Rosetta Daily · May 26, 2026

Auto-generated · 29 sources configured (WebSearch mode — feed allowlist still in effect) · 16 items selected
Window: past 24 hours (2026-05-25 → 2026-05-26)

In-the-Wild / Actively Exploited

• 🔴🔥⚠️ CVE-2026-46333 "ssh-keysign-pwn" — 9-year-old Linux kernel ptrace exit-race to root (Qualys, public exploit out)
  Qualys disclosed a logic flaw in __ptrace_may_access() that has been in mainline Linux since v4.10-rc1 (November 2016). Between the moment a task's mm is detached and the moment its fd table is closed, the ptrace access check skips its dumpable safeguard because mm is already NULL. An unprivileged local process can ride that window with pidfd_getfd(2) (Linux 5.6+) and steal open file descriptors out of an exiting privileged process — /etc/shadow, SSH host private keys, a dbus connection to systemd — giving immediate root on default installs of RHEL, SUSE, Debian, Fedora, AlmaLinux, CloudLinux. Working exploits are already public. Patch now or set kernel.yama.ptrace_scope=2 as interim mitigation; that closes the public exploit path.
  Qualys blog · The Hacker News · CloudLinux mitigation guide

• 🔴🔥⚠️ Ghost CMS CVE-2026-26980 — unauth blind SQLi exploited at scale, 700+ sites turned into ClickFix droppers (Bleeping/XLab/SecurityWeek)
  XLab/Bleeping/SecurityWeek confirm large-scale exploitation of a pre-auth blind SQL-injection in the Ghost CMS Content API (versions 3.24.0 → 6.19.0). Attackers dump the Admin API Key from the DB, use it to inject JavaScript into articles, and serve a fake Cloudflare "verify you're human" iframe on top — a ClickFix chain that has the visitor paste a base64 command into the Run dialog, dropping a ZIP that delivers a DLL via rundll32.exe. Two distinct actors are racing each other on the same compromised sites. Confirmed victims include domains at Harvard, Oxford, Auburn, and DuckDuckGo. Patch to Ghost ≥ 6.19.1.
  Bleeping Computer · XLab Qianxin technical writeup · SecurityWeek · The Hacker News

• 🔴🔥 CVE-2026-9082 — Drupal Core PostgreSQL SQLi added to CISA KEV (5/22); federal deadline 2026-05-27 (tomorrow)
  CISA added the Drupal Core SQL-injection (PostgreSQL backend) to KEV on 5/22 after confirmed in-the-wild exploitation. Tenable, Imperva and Cloudflare are now reporting 30k+ attack attempts across 9k+ distinct Drupal+PG sites in 70+ countries. Patch coverage remains uneven — only ~55% of managed-hosting customer sites are on a fixed release. Federal civilian agencies must remediate by 2026-05-27.
  Qualys ThreatPROTECT · CISA KEV catalog · Tenable

Critical Vulnerabilities & Advisories

• ⚠️ YellowKey BitLocker bypass (CVE-2026-45585, no patch, mitigation-only)
  Eclypsium and Microsoft jointly published mitigation guidance for YellowKey, a physical-access BitLocker bypass that requires no special tooling. Drop an FsTx directory on a USB drive, plug it into a powered-off Windows machine with BitLocker, force a reboot into WinRE, then hold CTRL — Transactional NTFS replays delete winpeshl.ini and you land in an unrestricted command prompt with the volume already unlocked. Affects Windows 11 24H2 / 25H2 / 26H1 and Windows Server 2025. Microsoft is "issuing this CVE to provide mitigation guidance" rather than a patch. Mitigation: switch BitLocker protector from TPM-only → TPM+PIN, or remove autofstx.exe from the Session Manager BootExecute value.
  Eclypsium technical writeup · The Hacker News · SecurityWeek · Help Net Security

• Verizon 2026 DBIR drops — vulnerability exploitation overtakes stolen credentials as #1 initial-access vector (first time in 19 years)
  Verizon's 2026 DBIR (released 5/20) reports vulnerability exploitation is now 31% of all initial access, up from 20% — a 55% YoY rise. Stolen credentials drop to second for the first time in the report's history. The supporting numbers are ugly: only 26% of CISA KEV vulnerabilities were fully remediated in the polled population (vs 38% the year prior), median patch-time has stretched from 32 → 43 days, and the recorded vulnerability instances Verizon tracks went from 68.7M in 2022 to 527.3M in 2025 — an ~8x increase in 3 years. The structural story: defenders are losing the patch race as AI-assisted discovery (Glasswing, GPT-5.5-Cyber) keeps compressing the disclosure-to-exploit window.
  Help Net Security · watchTowr analysis · Verizon DBIR portal ·

