Category: Cyber Security News

CISA warned that threat actors are actively exploiting the “Copy Fail” Linux kernel vulnerability (CVE-2026-31431) days after Theori published a 100% reliable PoC exploit that can root multiple major distributions. Federal agencies must patch affected systems by May 15 under BOD 22-01, and CISA urged all organizations to prioritize updates or mitigations to prevent unprivileged users from gaining root. #CVE-2026-31431 #CopyFail

Instructure confirmed a cybersecurity incident after the ShinyHunters extortion gang claimed to have stolen and listed its data on a leak site. The company says identifying information and private messages may have been exposed, it patched the vulnerability, rotated application keys, and is requiring customers to re-authorize API access while investigations continue. #Instructure #ShinyHunters

Microsoft Defender began flagging legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha after an April 30 signature update, causing false-positive alerts and removal of entries from the Windows trust store. Microsoft has released Security Intelligence updates to fix the detections and restore removed certificates, and the issue is possibly linked to a recent DigiCert incident that led to abused EV code-signing certificates. #DigiCert #ZhongStealer

Last week’s highlights span AI-driven attack surfaces, widespread exploit activity against critical infrastructure and software, and major data breaches alongside rising privacy enforcement. Notable items include the RentAHuman gig model for AI agents, active exploitation of Windows Shell (CVE-2026-32202) and GitHub Enterprise (CVE-2026-3854), the buggy Vect ransomware, identity and IAM risks from AI agents, and record state privacy fines and breach disclosures #Vect #UNC6692

The Pentagon has reached agreements with seven tech companies to deploy their AI capabilities inside classified networks to augment warfighter decision-making. The deals — notably excluding Anthropic after its dispute with the administration — raise questions about human oversight, privacy, and the risks of overreliance on AI in combat. #Pentagon #OpenAI…

Researchers uncovered a large-scale fraud operation called FEMITBOT that uses Telegram Mini Apps and bots to run crypto scams, impersonate major brands, and distribute Android malware via sideloaded APKs. The campaigns rely on a shared backend, in-app phishing pages, and tracking pixels to optimize conversions, so users should avoid launching Mini Apps from unknown bots or sideloading APKs. #FEMITBOT #TelegramMiniApps

CISA added CVE-2026-31431—known as Copy Fail—to its Known Exploited Vulnerabilities catalog after observing active exploitation of a local privilege escalation bug in the Linux kernel that can allow an unprivileged user to obtain root; fixes are available in kernel versions 6.18.22, 6.19.12, and 7.0. This flaw, introduced by changes made between…

A critical authentication bypass in WHM and cPanel (CVE-2026-41940) is being mass-exploited to breach servers and deploy a Linux encryptor used in “Sorry” ransomware attacks. At least 44,000 cPanel hosts have been compromised and hundreds of affected sites are indexed by Google, so administrators must apply the emergency update immediately to prevent further encryption and data theft. #CVE-2026-41940 #SorryRansomware

ConsentFix v3 is an automated, scalable evolution of OAuth authorization-code phishing that abuses pre-consented Microsoft first‑party apps to harvest tokens and hijack Azure accounts. Attackers combine tenant discovery, targeted reconnaissance, Cloudflare Pages phishing, and Pipedream automation to immediately exchange authorization codes for refresh tokens and enable post‑exploitation via tools like Specter Portal. #ConsentFixv3 #MicrosoftAzure

Bluekit is a newly discovered phishing kit that bundles over 40 templates, an AI assistant, automated domain registration, anti-bot cloaking, spoofing, voice cloning, and uses Telegram for data exfiltration. Varonis accessed Bluekit’s control panel and found integrated domain and campaign management, session tracking, and rapid feature updates, though the kit remains…

Instructure disclosed a cybersecurity incident perpetrated by a criminal threat actor and says outside forensics are investigating the impact. Some services, including Canvas Data 2 and Canvas Beta, have been under maintenance since May 1 and customers may experience issues with tools that rely on API keys. #Instructure #ShinyHunters