SecOpsSam

SecOps enthusiast | Defender always | Breaking silos, building security | Lover of logs, SIEM dreams, and zero-trust schemes

[SecOpsSam @gbc13]

*Laravel Lang packages were hijacked to deliver credential-stealing malware*
Why it matters: this is another live software supply-chain compromise through trusted package ecosystems, directly impacting developer environments.
Source: https://t.co/YSfFddPWdz

[SecOpsSam @gbc13]

To check if it’s enabled:

Settings → Privacy & Security → Recall & Snapshots

Or in PowerShell:

Get-WindowsOptionalFeature -Online | findstr /i recall

Normal Windows 11 PCs generally do NOT do this by default.

[SecOpsSam @gbc13]

Most people still don’t realise this, some newer Windows 11 “Copilot+” PCs can use a feature called Recall that periodically snapshots your screen so AI can search your past activity.

That means your on screen data ;can potentially end up indexed locally on the machine.

[SecOpsSam @gbc13]

From a cyber perspective, this changes endpoint risk dramatically. Your laptop becomes a searchable memory database.

[SecOpsSam @gbc13]

To check if it’s enabled:

Settings → Privacy & Security → Recall & Snapshots

Or in PowerShell:

Get-WindowsOptionalFeature -Online | findstr /i recall

Normal Windows 11 PCs generally do NOT do this by default.

[Theo - t3.gg @theo]

Security things from the last few days:
- CopyFail (linux pwn'd)
- CopyFail 2/Dirty Frag
- 13 advisories in Next.js
- Over 70 CVEs addressed in MacOS 26.5
- ~50 CVEs addressed in iOS 26.5
- YellowKey (Windows Bitlocker pwn'd entirely)
- GreenPlasma (Windows privilege escalation)
- CVE-2026-21510 and CVE-2026-21513 confirmed to be used by Russia for Windows RCE
- CVE-2026-32202 separately confirmed to be used by Russia for sensitive document access
- Mini-Shai Hulud (over 300 JS and Python packages compromised via GitHub Action cache poisoning)
- Google confirms they have identified AI-powered exploitation of zero days in an unidentified "open-source, web-based system administration too"
- Canvas (popular LMS used in most schools) pwn'd entirely
- PAN-OS (palo alto networks) pwn'd with a 9.3 severity CVE-2026-0300

Are you scared yet?

[International Cyber Digest @IntCyberDigest]

‼️🚨 Pwn2Own Berlin 2026 just hit a wall. For the first time in 19-years, ZDI rejected dozens of working zero-day RCE submissions because organizers ran out of contest slots.

Rejected hackers are now going public with PoC demos and direct vendor disclosures, breaking Pwn2Own's usual secrecy.

▪️ AI surfaces a massive wave of 0-day RCEs.
▪️ Submissions overwhelm ZDI past max capacity.
▪️ Slots run out. Researchers with working chains get rejected.
▪️ "Revenge disclosures" begin. ← we are here.

Confirmed casualties so far:
▪️ @xchglabs : 86 vulnerabilities prepared (PyTorch, NVIDIA, Linux KVM, Oracle, Docker, Ollama, Chroma, LiteLLM, llama.cpp). All rejected. Now reporting directly to vendors with writeups dropping as patches land.
▪️ @ggwhyp : full-chain Firefox RCE on Windows. Rejected. Publicly demoed (HTML page → cmd.exe → calc.exe). Responsibly disclosed to Mozilla.
▪️ @yunsu_dev : working RCE chain, rejected. Submitting elsewhere.
▪️ @ryotkak : tried to register for 3+ weeks. ZDI confirmed "at maximum capacity, can't add extra contest days." Considered canceling flight and hotel.
▪️ @anzuukino2802 : Claude Code RCE PoC. Rejected.
▪️ @desckimh : 0-day RCEs in Ollama and LM Studio. Rejected.

Reported impact: a community-estimated 150+ researchers tried to register. Accepted contestants are now being warned about collisions. Rejected vulnerabilities going to bug bounty programs may trigger pre-event patches that invalidate the work of those who got in.

