Rosetta Daily · May 24, 2026

Auto-generated · 29 sources configured (WebSearch mode — feed allowlist still in effect) · 15 items selected
Window: past 24 hours (2026-05-23 → 2026-05-24)

In-the-Wild / New CISA KEV

• 🔴🔥⚠️ CVE-2026-9082 — Drupal Core SQL Injection added to CISA KEV (5/22), already 15,000+ attack attempts in the wild
  CISA added the Drupal Core PostgreSQL-driver SQL injection to KEV on 5/22 after Imperva and others observed 15,000+ exploit attempts against ~6,000 distinct sites across 65 countries. Roughly half of attacks target gaming and financial-services sites. Drupal 8 and all later versions on PostgreSQL are affected — MySQL/MariaDB/SQLite stacks are not. The injection primitive chains to information disclosure → data tamper → in some configurations RCE. Patch immediately; the window between disclosure and mass-exploitation kits is closing fast.
  Tenable advisory · Imperva — 15K attack attempts · Windows Forum — KEV addition

• 🔴🔥⚠️ Laravel-Lang supply-chain attack — 700+ poisoned versions across community PHP packages (5/22–5/23, ongoing)
  Aikido Security and Socket disclosed on 5/22 that the Laravel-Lang GitHub organization is currently being weaponized at scale: 700+ versions across laravel-lang/lang (7.8k stars), laravel-lang/attributes, laravel-lang/http-statuses, and laravel-lang/actions have been re-tagged to point at malicious forks. Attackers exploited a GitHub feature where version tags can point to commits from a fork — bypassing the maintainer review path that PR-based attacks need. The payload registers a src/helpers.php under composer.json autoload.files, so the backdoor executes on every PHP request. Aikido characterizes it as a credential stealer; Socket characterizes it as an RCE backdoor. Suspected vector: organization-level credentials, repository automation, or release infrastructure compromise. Tags were published in rapid bursts on 5/22 and 5/23 — automation, not a human attacker.
  The Hacker News · Socket — full analysis · Aikido report · SecurityOnline

• 🔴⚠️ Microsoft Exchange OWA zero-day CVE-2026-42897 — still no permanent patch; automatic mitigation now deployed via EM Service
  Microsoft has not yet shipped a code-level fix for the actively-exploited Exchange OWA spoofing/XSS bug (affects every supported on-prem release: Exchange SE / 2019 / 2016). Microsoft has now pushed automatic mitigation M2.1.x via the Exchange Emergency Mitigation Service for tenants that have EM enabled. CISA KEV deadline for Federal agencies is 5/29. If you have on-prem Exchange exposed to the public internet: confirm M2.1.x is applied (TechCommunity post documents verification steps), or take OWA offline.
  Microsoft TechCommunity — addressing CVE-2026-42897 · MSRC · SecurityAffairs

Critical Vulnerabilities

• 🔴 CVE-2026-20223 — Cisco Secure Workload REST API authentication bypass (CVSS 10.0, patched)
  Cisco shipped fixes on 5/21 for a maximum-severity flaw in Secure Workload (formerly Tetration) Cluster Software, both SaaS and on-prem. Insufficient validation and authentication on internal REST API endpoints lets an unauthenticated remote attacker who can reach the management plane obtain Site Admin privileges — full segmentation-policy control across tenants. Web management UI is not affected. No workarounds; Cisco says no known in-the-wild exploitation yet. Patched versions: 3.10.8.3 (3.10 branch), 4.0.3.17 (4.0 branch); 3.9 and earlier must migrate to a fixed release.
  The Hacker News · Cisco advisory via SecurityAffairs · The Register

• 🔴⚠️ GitHub Nx Console / TanStack supply-chain blast radius confirmed — 3,800 internal repos exfiltrated
  GitHub CISO Alexis Wales formally identified the malicious VS Code extension behind the GitHub-internal repo breach as a trojanized version of Nx Console (2.2M installs). The full attack chain (TeamPCP, "Mini Shai-Hulud"): 5/11 attacker poisoned @tanstack package release workflow via GitHub Actions cache pollution → 84 malicious versions of 42 @tanstack packages → stole Nx Console maintainer's GitHub CLI credentials → pushed an orphan commit to nrwl/nx → published Nx Console 18.95.0 on the VS Code Marketplace at 12:30 UTC on 5/18 (live 18 minutes). The credential stealer specifically targets 1Password vaults, Anthropic Claude Code configs, npm, GitHub, AWS. Secondary victims: Grafana Labs, Mistral AI, UiPath, 160+ additional npm/PyPI packages.
  Help Net Security · The Hacker News · TanStack postmortem ·

Vendor Advisories

• Microsoft — Exchange Server EM Service auto-mitigation M2.1.x now live for CVE-2026-42897. See KEV item above.

