attack.
Key Takeaways
What happened: Hackers sent malware disguised as a screenshot through a support chat, infected an analyst's machine, and used that access to steal high-trust code signing certificates.
Why it matters: DigiCert is a cornerstone of internet trust — it issues the certificates that tell your browser and OS that a website or piece of software is legitimate. A breach here has serious downstream implications.
What was stolen: 60 EV Code Signing certificates were fraudulently obtained. These are the same certificates used to prove software is safe and hasn't been tampered with.
Real-world damage: At least 11 of those stolen certificates were actively used to sign Zhong Stealer malware — meaning attackers were distributing malware that appeared to come from a trusted, verified source.
How they got in: A single malicious chat attachment. One infected analyst endpoint was enough to pivot into the entire internal support portal.
Second infection missed: A second infected machine wasn't discovered until April 14 — nearly two weeks later — because security tools on that endpoint were malfunctioning.
Response: All 60 certificates revoked, pending orders cancelled, MFA enforced for admin workflows, chat file type restrictions added, and support users can no longer access certificate initialization codes.
Bigger picture: This is a supply chain trust attack — not a direct attack on end users, but one that could make malware appear completely legitimate to anyone who ran it.
Ionut Arghire
Hackers Are Now Stealing Physical Cargo
The FBI has issued a formal warning about a rapidly growing crime trend: hackers are using cyber attacks to steal real, physical cargo from the U.S. transportation and logistics industry.
Key Takeaways
What's happening: Cyber criminals are using hacking techniques — phishing, fake URLs, remote access tools — to steal physical goods from the supply chain. This is no longer just a digital crime.
The scale: Cargo theft losses reached $6.6 billion across North America in 2025. In the U.S. and Canada alone, losses hit $725 million — up 60% from 2024.
How the attack works: Hackers compromise broker or carrier accounts, post fake freight listings, impersonate trusted carriers to accept real shipments, then reroute and steal the goods using complicit drivers.
Who's behind it: Organized crime groups, active since at least 2024, increasingly working alongside traditional cargo thieves.
Red flags to watch for: Unexpected contacts about shipments, emails mimicking real domains, shortened or spoofed links, suspicious auto-forwarding email rules, short-lived VoIP phone numbers, and slightly altered email addresses.
Ransom twist: In some cases attackers demand payment just to tell victims where their stolen shipment ended up.
How to protect your business: Verify all shipment requests through multiple independent channels, never trust a name or email alone, and keep detailed records of drivers, vehicles, and transactions.
Bigger picture: This is a new breed of crime where a single phishing email can result in a truck full of goods disappearing — bridging the gap between cyber-crime and old-fashioned theft in a way that's proving very difficult to stop.
Pierluigi Paganini
World Leaks Hits Orbán's Media Ecosystem
A ransomware and data extortion group called World Leaks hacked Mediaworks, Hungary's largest pro-government media company — an outlet widely seen as aligned with Prime Minister Viktor Orbán.
Key Takeaways
Who was hit: Mediaworks — Hungary's largest pro-government media group, operating dozens of newspapers, magazines, and online outlets aligned with Orbán's political allies.
Who did it: World Leaks, a data theft and extortion gang that emerged in early 2025 as a rebrand of the Hunters International ransomware group. This appears to be their first operation in Hungary.
What was stolen: 8.5 terabytes of data including payroll records, contracts, financial statements, and internal communications.
The bombshell detail: Leaked editorial meeting notes allegedly show Mediaworks staff discussed seeking help from Moscow to produce content discrediting Ukrainian President Zelensky — a significant allegation given Hungary's controversial stance on the Russia-Ukraine war.
The cover-up attempt: Mediaworks threatened legal action against independent Hungarian outlets that reported on the leaked documents, calling it a criminal offense to use the data. The outlets refused to back down.
Political context: Orbán recently lost Hungary's national election to the opposition, making these revelations politically explosive at an already turbulent moment.
Important caveat: The authenticity of the leaked documents — including the Moscow memo — has not been independently verified.
Bigger picture: This breach sits at the intersection of cybercrime, press freedom, and geopolitics — the hack itself may matter less than what the leaked documents reveal about media independence and foreign influence in Hungary.