Vendor Advisories

• Microsoft Exchange CVE-2026-42897 — KEV deadline 5/29 (Friday), still mitigation-only
  Status update on the OWA XSS/spoofing 0-day: no permanent code patch, automatic mitigation M2.1.x continues to roll through Emergency Mitigation Service. The CISA KEV deadline is 2026-05-29 — three days out. Verify M2.1.x application with the TechCommunity verification commands; Exchange 2016/2019 patches will only ship to Period 2 ESU customers (Period 1 ended in April 2026).
  MSRC · Microsoft TechCommunity · SecurityWeek

• Cisco SD-WAN CVE-2026-20182 (CVSS 10.0) — sixth Cisco SD-WAN 0-day this year; CISA KEV addition + UAT-8616 activity continues
  Cisco's Catalyst SD-WAN Controller/Manager pre-auth bypass landed in KEV on 5/14 and exploitation by UAT-8616 is ongoing — the attacker chains the bypass with CVE-2022-20775 via a software-version downgrade to escalate to root, inject SSH keys into vmanage-admin, and pivot via NETCONF on TCP/830. This is the sixth exploited SD-WAN bug Cisco has shipped this year — concerning for anyone whose SD-WAN appears in shodan/zoomeye scans. Fixed in 20.9.9.1 / 20.12.5.4+ / 20.15.4.4+ / 20.18.2.2 / 26.1.1.1.
  Cisco advisory · Rapid7 technical analysis · Talos exploitation tracking · SecurityWeek

Web Security Research

• Project Zero — full 0-click root chain for Pixel 10 ("When a Door Closes, a Window Opens"), 5/13
  Seth Jenkins and Jann Horn published a complete 0-click chain for Pixel 10 going from a malicious audio message to kernel arbitrary read/write in roughly a day of effort. First link is CVE-2025-54957 in the Dolby Unified Decoder (UDC) — incoming audio in Google Messages is transcribed before the user ever opens the message, so the attack surface is fully unattended. Second link is a new bug in the Pixel 10's /dev/vpu driver (Chips&Media Wave677DV on Tensor G5) maintained by the same team behind the previously-broken BigWave block; Jenkins and Horn found a critical mmap-handler flaw in two hours. Pixel patches landed Jan/Feb 2026; the writeup is now public. Required reading for anyone hardening Android attack surface, especially around messaging-stack codecs and vendor kernel drivers.
  Project Zero — Pixel 10 0-click · CyberSecurityNews summary

• TanStack supply-chain saga continues — Unit 42 / StepSecurity / Wiz / Akamai converge on "Mini Shai-Hulud" (TeamPCP), 600+ malicious packages, valid SLSA provenance
  This week's Mini Shai-Hulud activity is now reconstructed in detail: on 5/11 TeamPCP pivoted through TanStack's GitHub Actions CI to publish 84 malicious artifacts across 42 @tanstack/* packages within six minutes — @tanstack/react-router alone gets 12.7M weekly downloads. 5/19 brought a second wave riding the compromised atool npm maintainer account: 639 malicious package versions across 323 packages in ~1 hour, the largest single-hour count of any Shai-Hulud wave. Notable firsts: (1) the first npm worm to produce validly-attested packages with real SLSA provenance, and (2) cross-ecosystem propagation into PyPI. OpenAI has now confirmed two of its employee devices were compromised in the 5/11 wave with internal repo access; iOS/macOS/Windows code-signing certificates were rotated as precaution.
  Unit 42 npm landscape tracker (5/21) · StepSecurity reconstruction · Wiz · ·

AI Security

• ⚠️ Anthropic Project Glasswing — formal initial update (5/22) + extended partner roster (5/26): 10,000+ critical bugs, Cloudflare/Mozilla case studies, wolfSSL CVE-2026-5194
  Anthropic posted its first formal Glasswing update on 5/22; the program has now expanded to additional partners as of 5/26. Headline metrics from the past month with Claude Mythos Preview: ~50 partners surfaced 10,000+ high/critical-severity findings across systemically-important codebases. Specific case studies disclosed for the first time:

