Rosetta Daily · May 31, 2026

Auto-generated · 29 sources configured (WebSearch mode — feed allowlist still in effect) · 17 items selected
Window: past ~24–48 hours (2026-05-29 → 2026-05-31), with carry-over context from the holiday weekend

In-the-Wild / Actively Exploited

• 🔴🔥⚠️ LiteSpeed cPanel Plugin CVE-2026-48172 (CVSS 10.0) — run scripts as root, added to CISA KEV (5/26), mass scanning underway
  A maximum-severity incorrect-privilege-assignment flaw in the LiteSpeed User-End cPanel Plugin lets any cPanel user (including a compromised low-priv account) call the lsws.redisAble function to execute arbitrary scripts as root. Affects all plugin versions 2.3 → 2.4.4. CISA added it to KEV on 2026-05-26 with a federal remediation deadline of 2026-05-29 (now passed). Broad opportunistic exploitation is being reported — automated scanners are racing to plant backdoors and deploy malware on shared-hosting fleets. Fixed in plugin 2.4.5; upgrade to LiteSpeed WHM Plugin 5.3.1.0 (bundled with cPanel plugin v2.4.7+).
  The Hacker News · SecurityWeek · CyberSecurityNews · CyCognito

• 🔴🔥⚠️ Marimo CVE-2026-39987 — pre-auth RCE, attacker then drove an LLM agent for live post-exploitation (THN, 5/29)
  A critical pre-authenticated RCE in Marimo notebooks (all versions ≤ 0.20.4) is being exploited against internet-reachable instances. What makes this one notable: after initial access on 5/10, the actor deployed an LLM agent to dynamically generate post-compromise actions rather than running a static script. The agent harvested two cloud credentials from env files, replayed them through a fanned-out egress pool to pull an SSH private key from AWS Secrets Manager, then drove eight short SSH sessions against a bastion and exfiltrated an internal PostgreSQL schema + full contents in under two minutes. One of the cleanest public cases yet of "LLM agent as the lateral-movement operator." Fixed in 0.23.0 — audit for public instances and rotate creds/keys.
  The Hacker News · GBHackers · CyberSecurityNews

• 🔥 CISA adds 3 to KEV (5/27) — all supply-chain / embedded-malicious-code: Daemon Tools Lite, TanStack, Nx Console
  CISA's 5/27 batch is unusual in that all three are embedded-malicious-code entries rather than memory-safety bugs: CVE-2026-8398 (Daemon Tools Lite), CVE-2026-45321 (TanStack), and CVE-2026-48027 (Nx Console). The TanStack and Nx Console entries continue the TeamPCP / Mini Shai-Hulud supply-chain thread that has dominated the last two weeks — the poison is now formally recognized at the federal-mandate level. Treat any environment that pulled affected @tanstack/* or Nx Console artifacts as suspect; rotate tokens.
  CISA alert (5/27) · CISA KEV catalog

Critical Vulnerabilities & Advisories

• 🔴⚠️ NGINX Rift CVE-2026-42945 (CVSS 9.2) — 18-year-old heap overflow, exploited since 5/16, PoC public
  A heap-based buffer overflow in nginx's ngx_http_rewrite_module — present since 0.6.27 (≈18 years) — lets an unauthenticated attacker crash a worker or, on hosts with ASLR disabled, achieve RCE with a single crafted HTTP request. Root cause is a size-mismatch between two passes over the rewrite replacement string (unnamed PCRE captures + ? + a following rewrite/if/set). Affects nginx OSS 0.6.27 → 1.30.0 and nginx Plus R32 → R36. VulnCheck canaries flagged exploitation attempts on 5/16, three days after disclosure; a public exploit is on GitHub. Patch and audit rewrite rules.
  Help Net Security (exploited) · XM Cyber (chain) · Picus · NVD

• 🔴⚠️ "Dirty Frag" CVE-2026-43284 / CVE-2026-43500 — deterministic Linux kernel LPE chain, in-the-wild post-compromise use
  A pair of chained Linux kernel networking flaws — xfrm-ESP page-cache write (esp4/esp6, CVE-2026-43284) providing a 4-byte STORE primitive, and RxRPC page-cache write (CVE-2026-43500) providing namespace-creation — together yield root on nearly all major distros (Ubuntu, RHEL, CentOS Stream, AlmaLinux, Fedora, openSUSE, OpenShift). Unlike DirtyPipe it is a deterministic logic flaw with very high success and minimal panic risk. Microsoft's Security Blog flags active post-compromise use to expand footholds. CVE-2026-43284 patched 5/8; ensure the full chain is closed (RxRPC patch followed) and apply vendor/KernelCare live patches where reboot isn't possible.
  Microsoft Security Blog · Tenable FAQ · Red Hat RHSB-2026-003 ·