ZDI has not publicly addressed the capacity issue. The event still runs May 14-16 in Berlin.

[SecOpsSam @gbc13]

A fake OpenAI repository on Hugging Face was used to distribute infostealer malware.
Why it matters: attackers are effectively abusing developer trust channels and brand impersonation to steal credentials and sensitive data from technical users.

Source: https://t.co/5nO0fpzawW

[SecOpsSam @gbc13]

*Progress warned MOVEit Automation customers about a critical auth-bypass flaw*

Why it matters: authentication bypass in widely deployed managed file transfer tooling creates immediate unauthorised-access risk in enterprise file workflows.

Source: https://t.co/BkRN7JJZ9b

[SecOpsSam @gbc13]

Microsoft Defender incorrectly flagged DigiCert certificates as malware

Why it matters: false positives on trusted certificate material can disrupt trust chains and operations, while also creating major response noise.

Source: https://t.co/Qgxx8VASWh

[SecOpsSam @gbc13]

CISA ordered federal agencies to patch a cPanel vulnerability by Sunday*
Why it matters: emergency federal patch directives are strong indicators of active exploitation risk and high potential impact on internet-facing hosting infrastructure.
Source: https://t.co/Mlz7Blx9ZQ

[SecOpsSam @gbc13]

*Critical cPanel vulnerability is being mass-exploited in “Sorry” ransomware campaigns*
Why it matters: internet-facing, unmanaged hosting servers can be compromised and encrypted quickly at scale.

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: cPanel and WHM, the control panels behind an estimated 70+ million websites, have a critical security flaw that lets anyone become root admin without a password. CVE-2026-41940 affects every supported version. It’s already being exploited in the wild.

watchTowr Labs published the full attack today, after the hosting company KnownHost confirmed the bug was already being used to break into a significant chunk of the internet.

If you've never heard of cPanel: it's the dashboard that hosting providers and millions of website owners use to manage their servers, domains, email accounts, databases, and SSL certificates. WHM is the admin version that controls the entire server. If someone gets root access to WHM, they get the keys to the kingdom and to every apartment inside it.

How the attack works, in plain English:

🔴 Step 1: The attacker sends a deliberately wrong login. cPanel still creates a temporary "you tried to log in" record on disk and gives the attacker a cookie tied to it.
🔴 Step 2: The attacker tweaks the cookie to disable cPanel's password encryption. Normally cPanel encrypts the password field on disk. With one small change to the cookie, cPanel just stores it as plain text instead.
🔴 Step 3: The attacker sends a fake login attempt where the password field secretly contains hidden line breaks. cPanel does not strip these line breaks out, so they get written straight to the session file. Each line break creates a brand new fake record. The attacker uses this to inject lines that say "this user is root" and "this user already authenticated successfully."
🔴 Step 4: The attacker visits one more random page on the site to nudge cPanel into re-reading the file. cPanel then promotes the injected fake lines into its main session memory.
🔴 Step 5: On the next request, cPanel sees a flag that says "this user already passed the password check." cPanel trusts that flag, skips checking the actual password, and lets the attacker in as root.

From start to finish, the attack takes a handful of HTTP requests.

If you run cPanel or WHM, the patched versions are:

🔴 cPanel/WHM 110.0.x → 11.110.0.97
🔴 cPanel/WHM 118.0.x → 11.118.0.63
🔴 cPanel/WHM 126.0.x → 11.126.0.54
🔴 cPanel/WHM 132.0.x → 11.132.0.29
🔴 cPanel/WHM 134.0.x → 11.134.0.20
🔴 cPanel/WHM 136.0.x → 11.136.0.5

If your version is older than these, assume someone has already broken in and act accordingly. Patch right now, then rotate every password and key the server touched: root passwords, API tokens, SSL private keys, SSH keys, mail passwords, and database passwords.

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: An AI found a Linux kernel zero-day that roots every distribution since 2017. The exploit fits in 732 bytes of Python. Patch your kernel ASAP.

The vulnerability is CVE-2026-31431, nicknamed "Copy Fail," disclosed today by Theori. It has been sitting quietly in the Linux kernel for nine years.