Daryna Antoniuk
The Phishing Kit That Fixes Itself: Inside the Year-Long VENOMOUS#HELPER Campaign
A sophisticated, year-long phishing campaign dubbed VENOMOUS#HELPER has quietly compromised over 80 organizations — mostly in the U.S. — by disguising itself as official U.S. Social Security Administration communications.
Key Takeaways
What it is: A phishing campaign active since at least April 2025 that has hit 80+ organizations, primarily in the U.S., and is still ongoing.
The lure: Emails impersonating the U.S. Social Security Administration, tricking recipients into downloading a fake SSA statement that is actually malware.
The clever evasion: Links point to legitimate but compromised real-world websites, helping the emails slip past spam filters.
What gets installed: SimpleHelp — a legitimate, commercially available remote access tool — giving attackers full desktop control, keylogging, file transfers, and the ability to pivot to other systems on the network.
Why security tools miss it: The software is legitimately signed and comes from a reputable vendor. To antivirus and standard monitoring tools, it looks completely normal.
The self-healing trick: The malware installs itself as a Windows service that automatically restarts if killed, and monitors itself every 67 seconds — making it very hard to remove.
The backup plan: If SimpleHelp is detected and blocked, attackers also install ConnectWise ScreenConnect as a second remote access channel, ensuring they can't be fully locked out.
Who's behind it: Unknown, but researchers believe it's a financially motivated Initial Access Broker — a group that breaks into organizations and then sells that access to ransomware gangs.
Bottom line: If an employee clicks this link, attackers can return silently at any time, run commands, steal files, and spread across the network — all while appearing to be legitimate software.
The Hacker News
The AI Tool in Your Pipeline Just Stole Your Cloud Keys
Attackers compromised PyTorch Lightning — one of the most widely used AI and machine learning frameworks with over 11 million monthly downloads — by sneaking malicious code into versions 2.6.2 and 2.6.3 published on PyPI on April 30, 2026.
Key Takeaways
What was hit: PyTorch Lightning — a foundational AI/ML framework used by developers worldwide to train and fine-tune machine learning models, with 11 million+ monthly downloads.
How it worked: Attackers compromised the build/release pipeline and published two malicious versions (2.6.2 and 2.6.3). The malicious code runs automatically the moment the package is imported — no extra user action required.
What was stolen: Browser credentials (Chrome, Firefox, Brave), API keys, GitHub tokens, environment variables, and cloud secrets across AWS, Azure, and GCP — essentially anything sensitive on the developer's machine or CI/CD environment.
It spreads itself: If the malware finds npm publishing credentials, it injects itself into every other package that token has rights to publish, then republishes them — turning victims into unwitting distributors of the malware.
Where stolen data goes: Credentials are quietly committed to attacker-controlled public GitHub repositories disguised as routine dependency updates.
Novel detail: The malware plants persistence hooks targeting VS Code and Claude Code's hook systems — reportedly one of the first documented cases of malware abusing Claude Code in a real-world attack.
Part of a bigger campaign: This is linked to the broader Shai-Hulud supply chain campaign that has been targeting developer tools across multiple package ecosystems.
Safe version: Roll back to version 2.6.1 immediately. The compromised versions have been quarantined on PyPI.
If you ran the affected versions: Don't just uninstall and move on. Rotate all cloud credentials, GitHub tokens, and API keys, audit your repositories for injected files, review CI/CD logs, and treat the entire environment as compromised.
Bill Toulas
Guardrails Off, Government In: How the U.S. Is Stress-Testing AI Models Before Public Release
All five of the biggest U.S. AI companies — Google, Microsoft, xAI, OpenAI, and Anthropic — have now agreed to give the U.S. government early access to their AI models before public release. The reviews are conducted by the Commerce Department's Center for AI Standards and Innovation (CAISI), which evaluates models for national security risks, unexpected behaviors, and capability concerns.
Key Takeaways
What happened: Google, Microsoft, and xAI joined OpenAI and Anthropic in agreeing to let the U.S. government evaluate their AI models before public release — meaning all five major U.S. AI labs are now part of this program.