Vendor Advisories

• Microsoft Exchange CVE-2026-42897 — on-prem exploited via crafted email; KEV deadline 5/29 has passed
  Fresh reporting confirms the OWA XSS/spoofing 0-day (CVSS 8.1) is being exploited against on-prem Exchange via a crafted email. The CISA KEV remediation deadline was 2026-05-29 — any FCEB or enterprise still un-mitigated is now out of compliance and actively targeted. Verify the M2.1.x Emergency Mitigation Service rollout landed; Exchange 2016/2019 fixes ship only to Period 2 ESU customers.
  The Hacker News · SecurityWeek · MSRC

• Fortinet FortiClient EMS CVE-2026-35616 (CVSS 9.1) — pre-auth API bypass, exploited to drop credential stealers
  A critical pre-authentication API access-bypass in FortiClient Endpoint Management Server remains in active exploitation through May, used to deliver credential-stealing malware. Internet-exposed EMS is a high-value pivot into managed-endpoint fleets — patch and restrict management-plane exposure.
  The Hacker News

Web Security Research

• arXiv 2605.17634 — "AI Agents May Always Fall for Prompt Injections"
  A timely formalization arguing the prevailing defense paradigm (data/instruction separation) may be fundamentally insufficient: it both misses attacks that operate through contextual manipulation and degrades legitimate contextual behavior. Pairs directly with the Marimo + LLM-agent case above — if the agent is the attacker's hands, input-trust boundaries are the whole ballgame.
  arXiv

• PortSwigger Research — custom scan checks + Top 10 Web Hacking Techniques of 2025
  Quieter research week. PortSwigger's 5/1 piece on turning practitioner intuition into scalable custom scan checks is worth a read for AppSec teams standardizing detection; the annual Top 10 Web Hacking Techniques of 2025 roundup remains the best single index of the year's novel web research.
  Custom scan checks · Top 10 of 2025

AI Security

• ⚠️ Marimo + LLM-agent post-exploitation (cross-ref) — the "LLM agent as operator" pattern goes operational
  See In-the-Wild above. The significance for AI-security teams: this is no longer LLMs writing malware offline — the model is inside the kill chain making decisions in real time (analyze output → choose next pivot). Detection signal: bursty, fanned-out egress + short serial SSH sessions with non-human pacing.
  The Hacker News

• ⚠️ Microsoft — "When prompts become shells: RCE vulnerabilities in AI agent frameworks" (5/7)
  Microsoft's research walks through how, once an agent is wired to tools, prompt injection stops being a content problem and becomes a code-execution primitive. Concrete framework-level RCE patterns are documented. Combined with OWASP keeping prompt injection at LLM01, the guidance converges: treat any tool-enabled agent's input surface as an RCE attack surface.
  Microsoft Security Blog · Securance (OWASP #1)

Threat Intelligence

• Unit 42 — 2026 Global Incident Response Report: attacks 4× faster, exfil < 1 hour, identity in ~90% of cases
  Headline trends: AI is a force multiplier compressing access-to-impact; identity weaknesses feature in nearly 90% of investigations; supply-chain risk has expanded from vulnerable code to abuse of trusted connectivity (SaaS integrations, vendor tools, app dependencies). The throughline with this week's items (TanStack/Nx in KEV, Marimo LLM-agent, exfil in under two minutes) is unmistakable — speed and trust-abuse are the story.
  Unit 42 IR report (RH-ISAC) · Unit 42

• Unit 42 — Screening Serpens (UNC1549 / Iranian "Dream Job") espionage, Feb–Apr 2026
  Unit 42 tracks continued Iran-nexus activity by Screening Serpens, with operational timing aligned to a regional conflict that began 2026-02-28. Aerospace/defense lures and job-themed social engineering remain the signature. Relevant for defense-industrial-base and aerospace orgs reviewing inbound recruiter contact.
  Unit 42

• ShinyHunters leaks ~42M Charter records (stolen April, leaked late May)
  ShinyHunters published over 42 million records allegedly taken from Charter in April, the latest in the group's sustained extortion run (cf. the Instructure/Canvas incident covered 5/26). Telecom/ISP customer PII at this scale fuels downstream SIM-swap and phishing — affected-population monitoring and credential-reset campaigns are the practical response.
  BreachSense · SharkStriker (May breaches)

