## Executive Summary The threat landscape is dominated by widespread, active exploitation of critical vulnerabilities across core infrastructure and software supply chains. **CISA has added multiple new CVEs to its Known Exploited Vulnerabilities (KEV) catalog**, including the **Linux 'Copy Fail' kernel flaw (CVE-2026-31431)** and the **cPanel/WHM authentication bypass (CVE-2026-41940)**, signaling urgent patching requirements. Supply chain attacks continue to escalate, with new campaigns targeting **Ruby gems, Go modules, npm, and PyPI packages** to compromise CI/CD pipelines. Additionally, ransomware operations face legal repercussions, while a critical flaw in **VECT 2.0 ransomware** is causing irreversible data destruction for victims.

## ⚠️ Immediate Action Required

* **Linux Kernel 'Copy Fail' Privilege Escalation** A critical local privilege escalation vulnerability in the Linux kernel allows unprivileged users to gain root access by corrupting the page cache of setuid binaries. CISA has added it to the KEV catalog due to active exploitation. * **CVE:** CVE-2026-31431 (CVSS: 7.8) * **Status:** Active exploitation detected * **Vulnerable:** Linux distributions since 2017 (specific kernel versions not listed in source — check vendor advisory) * **Fixed:** Patches are available in specific kernel versions but not widely deployed (Not specified in source — check vendor advisory) * **Workaround:** None mentioned in source * **Reference:** [The Hacker News](https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html)

* **cPanel/WHM Authentication Bypass** A critical authentication bypass flaw in cPanel and WHM allows unauthenticated attackers to gain root access. It has been exploited as a zero-day for months and is now mass-exploited in "Sorry" ransomware attacks. * **CVE:** CVE-2026-41940 (CVSS: 9.8) * **Status:** Active exploitation detected * **Vulnerable:** Multiple releases from 11.40 to 130.0.19 * **Fixed:** Patches are available in specific builds (Not specified in source — check vendor advisory) * **Workaround:** None mentioned in source * **Reference:** [BleepingComputer](https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/)

* **🏢 Cisco ASA/Firepower FIRESTARTER Backdoor** The FIRESTARTER backdoor, deployed by APT actors, exploits critical vulnerabilities in Cisco Firepower and ASA devices. It achieves persistence, survives patches and reboots, and requires a full power cycle for removal. * **CVE:** CVE-2025-20362, CVE-2025-20333 (CVSS: Up to 9.9) * **Status:** Active exploitation detected * **Vulnerable:** Cisco ASA and FTD software up to version 9.12.4.72 * **Fixed:** Not specified in source — check vendor advisory * **Workaround:** A full power cycle (cold start) is required to clear the persistent backdoor from infected devices. * **Reference:** [CSO Online](https://www.csoonline.com/article/4163925/infected-cisco-firewalls-need-cold-start-to-clear-persistent-firestarter-backdoor.html)

* **Windows Zero-Click Authentication Coercion Flaw** A zero-click authentication coercion flaw in Windows was exploited as a zero-day. This vulnerability (CVE-2026-32202) is a regression from an incomplete patch for CVE-2026-21510. * **CVE:** CVE-2026-32202 (CVSS: 4.3) * **Status:** Active exploitation detected * **Vulnerable:** Windows 10 1607 prior to 10.0.14393.9060 * **Fixed:** Microsoft has issued a patch. * **Workaround:** None mentioned in source * **Reference:** [The Register Security](https://go.theregister.com/feed/www.theregister.com/2026/04/29/microsoft_zero_click_exploit/) * **Note:** Related to CVE-2026-21510. Systems patched only for the earlier issue may still be vulnerable — verify current patch level.