Who's doing the evaluating: The Commerce Department's Center for AI Standards and Innovation (CAISI), which has already completed 40+ evaluations of models — including cutting-edge ones the public hasn't seen yet.
What they're looking for: National security risks, unexpected behaviors, cyberattack potential, and military misuse concerns.
The guardrails detail: Companies sometimes hand over versions of their models with safety guardrails stripped back so the government can probe for risks that might otherwise be hidden — a significant and underreported detail.
Trump vs. Biden: The agreements build on Biden-era deals but have been updated to align with Trump's AI Action Plan, reflecting a shift in priorities from broad safety standards toward national security-focused evaluation.
The Anthropic wrinkle: Anthropic's participation is complicated by an ongoing Pentagon dispute — the Defense Department has been working to phase out Anthropic's tools over supply chain risk concerns, even as Anthropic renegotiates its evaluation partnership.
What's coming next: Reports suggest Trump may issue an executive order formalizing a government review process for AI tools — suggesting these voluntary agreements could eventually become mandatory.
Bigger picture: This represents a significant — if quiet — expansion of government oversight of AI, with Washington increasingly treating frontier AI models as a national security matter rather than just a consumer technology issue.
Sanya Mansoor
While Trump Disbanded Its U.S. Equivalent, Australia Is Building a Cyber Review Board Mid-Salt-Typhoon Storm
Australia has launched a new Cyber Incident Review Board — an independent body that will conduct no-fault, post-incident reviews of major cyberattacks on Australian government and industry. The goal isn't to assign blame or punish anyone, but to extract systemic lessons from significant breaches and use them to strengthen national cyber resilience.
Key Takeaways
What it is: A seven-member independent board that will review major cyberattacks in Australia after they happen, focusing on what went wrong systemically rather than who to punish.
The "no-fault" approach: Organizations won't face penalties for participating — the point is learning, not liability. This encourages more open and honest disclosure.
The key upgrade over the U.S. model: Australia's board can compel organizations to cooperate and hand over information. The U.S. version relied on voluntary participation, which limited its effectiveness.
Who's on it: Senior figures from Telstra, Boeing Australia, NBN Co, University of New South Wales, law firm Allens, Toll Group, and SA Power Networks. Notably majority female — unusual at senior levels in cybersecurity.
What triggered it: A string of high-profile breaches in Australia — most notably Medibank and Optus — that exposed millions of Australians' data and put pressure on the government to act.
The U.S. contrast: The Biden-era U.S. Cyber Safety Review Board produced three reports before Trump disbanded it — most consequentially one that accused Microsoft of "a cascade of avoidable security failures" that led Satya Nadella to issue a company-wide security overhaul directive. That board was scrapped while investigating Salt Typhoon.
What Australia is not doing: The board won't be able to expand its membership with specialist experts for specific reviews — something cybersecurity experts recommended — which may limit its effectiveness on highly technical incidents.
Bigger picture: As the U.S. steps back from proactive cyber oversight under Trump, allies like Australia are stepping forward — a notable shift in who is leading the charge on structured, accountable cyber governance.
Alexander Martin
You're Under Investigation: The Phishing Campaign That Scared 35,000 Employees Into Handing Over Their Credentials
Microsoft's Defender Research team uncovered a large-scale phishing campaign that ran over just two days — April 15-16, 2026 — and targeted over 35,000 users across 13,000 organizations in 26 countries, primarily in the U.S. The attack was unusually sophisticated, using fake internal compliance and "code of conduct" emails that looked like they came from the victim's own HR or legal department.
Key Takeaways
What it is: A mass phishing campaign that impersonated internal HR and compliance communications to steal Microsoft account credentials from tens of thousands of employees worldwide.
The scale: 35,000+ users targeted across 13,000 organizations in 26 countries — all within a 48-hour window.
The lure: Fake emails claiming a "code of conduct review" had been initiated against the recipient, complete with organization-specific names and urgent deadlines — designed to trigger fear and prompt immediate action.
Why it worked: The emails looked genuinely internal — polished enterprise-style templates, fake encryption notices, HIPAA compliance branding from a real service called Paubox, and preemptive statements claiming all links had been "securely reviewed."
