CornicheCorp

Our business is about enterprise #DigitalTransformation #Infosec #AI #CustomerExperience #Bigdata #Cloud #Privacy #ERP 📊

[Cyber Security News @The_Cyber_News]

🛡️ Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including 29 Critical RCE Flaws

Source: https://t.co/Kwjlq3sYml

Microsoft’s May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

Unlike several recent cycles, Microsoft reports no zero‑days exploited in the wild or publicly disclosed ahead of the release, but the breadth of attack surface from DNS and Netlogon to Office and Wi‑Fi drivers means defenders cannot afford to treat this month as low risk.

#cybersecuritynews #windows #patchtuesday

[Ubuntu @ubuntu]

Canonical’s web infrastructure is under a sustained, cross-border attack and we are working to address it.

We will provide more information in our official channels as soon as we are able to.

[Cyber Security News @The_Cyber_News]

⚠️Google Gemini CLI Vulnerabilities Allow Attackers to Execute Commands on Host Systems

Source: https://t.co/b4g1rl3NHU

A critical remote code execution vulnerability in the Google Gemini CLI and its associated GitHub Action. Assigned a maximum severity score of CVSS 10.0, the flaw allowed unprivileged external attackers to execute commands directly on host systems.

This vulnerability effectively turned automated CI/CD pipelines into potential attack vectors in the supply chain. The core issue was how the Gemini CLI handled workspace trust in non-interactive environments.

#cybersecuritynews

[BleepingComputer @BleepinComputer]

Official SAP npm packages compromised to steal credentials
https://t.co/ff4ETecwk3

https://t.co/ff4ETecwk3

[Cyber Security News @The_Cyber_News]

⚠️ Linux Kernel 0-Day "Copy Fail" Roots Every Major Distribution Since 2017

Source: https://t.co/fyfuQjBYHn

A critical zero-day vulnerability in the Linux kernel has been publicly disclosed, enabling any unprivileged local user to obtain root access on virtually every major Linux distribution shipped since 2017.

Copy Fail is a straight-line logic bug not a race condition in the Linux kernel's authencesn cryptographic template, reachable via the AF_ALG socket interface combined with the splice() system call.

A single 732-byte Python script using only standard library modules achieves deterministic root on every tested distribution and architecture.

#cybersecuritynews #linux #CopyFail

[Cyber Security News @The_Cyber_News]

🚨 New VECT 2.0 Ransomware Destroys Files Over 128 KB Across Windows, Linux, & ESXi

Source: https://t.co/BJ5h0UvpTc

A newly documented ransomware strain called VECT 2.0 has drawn serious attention from the cybersecurity community for a deeply damaging flaw in its design.

Unlike typical ransomware that locks files and demands payment for decryption, VECT 2.0 permanently destroys any file larger than 128 KB, making recovery impossible even if a victim pays the ransom.

VECT Ransomware first appeared in December 2025 on a Russian-language cybercrime forum, operating as a Ransomware-as-a-Service (RaaS) program.

#cybersecuritynews

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: An AI found a Linux kernel zero-day that roots every distribution since 2017. The exploit fits in 732 bytes of Python. Patch your kernel ASAP.

The vulnerability is CVE-2026-31431, nicknamed "Copy Fail," disclosed today by Theori. It has been sitting quietly in the Linux kernel for nine years.

Most Linux privilege-escalation bugs are picky. They need a precise timing window (a "race"), or specific kernel addresses leaked from somewhere, or careful tuning per distribution. Copy Fail needs none of that. It is a straight-line logic mistake that works on the first try, every time, on every mainstream Linux box.

The attacker just needs a normal user account on the machine. From there, the script asks the kernel to do some encryption work, abuses how that work is wired up, and ends up writing 4 bytes into a memory area called the "page cache" (Linux's high-speed copy of files in RAM). Those 4 bytes can be aimed at any program the system trusts, like /usr/bin/su, the shortcut to becoming root.

Result: the next time anyone runs that program, it lets the attacker in as root.

What should worry most: the corruption never touches the file on disk. It only exists in Linux's in-memory copy of that file. If you imaged the hard drive afterwards, the on-disk file would match the official package hash exactly. Reboot the machine, or just put it under memory pressure (any normal system load that needs the RAM), and the cached copy reloads fresh from disk.

Containers do not help either. The page cache is shared across the whole host, so a process inside a container can use this bug to compromise the underlying server and reach into other tenants.