• Cisco — Catalyst SD-WAN Controller (CVE-2026-20182) and Secure Workload (CVE-2026-20223) advisories both unpatched-to-patched within the same week. Second perfect-10 from Cisco in two weeks. Patch management teams running Cisco network gear should expect a follow-on cleanup cycle even if both got mainline-channel fixes.

Web Security Research

• Pwn2Own Berlin 2026 final tally — $1,298,250 paid for 47 zero-days; DEVCORE crowned Master of Pwn (5/14–5/16)
  Day 1 $523,000 / 24 0-days · Day 2 $385,750 / 15 0-days · Day 3 $389,500 / 8 0-days. Targets: web browsers, enterprise applications, local privilege escalation, servers, local inference, cloud-native/container environments, virtualization, and the LLM category (new this year). Final rankings: DEVCORE (50.5 pts / $505,000), STARLabs SG (25 pts / $242,500), Out Of Bounds (12.75 pts / $95,750). Watch for cluster of vendor advisories over the next 2–3 weeks.
  ZDI — Day 3 + Master of Pwn · Bleeping Computer · Penligent — 47 zero-days + LLM toolchain attack surface

• Microsoft Security Blog — "When prompts become shells: RCE vulnerabilities in AI agent frameworks" (5/7, momentum carries this week)
  Microsoft Security walks through how indirect-prompt-injection into AI-agent frameworks becomes a remote-code-execution primitive once a model is wired to tools — the boundary between content-security and exec is no longer conceptually distinct. Practitioner-focused; identifies anti-patterns in popular agent harnesses. Strongly recommended companion read for anyone shipping agents to production.
  Microsoft Security Blog

AI Security

• ⚠️🛡 Anthropic — Project Glasswing update: 10,000+ critical bugs found across ~50 partners (5/22)
  Anthropic published the second Glasswing update: Claude Mythos Preview has been used with ~50 partner organizations to find 10,000+ high- or critical-severity vulnerabilities in systemically-important software. Cloudflare reported ~2,000 bugs (400 high/critical) with fewer false positives than human-led testing; Mozilla identified and fixed 271 vulns in Firefox 150 during Mythos testing. Anthropic committing $100M in Mythos usage credits + $4M in donations to OSS-security orgs. Public Claude Security beta has patched 2,100+ vulns in three weeks. Trend confirmation: AI-assisted code audit is now meaningfully outperforming the human-only baseline for breadth on commodity vulnerabilities.
  Anthropic — Glasswing initial update · Benzinga · SiliconANGLE — Claude Security public beta · Anthropic — Claude Mythos Preview

• ⚠️🛡 arXiv 2605.03378 — ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection (new May 2026 paper)
  Introduces AgentLure, a benchmark of context-dependent agent tasks paired with context-aware prompt-injection attacks across 4 agent domains × 8 attack vectors. Proposes ARGUS, which enforces provenance-aware decision auditing on the agent by constructing an influence-provenance graph to track how untrusted context propagates into decisions. The result that matters: state-of-the-art defenses still get popped at >85% success rate by adaptive attacks; <50% mitigation against sophisticated adaptive injection. Treat any non-provenance-aware agent defense as a speed-bump, not a wall.
  arXiv 2605.03378

• 🛡 HiddenLayer 2026 AI Threat Landscape Report — agentic AI now the dominant attack surface (released earlier in May, still defining the conversation) Headline finding: Public model/code-repository malware is , but through AI in the past 12 months. The IPI-as-control-flow finding (last week's brief) plus this survey: budget AI-security tooling for .