Most Linux privilege-escalation bugs are picky. They need a precise timing window (a "race"), or specific kernel addresses leaked from somewhere, or careful tuning per distribution. Copy Fail needs none of that. It is a straight-line logic mistake that works on the first try, every time, on every mainstream Linux box.

The attacker just needs a normal user account on the machine. From there, the script asks the kernel to do some encryption work, abuses how that work is wired up, and ends up writing 4 bytes into a memory area called the "page cache" (Linux's high-speed copy of files in RAM). Those 4 bytes can be aimed at any program the system trusts, like /usr/bin/su, the shortcut to becoming root.

Result: the next time anyone runs that program, it lets the attacker in as root.

What should worry most: the corruption never touches the file on disk. It only exists in Linux's in-memory copy of that file. If you imaged the hard drive afterwards, the on-disk file would match the official package hash exactly. Reboot the machine, or just put it under memory pressure (any normal system load that needs the RAM), and the cached copy reloads fresh from disk.

Containers do not help either. The page cache is shared across the whole host, so a process inside a container can use this bug to compromise the underlying server and reach into other tenants.

The original sin was a 2017 "in-place optimization" in a kernel crypto module called algif_aead. It was meant to make encryption slightly faster. The change broke a critical safety assumption, and nobody noticed for nine years. That bug then rode every kernel update from 2017 to today.

This vulnerability affects the following:
🔴 Shared servers (dev boxes, jump hosts, build servers): any user becomes root
🔴 Kubernetes and container clusters: one compromised pod escapes to the host
🔴 CI runners (GitHub Actions, GitLab, Jenkins): a malicious pull request becomes root on the runner
🔴 Cloud platforms running user code (notebooks, agent sandboxes, serverless functions): a tenant becomes host root

Timeline:
🔴 March 23, 2026: reported to the Linux kernel security team
🔴 April 1: patch committed to mainline (commit a664bf3d603d)
🔴 April 22: CVE assigned
🔴 April 29: public disclosure

Mitigation: update your kernel to a build that includes mainline commit a664bf3d603d. If you cannot patch immediately, turn off the vulnerable module:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

For environments that run untrusted code (containers, sandboxes, CI runners), block access to the kernel's AF_ALG crypto interface entirely, even after patching. Almost nothing legitimate needs it, and blocking it shuts the door on this whole class of bug...

[SecOpsSam @gbc13]

*Threat actor used Microsoft Teams to deliver new “Snow” malware*
Why it matters: help-desk impersonation via trusted collaboration channels remains an effective initial-access method, so Teams trust controls need tweaking
Source: https://t.co/xmu2e2z3rG

[SecOpsSam @gbc13]

*ADT confirmed customer data theft linked to a cyber intrusion/extortion pressure*

Why it matters: this reinforces ongoing high-impact PII theft and extortion risk for large consumer-facing organisations.

Source: https://t.co/VXUfcAbR4d

[SecOpsSam @gbc13]

*Over 10,000 internet-exposed Zimbra servers remain vulnerable while exploitation continues*

Why it matters: with CVE-2025-48700 now in KEV, unpatched mail/collaboration servers remain a high-probability initial access path.

Source: https://t.co/1ZznpcRnTV

[SecOpsSam @gbc13]

*Bitwarden CLI npm package was compromised to steal developer credentials*
Why it matters: this supply-chain event targeted tokens/keys in developer environments, creating potential downstream exposure across CI/CD and cloud infrastructure.
Source: https://t.co/WgvqUsDNng

[SecOpsSam @gbc13]

*New Mirai activity is exploiting an RCE flaw in end-of-life D-Link routers (CVE-2025-29635)*

Why it matters: unpatched EoL edge devices continue to be low-cost botnet fuel for large-scale DDoS and follow-on abuse.

Source: https://t.co/EXWcsYU56T

[SecOpsSam @gbc13]

CISA warned about an Axios npm supply-chain compromise*
Why it matters: malicious versions in a widely used JavaScript dependency create direct risk to developer workstations, build systems, and CI/CD pipelines.
Source: https://t.co/z8Rqu1jknZ