The original sin was a 2017 "in-place optimization" in a kernel crypto module called algif_aead. It was meant to make encryption slightly faster. The change broke a critical safety assumption, and nobody noticed for nine years. That bug then rode every kernel update from 2017 to today.

This vulnerability affects the following:
🔴 Shared servers (dev boxes, jump hosts, build servers): any user becomes root
🔴 Kubernetes and container clusters: one compromised pod escapes to the host
🔴 CI runners (GitHub Actions, GitLab, Jenkins): a malicious pull request becomes root on the runner
🔴 Cloud platforms running user code (notebooks, agent sandboxes, serverless functions): a tenant becomes host root

Timeline:
🔴 March 23, 2026: reported to the Linux kernel security team
🔴 April 1: patch committed to mainline (commit a664bf3d603d)
🔴 April 22: CVE assigned
🔴 April 29: public disclosure

Mitigation: update your kernel to a build that includes mainline commit a664bf3d603d. If you cannot patch immediately, turn off the vulnerable module:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

For environments that run untrusted code (containers, sandboxes, CI runners), block access to the kernel's AF_ALG crypto interface entirely, even after patching. Almost nothing legitimate needs it, and blocking it shuts the door on this whole class of bug...

[The Hacker News @TheHackersNews]

🚨 WARNING: cPanel patched an auth flaw affecting all supported versions—forcing providers to restrict access.

Namecheap blocked ports 2083/2087, disabling control panel access until patches deployed.

🔗 Read → https://t.co/sdiL8E0oZA

[International Cyber Digest @IntCyberDigest]

🚨 SaaS platform ClickUp, used by 85% of the Fortune 500, has been leaking customer emails through its homepage for at least 465 days, and counting.

ClickUp has a $4 billion valuation. They are SOC 2 Type 2, ISO 27001, ISO 27017, ISO 27018, ISO 42001, and PCI DSS certified. The fix takes about 90 seconds.

Security researcher @weezerOSINT noticed a hardcoded Split[.]io SDK token sitting in plain text inside ClickUp's production JavaScript bundle. The bundle loads before you log in. View source, copy key, send one unauthenticated GET request, and 4.5MB of ClickUp's internal configuration is exposed: 959 customer emails and 3,165 internal feature flags.

The customer list consists of Home Depot. Fortinet, who sells enterprise firewalls. Tenable, who makes Nessus, the vulnerability scanner half the industry runs on. Autodesk. Rakuten. Mayo Clinic. Permira. Akin Gump. A Microsoft contractor. 71 ClickUp employees. Government workers from Wyoming, Arkansas, North Carolina, Montana, Queensland, and New Zealand.

It gets worse, ClickUp has a flag named "enable-missing-authz-checks." It is active in production. It lists five ClickUp API endpoints the company itself documented as having no authorization. They wrote down their own holes in a config anyone with a browser can read.

At first disclosure, another flag carried a live ClickUp API token tied to Fairfax County Public Schools, one of the largest school districts in the US, serving 180,000 students. The token pulled 1,066 staff records, including Chief Financial Services data. ClickUp removed that one token. They never rotated the SDK key that exposed it.

While that report rotted, the same researcher found a second bug. ClickUp's webhook API has zero SSRF protection. Reported via HackerOne on April 8, 2026. Status: "New." 19 days, zero response.

The original report was filed by @weezerOSINT on January 17, 2025 (!). The key is still live. The emails still drop with one GET. ClickUp has had 465 days to rotate a single token. Zero response...

The fix is one click in the Split[.]io dashboard... ClickUp still hasn't replied to the researcher.

[Cyber Security News @The_Cyber_News]

⚠️ Microsoft Confirms Remote Desktop Warnings May Display Incorrectly After April Update

Source: https://t.co/PuXP9gsrQi

Microsoft has officially acknowledged a known issue in its April 2026 Windows 11 cumulative update: Remote Desktop Protocol (RDP) security warning dialogs may render incorrectly on certain system configurations, a significant usability concern given that the warnings are designed to protect users from active phishing threats.

Users quickly began reporting rendering failures with the new dialog, prompting Microsoft to add it as a formal known issue on April 23, 2026, before issuing a correction to the documentation on April 27, 2026.