  • Cloudflare: 2,000 bugs identified in core systems, 400 high/critical, with a false-positive rate Cloudflare's team rates "better than human testers."
  • Mozilla: 271 vulnerabilitiesidentified and fixed in Firefox 150 testing; an explicit jump in efficacy over Claude Opus 4.6 runs.
  • wolfSSL: a certificate-forgery flaw (CVE-2026-5194) was found and a working exploit constructed by Mythos — would let an attacker host a perfectly-legitimate-looking fake bank/email site under wolfSSL TLS. Patched.
    Anthropic explicitly states: "the bottleneck is no longer finding bugs — it is fixing them fast enough." Average patch time for a Mythos-discovered high/critical: two weeks. Public release of Mythos remains paused — "no company, including us, has developed safeguards reliable enough" against misuse.
    Project Glasswing initial update· Help Net Security· Dataconomy· gHacks

• ⚠️ Unit 42 documents first large-scale indirect prompt-injection campaigns in the wild (March 2026 retrospective; new May data)
  Updated tracking from Unit 42: indirect prompt injection has crossed from research curiosity into production-attack rotation. New data points: and observed on multiple live commercial platforms; OWASP LLM Top 10 keeps it ranked #1 into 2026. The most striking real-world case is (GitHub Copilot, CVSS 9.6) — hidden prompt-injection in PR descriptions yielded remote code execution. With Google's 32% YoY increase in injection payloads in public web content + Mandiant's PROMPTFLUX/PROMPTSTEAL malware-meets-LLM finding, the convergence is now clearly: . · ·

Threat Intelligence

• DFIR Report flash alert (5/11) — full reconstruction of "EtherRAT + TukTuk → The Gentlemen" intrusion
  The DFIR Report's flash analysis (now broadly cited in the past 24 hours) walks through an April intrusion where a malicious MSI masquerading as a Sysinternals tool dropped EtherRAT, the actor then deployed TukTuk — an AI-generated malware framework — followed by GoTo Resolve RMM for persistence and cloud exfiltration. The Gentlemen ransomware deployed three days in, with the actor disabling Defender, adding AV exclusions, stopping VMs, deleting shadow copies, wiping event logs, then pushing the encryptor domain-wide via malicious GPO + scheduled tasks staged in SYSVOL/NETLOGON. Same TTP pattern as the 5/22 Check Point co-report — the GPO-as-deployment-vector pattern is now consolidated across multiple Gentlemen affiliates.
  DFIR Report Flash Alert · Check Point co-research

• Instructure / Canvas ShinyHunters incident — $10M rumored ransom paid, 3.65TB / 275M records, breach analyses converging
  Aftermath analyses (Bitdefender, Reed Smith, Rescana, Protos Labs) align on the technical story: ShinyHunters abused the Free-For-Teacher (FFT) account program — accounts created without institutional verification — to obtain authenticated access, then exfiltrated 3.65 TB across an estimated 275M users from 8,809 institutions globally. Instructure announced a ransom agreement on 5/11; unconfirmed reporting puts the payment at ~$10M. The action item for higher-ed CISOs is concrete: audit any tenant connected to an FFT account and rotate Canvas API tokens; review what student PII could be re-derived from previously-leaked data even after Instructure's claim of data destruction.
  The Hacker News (ransom agreement) · Bitdefender technical advisory · Reed Smith higher-ed action items · Inside Higher Ed

Chinese-Language Community Picks

• FreeBuf / Yijing Lab and others: continued coverage of CVE-2026-46333, a nine-year-old Linux kernel ptrace bug, Ghost CMS CVE-2026-26980 large-scale ClickFix poisoning, CVE-2026-9082 Drupal SQLi added to KEV, and cPanel's high-severity patches CVE-2026-29201/29202/29203; English-sphere topics such as the YellowKey BitLocker physical bypass and the Pixel 10 Project Zero 0-click chain were also picked up in the Chinese-language community.
• Checkmarx's official Jenkins AST pluginwas published on the Jenkins Marketplace in a maliciously tampered version (2026.5.09); the incident points to TeamPCP— the same crew behind npm Mini Shai-Hulud — and discussion of CI/CD supply chains has heated up markedly in the Chinese-language sphere.
• Drupal CVE-2026-9082set off domestic site operators: PostgreSQL backends account for a high share of Drupal deployments in China, and the 5/27 federal KEV deadlinealso implies a second wave of domestic coverage.
  FreeBuf· Yijing Lab daily sample

