Rosetta Intel

Auto-generated · 29 sources configured (WebSearch mode) · 16 items selected
Window: past 24 hours (2026-05-20 → 2026-05-21)

In-the-Wild / New CISA KEV

🔴🔥 CISA adds 7 KEV entries (2026-05-20) — two fresh Microsoft Defender flaws + five legacy IE / DirectX / Adobe Reader bugs being recycled
- CVE-2026-41091— Microsoft Defender Elevation of Privilege
- CVE-2026-45498— Microsoft Defender Denial of Service
- Legacy reissue: CVE-2008-4250 (Windows buffer overflow), CVE-2009-1537 (DirectX NULL byte), CVE-2009-3459 (Acrobat heap overflow), CVE-2010-0249 / CVE-2010-0806 (IE UAF). Confirms attackers are still ROIing decades-old chains against legacy estates.
  CISA Alert· WindowsForum analysis
🔴⚠️ GitHub internal breach via poisoned VS Code extension (disclosed 5/19, confirmed 5/20)
GitHub confirmed ~3,800 internal repos exfiltrated after an employee installed a trojanized extension from the official VS Code Marketplace. Attacker claims to be TeamPCP, demanding ≥$50k for the data. GitHub says no customer data outside internal repos affected; critical secrets rotated overnight. First public-facing developer supply-chain breach of GitHub itself — and the playbook (poisoned IDE extension → endpoint → SCM tokens) is now the canonical 2026 attack chain.
BleepingComputer · Help Net Security · The Register

Critical Vulnerabilities

🔴⚠️ CVE-2026-45829 "ChromaToast" — ChromaDB Python server pre-auth RCE (CVSS 10.0, still unpatched in v1.5.9)
ChromaDB's FastAPI server loads attacker-controlled embedding-function config (trust_remote_code: true + arbitrary HuggingFace model_name) before authenticating the request. Roughly 73% of internet-exposed deployments affected. Highly relevant to AI infra — most LangChain / LlamaIndex / RAG stacks ship Chroma as the default vector store. Mitigation: switch to Rust frontend or restrict network exposure.
Hadrian writeup · HiddenLayer "ChromaToast Served Pre-Auth" · BleepingComputer
🔴 Drupal "highly critical" core release (PSA-2026-05-18, patches drop 5/20 17:00–21:00 UTC)
Affects all supported branches: 11.3.x / 11.2.x / 10.6.x / 10.5.x. Drupal Security Team rated 20/25, Access Complexity = None, Authentication = None — i.e. unauthenticated. Drupal Steward customers get WAF mitigation at release.
PSA-2026-05-18 · SecurityWeek · TheHackerNews
⚠️ PinTheft — Linux kernel LPE PoC released (5/19, no CVE yet)
RDS zerocopy double-free → io_uring fixed-buffer page-cache overwrite → root via SUID binary substitution. Reliable on Arch Linux by default (RDS module enabled), needs io_uring + x86_64 elsewhere. PoC live on V12 Security GitHub.
BleepingComputer · oss-security thread
⚠️ DirtyDecrypt — Linux kernel CVE-2026-31635 LPE PoC released Separate kernel LPE chain, also live PoC. Pairs nicely with PinTheft for post-exploit toolkits.

Vendor Advisories

Microsoft Security Blog (5/20) — open-sources RAMPART and Clarity for AI agent safety
- RAMPART(Risk Assessment and Measurement Platform for Agentic Red Teaming): Pytest-native safety/security testing framework for agents, built on top of PyRIT. Turns red-team findings into CI regression tests.
- Clarity: structured "are we building the right thing?" sounding board for agent design.
  Signals that agent-security regression testing is becoming a CI concernrather than a periodic red-team artifact.
  Microsoft Security Blog· The Hacker News
Nx Console (rwl.angular-console) v18.95.0 published to VS Code Marketplace — malicious (>2.2M installs on the legit extension). Continues the trend of typo-squatted IDE extensions targeting dev secrets. Microsoft pulled it.
The Hacker News coverage

Web Security Research

Verizon 2026 DBIR drops (5/20) — vulnerability exploitation overtakes credential abuse as #1 breach vector for the first time in 19 DBIRs
- 31% of breaches start with an unpatched vuln (credential abuse: 13%)
- Median time-to-patch ↑ from 32 → 43 days (+34%)
- Only 26%of CISA KEV entries fully remediated in 2025 (down from 38%)
- 3rd-party involvement in breaches ↑ 60% YoY; 48% of breaches involve a third party
- Ransomware present in 48% of confirmed breaches (was 44%); median ransom paid <$140k
  SecurityWeek summary· Help Net Security findings· Verizon DBIR portal
Project Zero — "When a Door Closes, a Window Opens: 0-click Pixel 10 exploit chain" (5/13, still circulating)
Demonstrates that the Pixel 9 → root in 2 exploits chain ports to Pixel 10 despite mitigations. Useful read for anyone tracking mobile / browser sandbox boundaries.
Project Zero post