#cybersecuritynews

[Wiz @wiz_io]

🚨 BREAKING: Wiz Research discovered Remote Code Execution on https://t.co/SvN2lGsnbO with a single git push

The flaw in @github allowed unauthorized access to millions of repositories belonging to other users and organizations 🤯

[Cyber Security News @The_Cyber_News]

🚨 New Windows 0-Click Vulnerability Exploited to Bypass Defender SmartScreen

Source: https://t.co/uBwWAxBYvJ

A critical zero-click authentication coercion vulnerability, tracked as CVE-2026-32202, stemming from an incomplete patch for a Windows Shell security feature bypass actively weaponized by the Russian APT28 threat group.

Microsoft confirmed active exploitation of the flaw and released a fix as part of its April 2026 Patch Tuesday update.

The attack's primary mechanism abuses the Windows Shell namespace parsing pipeline. APT28 embedded a malicious LinkTargetIDList structure inside the LNK file, a binary IDList that Windows Explorer parses and renders, similar to how Control Panel items are displayed.

#cybersecuritynews #vulnerability #microsoft

[The Hacker News @TheHackersNews]

😳 Entra ID Agent ID Administrator role flaw enabled service principal takeover.

Users could take over non-agent service principals, add credentials, and escalate privileges before Microsoft’s April 9, 2026 patch.

🔗 See how the attack worked → https://t.co/WCitnTrOnl

[Tom's Hardware @tomshardware]

Claude-powered AI coding agent deletes entire company database in 9 seconds — backups zapped, after Cursor tool powered by Anthropic's Claude goes rogue https://t.co/x8wHYjS6nM

[BleepingComputer @BleepinComputer]

Microsoft asks iPhone users to reauthenticate after Outlook outage
https://t.co/BD6ixLzl13

https://t.co/BD6ixLzl13

[BleepingComputer @BleepinComputer]

Microsoft pulls service update causing Teams launch failures
https://t.co/pdb0lyb677

https://t.co/pdb0lyb677

[BleepingComputer @BleepinComputer]

Microsoft releases emergency updates to fix Windows Server issues
https://t.co/tjtDfgk1hT

https://t.co/tjtDfgk1hT

[Shalini Goyal @goyalshaliniuk]

Generative AI is not magic, it is math that creates.

From generating art and code to simulating human creativity, every GenAI model works differently, but with one shared goal: creation from data.

Here is a simple breakdown of the five major types of Generative AI models shaping today’s AI revolution 👇

1. Diffusion Models
Learn by adding and removing noise from data to create realistic outputs.
Used in image and art generation tools like DALL·E 3, Stable Diffusion, and Midjourney.

2. GANs (Generative Adversarial Networks)
Use two neural networks - a generator and a discriminator, that compete to produce lifelike data.
Power deepfake videos, face synthesis, and AI art.

3. Variational Autoencoders (VAEs)
Compress data into a compact representation and decode it to generate new versions.
Used in image reconstruction, anomaly detection, and creative design.

4. Autoregressive Models
Predict the next word, note, or pixel based on previous ones in a sequence.
Used in text generation, music composition, and time-series forecasting.

5. Transformers
Use self-attention to understand relationships across sequences for highly contextual generation.
Power modern AI systems like GPT, Claude, and Gemini for text, code, and image generation.

Generative AI Is Redefining Creativity

Each model type brings a new layer of intelligence, from reasoning to imagination.
Learn how these models work, and you’ll understand the core of AI’s creative power.

[New York Post @nypost]

Oracle axes 30K jobs in massive layoff - notifying fired employees with 6 a.m. email https://t.co/jYnYHSThyt

[CornicheCorp @cornichecorp]

Immediate Wins You’ll feel in 30 days with IXLCore
✅️Deals move because follow-ups fire on time
✅️Delivery is visible, so work ships on schedule
✅️Cash flow tightens as invoices + payments sync
✅️Teams stop blaming; the system shows reality. https://t.co/uNMwcdTMO2

[CornicheCorp @cornichecorp]

If your ops=spreadsheets +WhatsApp +"I'll remember" you are not scaling - you are gambling. IXLCORE kills the chaos: invoicing, HR, projects, CRM, marketing in one system. Close faster. Invoice faster. Grow cleaner. #ERP #SME #Automation #TaxCompliance
https://t.co/uNMwcdTMO2

[CornicheCorp @cornichecorp]

IXL CORE Centralizes in one platform:
✅ CRM & pipeline with disciplined follow-ups
✅ Invoicing, expenses, payments & recurring subs
✅ Projects/tasks with owners & deadlines
✅ HR records, leave, timesheets
✅ Marketing automation (email, SMS, WhatsApp.
#ERP #CRM #ixlcore