Threat Intelligence

• 🔥 CISA contractor (Nightwing) leak — 844 MB of internal CISA secrets, AWS GovCloud admin keys exposed for ~6 months
  Krebs and GitGuardian disclosed on 5/15 that a CISA contractor maintained a public GitHub repo named "Private-CISA" that contained 844 MB of internal CISA assets: AWS GovCloud access keys with admin privileges, plaintext credentials in CSV (one literally named importantAWStokens), CISA "Landing Zone DevSecOps" environment passwords, Kubernetes manifests, GitHub Actions workflows, internal docs. The contractor disabled GitHub's built-in push-protection scanning, so it was published with secrets in cleartext. Repo had been live since 2025-11-13. Worse: the exposed AWS keys remained valid for 48 hours after takedown. Bipartisan House Homeland Dems are demanding a briefing. Connect this with M-Trends 2026's prior compromise finding (3rd most common initial-access vector) and assume credential exposure becomes a recurring loss-vector for understaffed federal teams.
  Krebs · CSO Online · eSecurity Planet · CyberInsider

• Check Point / KELA / Ransom-ISAC — "The Gentlemen" RaaS internal data leak (analysis continues this week)
  Follow-on coverage of the 5/5 backend breach of "The Gentlemen" RaaS group: leaked chats, affiliate rosters, ransom-negotiation transcripts, EDR-killer discussions, and server credentials. Roles separated: zeta88/hastalamuerte (admin/operator), plus active personas Kunder, qbit, JeLLy, Protagor, Bl0ck, Wick, quant, donpakto, mAst3r. Affiliate split: 90/10 in favor of the affiliate — aggressive, designed to siphon experienced operators from competing RaaS programs. Check Point's analysis (5/22) documents how the group industrialized victim VPN access, push-payload C2, and EDR neutralization — useful for blue-team simulation development.
  Check Point Research — "Thus Spoke The Gentlemen" · · ·

Ransomware Today

Active leak-site posting on 5/22–5/23 (RansomLook + ransomware.live observations):

• ShinyHunters— Charter Communications, Inc.(US telecom), Baker Distributing Company(US HVAC distribution); also continuing victim drops on its dedicated leak site
• Titan— 9 posts on 5/23 (mid-sized victim cluster)
• Multiple groups, individual posts— University of Valencia (5/23, ES, education watchlist sector:education), Mopas Online Supermarket (5/23, retail), Bank Negara Indonesia (5/22, watchlist sector:financial), A-Sonic Logistics (5/22, logistics), Alkaloid AD Skopje (5/22, pharmaceutical / healthcare-adjacent ), ConsulTIC (5/22, IT consulting), G. Theodor Freese GmbH (5/22, maritime/shipping watchlist sector:shipping), BMJ Paperpack, Semgrep, Cablematic Dos Mil SLU, Mecanizados y Montajes Aeronáuticos (aerospace)

Most-active groups this week: ShinyHunters, Titan, Akira, Qilin (REDBIKE/AGENDA), The Gentlemen (despite the internal leak — affiliates still posting).

⚠️ Watchlist hits today: education (University of Valencia), financial (Bank Negara Indonesia), shipping (G. Theodor Freese), healthcare-adjacent (Alkaloid AD Skopje pharmaceutical).

Full table + watchlist hits: intel/ransomware/daily/2026-05-24.html

Ransomware.live · RansomLook recent posts · Resecurity — ShinyHunters DLS analysis

---

AI Frontier

OpenAI

• C2PA + SynthID watermarks live on every ChatGPT/Codex/API image since 5/19— invisible-watermark + provenance metadata survives screenshots, compression, format conversion. Public verification tool at openai.com/verify. Direct counter to deepfake disinfo pipelines; start auditing your inbound-image classification for whether C2PA-checked is now a sane gating signal for low-stakes deepfake detection. OpenAI — Advancing content provenance· Releasebot — OpenAI
• ChatGPT Business — Codex appshots, GA goal mode, browser-annotation tooling, remote locked computer use, shared plugins, admin adoption analytics— Codex is now a meaningfully different product surface vs. 1–2 weeks ago for enterprise admins. Releasebot — OpenAI
• ChatGPT for Personal Finance (Plaid-backed, US Pro preview, 12,000+ institutions)— continued rollout. TechCrunch