## 🔍 Threat Activity * **Supply Chain Attacks Target CI/CD Credentials:** A coordinated campaign is using poisoned **Ruby gems and Go modules** to steal credentials and tamper with CI/CD pipelines, specifically targeting GitHub Actions. Separately, the **PyTorch Lightning PyPI package (versions 2.6.2 & 2.6.3)** was compromised to deploy a Bun-based credential stealer upon import. Additionally, **SAP-related npm packages** (e.g., `mbt@1.2.48`) were injected with malicious preinstall scripts (`Mini Shai-Hulud`) that steal credentials. * **Ransomware Legal Fallout:** Two U.S. cybersecurity professionals were sentenced to four years in prison for their involvement in **BlackCat ransomware** attacks. In a related case, a ransomware negotiator pleaded guilty to aiding the gang by leaking confidential victim data to maximize extortion payouts. * **VECT 2.0 Ransomware Acts as Wiper:** All public versions of the **VECT 2.0 ransomware** contain a critical encryption flaw causing permanent destruction of files larger than 128KB on Windows, Linux, and ESXi systems, making recovery impossible. * **Facebook Phishing via Google Services:** A Vietnamese-linked threat actor used **Google AppSheet** to send phishing emails impersonating Meta Support, successfully compromising approximately 30,000 Facebook Business accounts by harvesting credentials and 2FA codes.

## 📋 Patches & Updates * **🏢 Microsoft ASP.NET Core Privilege Escalation:** A critical flaw (CVE-2026-40372, CVSS 9.1) in ASP.NET Core's Data Protection library allows attackers to forge authentication cookies and gain SYSTEM privileges. **Affected:** ASP.NET Core 10.0.0 through 10.0.6. **Patched:** Microsoft has released emergency updates. * **GitHub Enterprise Server RCE:** A critical vulnerability (CVE-2026-3854, CVSS 8.8) allowed authenticated users to execute arbitrary code via malicious `git push` commands. **Affected:** GitHub Enterprise Server < 3.14.24 and >= 3.15.0 < 3.15.1. **Patched:** Fixed versions have been released. * **LiteLLM SQL Injection:** A critical SQL injection flaw (CVE-2026-42208) in LiteLLM was exploited within 36 hours of disclosure. **Affected:** Versions >=1.81.16 and <1.83.7. **Patched:** Version 1.83.7. * **nginx-ui Authentication Bypass:** Critical vulnerabilities (CVE-2026-33032, CVSS up to 9.8) allow unauthenticated attackers to take full control of Nginx servers. **Affected:** All versions prior to 2.3.5. **Patched:** Versions 2.3.4 and 2.3.5.

## Today's Priorities 1. **Patch Linux systems and cPanel/WHM servers immediately.** Both CVE-2026-31431 (Linux kernel) and CVE-2026-41940 (cPanel) are on CISA's KEV list and are under active attack. 2. **Review and harden CI/CD pipelines.** Audit dependencies for the compromised Ruby gems, Go modules, npm (`mbt`, `@cap-js/db-service`), and PyPI (`lightning`) packages. Enforce strict source verification and monitor for anomalous activity. 3. **🏢 Power cycle and patch affected Cisco ASA/Firepower devices.** If running vulnerable versions, assume compromise and follow the cold-start remediation procedure to eradicate the persistent FIRESTARTER backdoor. 4. **Apply Microsoft and other vendor patches.** Prioritize the Windows zero-day (CVE-2026-32202) and the ASP.NET Core privilege escalation (CVE-2026-40372).

## 🔗 References

• [The Hacker News: CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV](https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html)
• [BleepingComputer: Critrical cPanel flaw mass-exploited in "Sorry" ransomware attacks](https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/)
• [CSO Online: Infected Cisco firewalls need cold start to clear persistent Firestarter backdoor](https://www.csoonline.com/article/4163925/infected-cisco-firewalls-need-cold-start-to-clear-persistent-firestarter-backdoor.html)
• [The Hacker News: Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft](https://thehackernews.com/2026/05/poisoned-ruby-gems-and-go-modules.html)
• [The Hacker News: SAP npm Packages Compromised by “Mini Shai-Hulud” Credential-Stealing Malware](https://thehackernews.com/2026/04/sap-npm-packages-compromised-by-mini.html)