The CAPTCHA trick: After clicking, victims were hit with a Cloudflare CAPTCHA — not for security, but to block automated security scanners from analyzing the attack.
The final trap: Victims were walked through multiple staged pages mimicking a Microsoft login, ultimately triggering an Adversary-in-the-Middle (AiTM) attack that stole their authentication tokens — meaning even MFA-protected accounts could be compromised.
Why MFA isn't enough here: AiTM attacks steal session tokens after authentication, so even if you used MFA to log in, attackers can hijack your session and take over your account anyway.
What to do: Enable passwordless authentication where possible, turn on Safe Links and Safe Attachments in Microsoft Defender, configure automatic attack disruption in Microsoft Defender XDR, and train employees to recognize urgency-based social engineering — especially fake HR or compliance emails.
Bigger picture: Attackers are increasingly weaponizing workplace fear — the threat of an HR investigation is one of the most reliable ways to make someone click without thinking.
Beth Maundrill
The Quantum Threat Isn't Here Yet — But Proton Mail Is Preparing 100 Million Users for When It Is
Proton Mail has rolled out post-quantum encryption (PQC) to all of its 100 million+ users — including those on free accounts — making it one of the first major email providers to do so at consumer scale. The move is a direct response to a growing threat called "harvest now, decrypt later," where intelligence agencies and sophisticated attackers are believed to be quietly collecting encrypted communications today, banking on the fact that future quantum computers will eventually be powerful enough to crack them.
Key Takeaways
What happened: Proton Mail has made post-quantum encryption available to all users — free and paid — making it one of the first consumer email services to reach this milestone at scale.
The threat it addresses: "Harvest now, decrypt later" — adversaries are collecting encrypted emails and data today with the plan to decrypt them once quantum computers become powerful enough. That could be years away, but sensitive data sent today could still be sensitive then.
Why act now: Long-lived sensitive data — government communications, legal documents, medical records, financial information — could be exposed retrospectively even if it's perfectly secure today.
How it works: PQC adds a new quantum-resistant encryption layer on top of existing RSA and ECC standards. It doesn't replace current encryption — it stacks on top of it for extra future-proofing.
It's opt-in: Users need to manually enable it in account settings under "Encryption and keys." It only protects newly sent emails — existing messages in your inbox are not retroactively re-encrypted.
App update required: Older versions of the Proton Mail app don't support the new quantum-resistant keys, so users need to update their apps first.
Cross-provider vision: Proton is collaborating with Thunderbird and other open-source projects to make quantum-safe email work across different providers — a significant step toward broader industry adoption.
Industry context: NIST finalized its first post-quantum encryption standards in 2024. Google's deadline for implementing PQC is 2029, the NSA's is 2033 — making Proton's consumer rollout notably ahead of the curve.
One limitation: End-to-end encrypted email forwarding is temporarily disabled for users who enable PQC, as it isn't yet compatible with the new cryptographic scheme.
Bigger picture: This isn't just a Proton story — it's a signal that the quantum encryption transition is moving from government and enterprise into everyday consumer tools, and that the window to protect sensitive communications is now, not later.
Alex Lekander
The App You Downloaded Was a Trap: How a Chinese-Linked Attack Turned DAEMON Tools Into a Backdoor
DAEMON Tools — a hugely popular Windows application used by gamers, developers, and IT professionals to mount virtual disk images — was compromised in a sophisticated supply chain attack that went undetected for nearly a month.
Key Takeaways
What was hit: DAEMON Tools — a widely used Windows disk imaging app popular with gamers, developers, and IT professionals — had its official installer backdoored for nearly a month.
How long it ran: April 8 to early May 2026 — approximately one month before discovery, comparable in stealth to the notorious 3CX supply chain attack of 2023.
Why it was so hard to spot: The malicious installers were hosted on the official DAEMON Tools website and signed with legitimate developer digital certificates — meaning they looked completely trustworthy to users and security tools alike.
What it did to most victims: Silently collected system information — MAC address, hostname, running processes, installed software, language settings — and sent it to an attacker-controlled server on every startup.
What it did to high-value targets: A full backdoor was deployed to a select dozen machines belonging to government, scientific, manufacturing, and retail organizations in Russia, Belarus, and Thailand — giving attackers persistent remote access, code execution, and the ability to inject malicious payloads into legitimate Windows processes.