AI Security

⚠️🛡 OpenAI Daybreak launched (5/11, broader rollout announced this week) — AI-powered vuln detection + patch validation
GPT-5.5-Cyber + Codex Security run a project-specific threat model over a GitHub repo, find vulns via LLM reasoning, pressure-test in a sandbox to validate exploitability, and propose patches for human review. Repositions Codex as an enterprise security platform competing directly with Anthropic's Mythos and Google's Big Sleep / CodeMender.
The Hacker News · MarkTechPost analysis
⚠️🛡 Google CodeMender opens external API access (announced at I/O, broader access this week)
Gemini-powered agent that patches vulns (complementary to Big Sleep, which finds them). External red-team partners now getting API access. Big Sleep + CodeMender = Google's full find→fix pipeline, mirroring Anthropic's Mythos and OpenAI's Daybreak.
DeepMind CodeMender post · SecurityWeek · MWM analysis
🛡 Microsoft RAMPART + Clarity (5/20) — see Vendor Advisories above; this is the defensive half of the same race. Pytest framework for codifying agent red-team findings as regression tests.
⚠️🛡 ChromaDB ChromaToast (CVSS 10) — see Critical Vulns above. AI infrastructure vulnerabilities now reaching max severity with cross-cutting impact on every RAG stack.

Threat Intelligence

Webworm APT (China-aligned) targets European governments — new ESET research published 5/20
- Two new backdoors:
  - EchoCreep— Discord-based C2 (uploads files, runtime reports, receives commands via Discord)
  - GraphWorm— Microsoft Graph API C2, exclusively OneDrive endpoints
- Targets confirmed in Belgium, Italy, Poland, Serbia, Spain + a South African university
- 400+ decrypted Discord messages; >50 unique recon targets
- WormFrpcustom proxy retrieves config from compromised AWS S3 bucket (victim foots the AWS bill)
  The Hacker News· ESET· Help Net Security
DFIR Report — "The Gentlemen" ransomware via TukTuk + EtherRAT (5/11, still actively studied)
EtherRAT dropped via malicious MSI masquerading as Sysinternals → new framework TukTuk for C2 → GoTo Resolve for exfil → domain-wide ransomware via GPO scheduled tasks. The Gentlemen RaaS has claimed ~320 victims, mostly in 2026, with lockers for Windows / Linux / NAS / BSD / ESXi.
DFIR Report flash alert · Check Point Research recap
Grafana Labs scope-of-impact update (5/20) — GitHub-environment breach confirmed limited; no customer production impact.

Chinese-Language Community Picks

Chinese-language sources today (FreeBuf / Xianzhi / Anquanke): JS rendering on Chinese sites is limited under WebSearch mode, so no specific items for 5/20–5/21 were captured. Recommend following the domestic disclosure window directly via the FreeBuf news feedand the Alibaba Cloud Vulnerability Database.

Ransomware Today

Active leak-site posting continues at high tempo. Most active groups in the past 24h: LockBit, INC_Ransom, Akira, Qilin. Akira posted multiple new victims (Barclay Damon, Acton Electrical, TSG Enterprises). Qilin posted Hamer Childs with timestamp 2026-05-20. The Gentlemen RaaS continues expanding.

→ Full table: intel/ransomware/daily/2026-05-21.md

AI Frontier

OpenAI

Daybreak(launching this week) — AI vuln detection + patch validation built on GPT-5.5-Cyber + Codex Security
OpenAI + Dell partnership (5/19)— Codex coming to hybrid + on-prem enterprise environments
OpenAI content provenance research (5/20)— initiative "Advancing content provenance for a safer, more transparent AI ecosystem"
OpenAI News

Anthropic

Code w/ Claude London (5/20–5/21)— second tour stop after SF, includes Day 1 keynotes streamed live
Andrej Karpathy joins Anthropic (announced 5/19)— building a team to use Claude to accelerate pretraining research
Acquires Stainless (5/18)— SDKs and MCP-server tooling specialist
KPMG strategic alliance (5/19)— Claude across KPMG's core business and 276k workforce
Anthropic News· VentureBeat — Karpathy· Code with Claude London

Google DeepMind / AI

Project Genie + Street View (5/20)— multimodal world-simulation expands; rolls out to Google AI Ultra ($200/mo) subscribers globally
DeepMind blog
CodeMender external API access opens(post-I/O continuation) — see AI Security
Big Sleep continues finding in-the-wild 0-days— May 11 disclosure: threat actor's 0-day was AI-assisted, found pre-weaponization

🛡 = security-relevant, archived under intel/ai-frontier/security/

Key Threads This Week

Big-three labs all shipped find-and-fix AI security platforms within ~30 days: Anthropic Mythos / OpenAI Daybreak / Google Big Sleep + CodeMender. They're racing each other, and they're racing PROMPTFLUX-style AI-as-weapon malware described in M-Trends 2026.
AI infrastructure itself is now a high-value target: CVE-2026-45829 (Chroma, CVSS 10, unauthenticated, 73% of public deployments) is the canonical example. Anyone running a RAG stack inherits this risk.
Developer supply chain → 2026's dominant attack surface: GitHub-internal breach via poisoned VS Code extension this week is the cleanest example yet. Pair with DBIR finding that vulnerability exploitation overtook credentials as #1 breach vector.
PinTheft + DirtyDecrypt both shipped with PoCs in 48h— kernel LPE PoCs are landing faster, post-exploit playbooks updating in near-real-time.

Failed Sources

This run used WebSearch mode (workspace web_fetch network allowlist blocks most security RSS hosts). Coverage is by topic, not raw feed scraping; some lower-priority feeds (Detectify Labs, Trail of Bits, Krebs raw feed, 安全客, 先知社区) are not directly reflected. Items in the brief are cross-sourced from indexed news search.

Sources used: see intel/sources.yaml

Rosetta Daily · May 21, 2026