Ransomware Today

• ~35–45 new DLS posts in last 24hacross ~91 active leak sites. Most active in 24h(per public aggregators): Qilin, Akira, The Gentlemen, DragonForce / Devman, Nova, NightSpire. DragonForce activity stands out — multiple new victims (allianceadjustment.com, xtr-global.de, saver.nl, vegfresh.com, ggroupcpas.com). The Gentlemen affiliates continued posting (ACAM Systemautomation GmbH); Qilin healthcare/legal targeting continues (Alpha Health Care, Alpert Slobin & Rubenstein); Akira added Buffalo Niagara Convention Center. Watchlist hits today: Qilin × healthcare/legal, Akira × manufacturing/hospitality, The Gentlemen affiliates × mixed. Quarterly context: Qilin/Akira/Gentlemen/LockBit hold ~41% of all 2026 victims — Qilin alone outpaces the bottom 50 groups combined.
• Full per-victim breakdown → intel/ransomware/daily/2026-05-26.html

---

AI Frontier

OpenAI

• OpenAI × Folha de S.Paulo / Grupo UOL Brazilian-media partnership (5/25)— first Brazilian-media deal, content summaries surfaced to 900M ChatGPT weekly active users. OpenAI
• Codex on Mac, even when the screen is locked (5/22–5/24)— Codex desktop agent now operates Mac apps when display is off and locked, controllable from iPhone/Android via ChatGPT mobile. Adds short-lived authorization, covered displays, relock on local input, manual-unlock fallback. MacRumors· Macworld
• OpenAI confidential IPO filing prep (reported 5/20)— drafts in preparation with Goldman Sachs / Morgan Stanley. CNBC
• GPT-5.5-Cyber broader rollout via Trusted Access for Cyber (5/7 → ongoing)— more permissive cyber model, gated to vetted critical-infrastructure defenders. UK AISI evaluation published. OpenAI announcement· Help Net Security· AISI evaluation
• OpenAI confirms 2 employee devices compromised in TanStack supply-chain attack (5/11 wave)— internal repos accessed, code-signing certificates rotated. Phoenix Security writeup

Anthropic

• Project Glasswing — Initial Update (5/22) + expansion to more partners (5/26)— 10,000+ critical bugs in 30 days; Cloudflare 2,000 / Mozilla 271 / wolfSSL CVE-2026-5194 case studies. See AI Security above.Glasswing initial update· Benzinga (partner expansion)
• Code with Claude — London (5/19–5/21), Tokyo (6/5–6/6)— developer conference series; new Managed Agents capabilities (dreaming, multi-agent orchestration, outcomes, webhooks). MIT Technology Review
• Brief Opus 4.7 elevated-error incident (5/25)— resolved same day. Claude status
• Claude ad-free commitment statement— Anthropic restates that ads are incompatible with assistant trust; plan to expand access without ads.

Google DeepMind / AI

• Google I/O 2026 recap continues— Gemini Spark (consumer tier), Gemini 3.5 family with 3.5 Flash GA, 3.5 Pro internal, Ultra subscription cut from $250 → $200/mo, new $100/mo Developer tier. Gemini MAU hits 900M (2x YoY). Tom's Guide live blog· explainx.ai recap
• Big Sleep counter-discovery prevents AI-developed 0-day mass-exploitation attempt (5/11)— first publicly-documented case of an AI-discovered defensive intervention against an AI-developed offensive 0-day. See Threat Intel above.Google blog
• GTIG — AI-Vulnerability-Exploitation report— first comprehensive vendor framing of AI-augmented exploit dev + agentic operations. Report
• Project Zero — Pixel 10 0-click writeup (5/13)— full chain disclosed publicly, see Web Security Research above. Project Zero

---

Failed Sources

• RansomLook API + RSS— still blocked by sandbox egress allowlist (HTTP 403 from proxy / not in WebFetch provenance set). Ransomware section uses WebSearch aggregation of secondary sources; full per-victim accuracy not guaranteed.
• Chinese sources (FreeBuf, 安全客, 先知社区)— direct fetch not allowed in current sandbox; coverage in this brief is based on WebSearch summaries.

---

Sources used: see intel/sources.yaml