The targeting is deliberate: Only a tiny fraction of infected machines received the full backdoor, strongly suggesting the attackers were selectively choosing high-value targets from the pool of infected victims — a hallmark of espionage operations.
Scale: Thousands of infection attempts across 100+ countries, with the most victims in Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China.
Who's behind it: Unknown, but Chinese-language strings in the malware artifacts point toward a Chinese-speaking threat actor. No formal attribution has been made.
The fix: Update to DAEMON Tools Lite version 12.6 immediately. If you installed any version between 12.5.0.2421 and 12.5.0.2434 after April 8, uninstall it, run a full system scan, and check for unusual activity — particularly suspicious PowerShell commands or outbound network connections.
Bigger picture: This is the fourth major supply chain attack Kaspersky has investigated in 2026 alone — following eScan, Notepad++, and CPUID. Trusted, widely-used software is increasingly being weaponized as an attack vector, and the pattern is accelerating.
Dan Goodin
Plan B for the Power Grid: CISA Wants Critical Infrastructure to Keep Running Even When the Internet Goes Dark
CISA has launched a new initiative called CI Fortify that represents a significant — and largely unspoken — shift in U.S. cyber strategy. Rather than focusing primarily on keeping hackers out of critical infrastructure, the new approach accepts that attackers may already be inside and focuses instead on ensuring that power grids, water systems, and other essential services can keep operating even during an active cyberattack.
Key Takeaways
What it is: CI Fortify — a new CISA initiative that guides critical infrastructure organizations on how to keep operating during a cyberattack, even without internet or telecommunications connectivity.
The strategic shift: This represents a move away from "keep hackers out" toward "assume they're already in and limit the damage." It's a significant and sobering change in posture.
The Volt Typhoon reality: Chinese hackers have been embedded in U.S. critical infrastructure since at least 2019. Despite years of efforts to evict them, researchers say they are still deeply present — making full eradication increasingly unrealistic as a near-term goal.
What organizations are being asked to do: Proactively disconnect from third-party dependencies, segment operational technology (OT) networks from the rest of the network, build the ability to operate in isolation, and develop detailed emergency plans before a crisis hits.
Who it targets: All 16 critical infrastructure sectors — energy, water, transportation, healthcare, communications, and more.
The AI angle: CISA explicitly flagged AI as a growing concern, noting that attackers are using AI to conduct intrusions faster and at greater scale. A separate incident confirmed a hacker used an AI model to compromise a water utility in Mexico.
Not just China: While Volt Typhoon is the most visible threat, CISA said CI Fortify also addresses Russian tactics used in alleged OT attacks on Polish infrastructure earlier this year.
The uncomfortable truth underneath: By preparing infrastructure to operate in isolation rather than focusing solely on eviction, the U.S. government is implicitly acknowledging that some nation-state actors cannot be fully removed — and that resilience, not prevention, may be the more achievable goal.
What's next: CISA will conduct targeted assessments of critical infrastructure organizations, though it declined to say how many have been done or where.
Jonathan Greig
The Flaw That Bricks Your Network Management Platform Until Someone Physically Reboots It
Cisco has patched a high-severity denial-of-service vulnerability (CVE-2026-20188) affecting two of its most critical enterprise network management platforms — Crosswork Network Controller (CNC) and Network Services Orchestrator (NSO). These are the backbone tools that large enterprises and service providers use to manage and automate thousands of network devices from a single platform.
Key Takeaways
What's vulnerable: Cisco Crosswork Network Controller (CNC) and Network Services Orchestrator (NSO) — enterprise platforms used by large organizations and service providers to manage and automate entire networks of devices.
How serious is it: CVSS score of 7.5 (high severity). An unauthenticated remote attacker with no special skills can trigger it through a simple flood of connection requests.
What happens: The platform becomes completely unresponsive — taking down network management and automation across every device it controls until manually recovered.
The painful recovery: There is no automatic recovery and no workaround. Someone has to physically or remotely reboot the affected system — a significant operational disruption in large enterprise or carrier-grade environments where uptime is everything.