Chinese Community Picks

• FreeBuf / 蚁景网安: this week's notable high-severity items in the Chinese feeds — Apache Flink CVE-2026-35194(SQL injection in the codegen engine → RCE in distributed data-processing), n8n CVE-2026-44789 → 44791(a chainable trio across HTTP/Git/XML nodes leading to RCE), and Android adbd CVE-2026-0073(a zero-click flaw giving a nearby attacker full shell without interaction). English-circle topics (LiteSpeed cPanel, NGINX Rift, Dirty Frag) are all being tracked in parallel.
• The TeamPCP / Mini Shai-Huludsupply-chain saga — now reinforced by the 5/27 KEV additions (TanStack, Nx Console) — continues to drive heavy CI/CD-security discussion domestically.
  FreeBuf vuln channel· 蚁景网安日报样例

Ransomware Today

• ~30–45 new DLS posts in the last 24–48h across ~91 active leak sites(above the prior 84 peak). Most active (late-May aggregates): Qilin, The Gentlemen, Akira, followed by Inc Ransom, Clop, Play, NightSpire, DragonForce, Sinobi. Qilinholds #1 for a third consecutive quarter (~338 victims/quarter, widest geo footprint at 74 countries); Akirais #2 with a heavy US concentration (~57% of claims). Fresh Akiravictims discovered 2026-05-28include GS Yuasa Lithium Power, General Doors, Alpine Aerotech, Maschinen-Stockert. Watchlist hits today: Akira × manufacturing / energy(GS Yuasa = battery/energy + manufacturing), Qilin × healthcare/legal continuation.
• Full per-victim breakdown + watchlist hits → intel/ransomware/daily/2026-05-31.html

---

AI Frontier

OpenAI

• Rosalind Biodefense (5/29)— expands trusted access to GPT-Rosalindfor vetted developers and U.S. government partners working on biodefense, public health, and pandemic preparedness. A dual-use, gated-access model in the spirit of the GPT-5.5-Cyber program. OpenAI News
• Content provenance push (5/19)— multi-layered provenance via C2PA conformance + durable cross-platform SynthIDwatermarking on images (partnership with Google), plus a public verification tool preview. Releasebot
• GPT-5.5 Instant default (5/5)— new ChatGPT default: 52.5% fewer hallucinated claims vs GPT-5.3 Instant on high-stakes prompts. TechCrunch

Anthropic

• Claude Opus 4.8 (5/28)— stronger coding, agentic skills, reasoning, and practical knowledge-work vs Opus 4.7; Claude Code ships it with high-effort defaults, dynamic workflows, faster Fast mode, and broader agent/browser/plugin/MCP support plus tightened safety checks. Releasebot
• Series H — $65B raised at $965B post-money (5/28)— led by Altimeter, Dragoneer, Greenoaks, Sequoia; run-rate revenue crossed ~$47B earlier in May. Anthropic
• Managed Agents — sandbox you control + private MCP— agents can now execute tools and reach services entirely within enterprise-defined boundaries. Releasebot

Google DeepMind / AI

• Gemini 3.5 Flash + Gemini Omni— 3.5 Flash targets frontier agentic/coding at Flash speed (beats 3.1 Pro on key benchmarks); Gemini Omniis an any-input→any-output multimodal model, starting with video. Google Cloud (I/O 26)
• CodeMender into Agent Platform— DeepMind's code-security agent autonomously finds vulns, proposes/tests fixes, and (with approval) patches across dependent systems. DeepMind
• Big Sleep— continues as the first AI agent credited with directly foiling an in-the-wild exploitation attempt (cf. the 5/11 AI-developed 2FA-bypass 0-day). Google Cloud blog

🛡 = security-relevant

---

Failed Sources

• RansomLook API + RSS— still blocked by the sandbox egress allowlist (host not permitted / not in WebFetch provenance set). The ransomware section uses WebSearch aggregation of secondary trackers (PurpleOps, ransomware.live, Check Point Q1-2026); per-victim accuracy is best-effort.
• Direct RSS/Atom feeds (CISA, The Hacker News, Bleeping, PortSwigger, Mandiant, etc.)— direct fetch blocked by egress allowlist; this brief is assembled from WebSearch summaries of those same sources.
• Chinese feeds (FreeBuf, 安全客, 先知社区)— direct feed fetch not permitted; coverage based on WebSearch summaries.

---

Sources used: see intel/sources.yaml