Anthropic

• Project Glasswing update (5/22): 10,000+ critical bugs, ~50 partners, $100M in Mythos credits committed.See AI Security section above. Anthropic — Glasswing initial update
• Claude Security public beta— Claude Opus 4.7 patched 2,100+ vulnerabilities in first 3 weeks; new cyber-verification tools for eligible security teams. SiliconANGLE
• Claude on SAP Business AI Platform (SAP Sapphire, 5/12–5/13)— Claude as primary reasoning/agentic capability across S/4HANA, SuccessFactors, Ariba via Model Context Protocol. Treasury-manager → CFO-briefing demo. SAP News Center· ERP Today — Claude + Joule + MCP
• Claude for Small Business (5/13)— packaged QuickBooks / PayPal / HubSpot / Canva / DocuSign / Google Workspace / M365 connectors with ready-to-run workflows. InfoWorld
• Pricing change (effective 6/15)— programmatic Claude usage separated from standard chat subscription limits; Pro adds $20 credits, Max 5x +$100, Max 20x +$200.
• Talent — Andrej Karpathy joins Anthropic(focus: pre-training research). Reported May 2026.

Google DeepMind / AI

• Gemini 3.5 Flash released (5/19 at I/O 2026)— outperforms Gemini 3.1 Pro on coding/agentic benchmarks; 4× faster output tokens/secvs. other frontier models. Available in Gemini app, AI Mode in Search, Antigravity, Gemini API, Gemini Enterprise. Gemini 3.5 Pro internal, broader rollout next month. Google blog — Gemini 3.5· CNBC
• Gemini Ultra cut to $200/mo + new Developer tier at $100/mo.Heygotrade — I/O 2026 recap
• Co-Scientist (Nature paper, 5/19)— multi-agent AI partner that iteratively generates, debates, and evolves novel hypotheses for complex scientific problems. Independent CBRN safety evaluations, custom safety classifiers to flag unethical research goals and unsafe outputs. Notable as a published-in-Nature precedent for safety-engineering on agentic systems. DeepMind — Co-Scientist
• C2PA / SynthID detection coming natively to Google Search and Chrome (announced at I/O 2026, 5/19).Coordinated with OpenAI's same-day announcement; treat as the start of platform-level provenance UX.
• DeepMind hires 20+ Contextual AI researchers ($80–90M licensing deal)— agent-research talent stockpile.

🛡 = security-relevant. Spinoff archive: intel/ai-frontier/security/.

---

Chinese Community Highlights

• 网安早报【20260522】(信息安全知识库) — multi-source roundup: Microsoft BitLocker bypass tool YellowKey (CVE-2026-45585)disclosed; NGINX 0-day "nginx-poolslip"reported (unauthenticated RCE — details circulating, no advisory link yet, treat as developing); Android adbd zero-click follow-up coverage on CVE-2026-0073 still trending in FreeBuf/先知 weekly. Drupal CVE-2026-9082 receiving rapid Chinese-community technical writeups (PostgreSQL backends). 信息安全知识库
• FreeBuf coverage continues: 5月份 Top 5 high-impact items in Chinese-community summaries: Pwn2Own Berlin 47-0day haul, Laravel-Lang supply chain, GitHub/Nx Console breach, Microsoft Exchange OWA 0-day mitigation gaps, Apple iOS 26.5 / macOS Tahoe 26.5 batch patch (80+ CVEs). FreeBuf — 漏洞

---

Failed Sources

The cowork-egress allowlist still blocks direct RSS / HTML fetches (only *.anthropic.com and package registries are reachable from the workspace). Today's brief was assembled from WebSearch summaries with linked primary sources. Sources currently unreachable directly:

• cisa.gov(KEV feed)
• msrc.microsoft.com
• portswigger.net
• googleprojectzero.blogspot.com
• feeds.feedburner.com(The Hacker News)
• bleepingcomputer.com
• krebsonsecurity.com
• cloud.google.com(Mandiant)
• thedfirreport.com
• freebuf.com, xz.aliyun.com, api.anquanke.com
• openai.com, deepmind.google, blog.google
• www.ransomlook.io
• arxiv.org

Recommended fix (same as 5/23 brief): add the above hostnames to the workspace egress allowlist (Settings → Capabilities).

---

Sources used: see intel/sources.yaml