No workaround exists: Unlike many vulnerabilities where configuration changes can reduce risk while you patch, this one has no temporary fix. Patching is the only option.
Not exploited yet: Cisco's security team has confirmed no known active exploitation in the wild at the time of disclosure — but the clock is ticking given how simple the attack is to execute.
The pattern to watch: Cisco has a track record of similar DoS flaws being exploited after patches are released. In November 2025, two previously patched Cisco DoS flaws were actively used to force ASA and FTD firewalls into reboot loops — prompting an emergency CISA directive to federal agencies.
How it was found: Discovered internally through a Cisco Technical Assistance Center support case — not by external researchers — which means it may have been quietly impacting some organizations already.
Action required: Patch immediately. There are no alternative mitigations. If you run Cisco CNC or NSO, check your software version and upgrade to a fixed release as soon as possible.
Sergiu Gatlan
Ivanti's Zero-Day Problem Won't Stop: Another EPMM Flaw Is Already Being Exploited — Patch by Sunday
Ivanti has patched yet another actively exploited zero-day vulnerability in its Endpoint Manager Mobile (EPMM) product — a mobile device management platform used by enterprises and government agencies to manage and secure employee mobile devices. The new flaw (CVE-2026-6973) allows attackers with administrative privileges to execute arbitrary code remotely on affected systems, and has already been exploited against a limited number of customers before the patch was available.
Key Takeaways
What's vulnerable: Ivanti Endpoint Manager Mobile (EPMM) — a mobile device management platform used by enterprises and government agencies to manage employee mobile devices, enforce security policies, and control access to corporate resources.
The flaw: CVE-2026-6973 — an improper input validation bug that allows remote code execution by an attacker with admin-level access. Affects EPMM versions 12.8.0.0 and earlier.
Already exploited: Ivanti confirmed it was aware of a "very limited number" of customers being targeted in active zero-day attacks before the patch was released.
The chaining concern: This flaw likely isn't being used alone. Two earlier critical Ivanti EPMM flaws from January (CVE-2026-1281 and CVE-2026-1340) allowed unauthenticated remote code execution — attackers may have used those to gain admin access, then used this new flaw to deepen their foothold and take full control.
CISA's urgent deadline: Federal agencies have until May 10 to patch — just four days after disclosure. A sign of how seriously the government is taking this.
The bigger pattern: This is Ivanti's 34th vulnerability flagged by CISA as exploited in the wild. 12 of those have been abused by ransomware groups. Ivanti products are consistently and repeatedly targeted.
Who's likely behind it: Chinese state-sponsored threat actors are frequently suspected in Ivanti zero-day attacks, though no formal attribution has been made for this specific incident.
No reliable indicators of compromise: Ivanti warned there are currently no reliable atomic indicators of compromise for CVE-2026-6973 — making it difficult to know if you've already been hit.
800+ exposed appliances: Shadowserver is tracking over 800 Ivanti EPMM appliances exposed on the internet, many of which may still be unpatched.
What to do immediately: Update to EPMM versions 12.6.1.1, 12.7.0.1, or 12.8.0.1. Review all admin accounts and rotate credentials. Also audit your connected Sentry appliance for signs of lateral movement — and if you were compromised in January's attacks and didn't rotate credentials then, treat this as a high-priority emergency.
Bottom line: If your organization runs Ivanti EPMM on-premises, assume you are a target. This is not a one-off vulnerability story — it is part of a sustained, multi-year campaign against a platform that holds the keys to your entire mobile device fleet.
Sergiu Gatlan
Microsoft Edge Is Storing All Your Passwords in Plain Text — and Microsoft Says That's Fine
A security researcher discovered that Microsoft Edge decrypts every single password stored in its password manager and loads them all into process memory in plain text every time the browser starts — regardless of whether those passwords are actually needed for any site the user is visiting. Even more striking, Edge will still ask users to re-authenticate before displaying those same passwords in the Password Manager UI — creating a false sense of security, since the passwords are already sitting unprotected in memory the entire time.
Key Takeaways
What's happening: Microsoft Edge decrypts all saved passwords and stores them in plain text in process memory every time the browser launches — even for sites you're not visiting.
The false security: Edge will ask you to re-enter your system password before showing saved credentials in its Password Manager UI — but those same passwords are already fully decrypted and readable in memory the whole time, making that authentication prompt essentially theater.
Microsoft's response: When reported, Microsoft said this behavior is "by design" — meaning there are no plans to fix it.
Why it's dangerous: Anyone with administrative access to a machine can extract process memory using debuggers, crash dumps, memory scrapers, or malware and read every saved password in plain text — no hacking required, just the right tools and access level.
Shared environments are especially at risk: In terminal servers, remote desktop environments, or any shared computing setup, an admin can access the memory of all logged-on user processes — meaning one privileged account could expose every password saved by every user on that system.
How attackers exploit this: Credential dumping is one of the most common post-exploitation techniques. Once an attacker has admin access, tools can sweep process memory and harvest plaintext credentials in seconds — enabling lateral movement, privilege escalation, and ransomware deployment.
The security principle being violated: Passwords should be transient — entered, validated, and discarded from memory. Keeping them permanently decrypted in memory turns them from authentication mechanisms into liabilities.
Who is affected: Anyone using Microsoft Edge's built-in password manager — which is enabled by default and actively encouraged by the browser.
What you should do: Consider switching to a dedicated password manager that doesn't load all credentials into memory at startup, and avoid relying on Edge's built-in password manager in shared or enterprise environments where others may have administrative access to your machine.
Jordyn Alger
Rogue TeamPCP Insider May Be Running the Worm That's Methodically Looting Cloud Credentials Across the Internet
A new malware framework called PCPJack has been discovered targeting exposed cloud infrastructure — with a twist that makes it unlike most malware: its first action upon infecting a system is to completely remove any existing infections from TeamPCP, a notorious hacking group responsible for several high-profile supply chain attacks in early 2026. Once PCPJack has evicted TeamPCP and claimed the compromised environment for itself, it gets to work harvesting credentials from cloud services, containers, developer tools, and financial platforms across Docker, Kubernetes, Redis, MongoDB, AWS, and more. It then spreads itself to additional systems both inside the victim's network and across the internet, using stolen credentials and known vulnerabilities.
Key Takeaways
What it is: PCPJack — a sophisticated, self-spreading malware framework targeting exposed cloud infrastructure, discovered by SentinelOne researchers in late April 2026.
The unique twist: PCPJack's very first action is to find and completely remove all TeamPCP malware, tools, files, and persistence artifacts from the infected system — essentially kicking out one criminal gang to take over the compromised environment for itself.
Who it targets: Organizations running exposed Docker, Kubernetes, Redis, MongoDB, RayML, and AWS environments — essentially anyone with misconfigured or internet-exposed cloud infrastructure.
What it steals: Credentials from cloud services, container environments, developer tools, productivity platforms, and financial services — then exfiltrates them via Telegram to attacker-controlled infrastructure.
How it spreads: It uses stolen credentials and known vulnerabilities in web applications — including flaws in Next.js, WordPress plugins, and CentOS Web Panel — to propagate both laterally inside victim networks and externally across the internet, making it a true worm.
No cryptomining: Unlike most cloud-focused malware, PCPJack doesn't deploy cryptominers — suggesting a more focused, professional operation monetizing through credential resale, financial fraud, spam, or extortion.
Who's behind it: Unknown, but SentinelOne believes it's likely a former TeamPCP affiliate or member who broke off to run their own operation — given the deep familiarity with TeamPCP's tooling and the deliberate targeting of the same environments.
The criminal turf war: This represents an emerging trend of competing threat actors actively fighting over compromised infrastructure — essentially a criminal turf war playing out inside your cloud environment.
The second toolset: SentinelOne also found a second associated toolset including Sliver implants — a sophisticated open-source post-exploitation framework — indicating this is a well-resourced, capable operation.
Bottom line: If your cloud infrastructure is exposed to the internet, you may already be a battleground between competing criminal groups. Even if PCPJack "cleans up" a TeamPCP infection, you are not safer — you've simply changed hands from one attacker to another. Audit all exposed services, rotate credentials, and lock down any internet-facing cloud infrastructure immediately.
Bill Toulas
