## Executive Summary The threat landscape is dominated by **widespread, active exploitation of critical vulnerabilities** in enterprise software and a surge in **software supply chain attacks**. The **GitHub breach by TeamPCP** and the **Megalodon CI/CD campaign** highlight severe risks to developer ecosystems and source code integrity. Immediate patching is critical for **Microsoft SharePoint, Cisco SD-WAN, cPanel, and Trend Micro Apex One**, all under active attack. Additionally, the **first observed AI-generated zero-day exploit** targeting 2FA bypass represents a dangerous evolution in attacker capabilities.

## ⚠️ Immediate Action Required

* **🏢 Microsoft SharePoint Multiple Critical RCE Vulnerabilities** Multiple critical vulnerabilities in Microsoft SharePoint Server are being actively exploited, allowing remote code execution and spoofing attacks. * **CVE:** CVE-2026-20963 (CVSS: 8.8), CVE-2026-32201 (CVSS: 6.5), CVE-2026-45659, CVE-2026-33825, CVE-2026-33824 * **Status:** Active exploitation detected * **Vulnerable:** SharePoint Server 2016, 2019, and versions prior to specific updates released in April 2026. * **Fixed:** Apply Microsoft's April 2026 patches. Specific patched versions not specified in source — check vendor advisory. * **Workaround:** None mentioned in source * **Reference:** [Microsoft Security Response Center: CVE-2026-45659 Microsoft SharePoint Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659)

* **🏢 Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-20127)** A critical authentication bypass flaw (CVSS 10.0) in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to gain administrative access. Multiple related flaws are also under active exploitation. * **CVE:** CVE-2026-20127 (CVSS: 10.0) * **Status:** Active exploitation detected * **Vulnerable:** Various versions of Cisco Catalyst SD-WAN Manager. Not specified in source — check vendor advisory. * **Fixed:** Cisco has released patches. Organizations are urged to update immediately. * **Workaround:** None mentioned in source * **Reference:** [SC Media: 10.0 Cisco Catalyst SD-WAN Controller bug added to CISA’s KEV list](https://www.scworld.com/news/10.0-cisco-catalyst-sd-wan-controller-bug-added-to-cisas-kev-list)

* **cPanel & WHM Authentication Bypass (CVE-2026-41940)** A critical authentication bypass vulnerability allows unauthenticated attackers to gain administrative access to cPanel/WHM, leading to server takeover and ransomware deployment. * **CVE:** CVE-2026-41940 (CVSS: 9.8) * **Status:** Active exploitation detected * **Vulnerable:** cPanel versions 11.40 through 130.0.19 * **Fixed:** Patches are available in specific builds. Not specified in source — check vendor advisory. * **Workaround:** None mentioned in source * **Reference:** [FortiGuard Threat Signal: cPanel & WHM Authentication Bypass](https://fortiguard.fortinet.com/threat-signal-report/6447)

* **Trend Micro Apex One Critical Vulnerabilities** Multiple critical vulnerabilities in Trend Micro Apex One, including remote code execution and privilege escalation flaws, are being actively exploited in the wild. * **CVE:** CVE-2026-34926 (CVSS: Not specified), among others. * **Status:** Active exploitation detected * **Vulnerable:** Affects Windows and macOS versions of Apex One. Not specified in source — check vendor advisory. * **Fixed:** Patches are available for affected versions. * **Workaround:** None mentioned in source * **Reference:** [Help Net Security: Actively exploited Trend Micro Apex One flaw gets CISA warning (CVE-2026-34926)](https://www.helpnetsecurity.com/?p=371992)

* **Drupal Core SQL Injection (CVE-2026-9082)** A critical SQL injection vulnerability in Drupal Core's database abstraction API allows unauthenticated attackers to execute arbitrary SQL on PostgreSQL-backed sites. Now on CISA's KEV list. * **CVE:** CVE-2026-9082 (CVSS: 6.5) * **Status:** Active exploitation detected * **Vulnerable:** Drupal 10.x and 11.x prior to specific patched releases. * **Fixed:** Patches are available for impacted versions. * **Workaround:** None mentioned in source * **Reference:** [The Hacker News: Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV](https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html)

## 🔍 Threat Activity

* **GitHub Breach & Megalodon CI/CD Campaign Highlight Supply Chain Crisis.** The **TeamPCP** breach of GitHub's internal repos via a malicious VS Code extension and npm package (`art-template`) coincides with the separate **Megalodon** campaign that injected malicious workflows into over 5,500 public repos. Both represent a severe, multi-vector attack on the software development supply chain, targeting secrets and proprietary code. Reference: [The Hacker News: GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension](https://thehackernews.com/2026/05/github-internal-repositories-breached.html)

* **KnowledgeDeliver LMS Zero-Day Deploys Cobalt Strike.** Attackers are exploiting a critical ViewState deserialization flaw (CVE-2026-5426, CVSS 9.1) in KnowledgeDeliver LMS to deploy web shells and Cobalt Strike beacons. Affected systems are prior to February 2026 patches. Reference: [BleepingComputer: KnowledgeDeliver flaw exploited as a zero-day to install web shells](https://www.bleepingcomputer.com/news/security/knowledgedeliver-flaw-exploited-as-a-zero-day-to-install-web-shells/)

* **Ghost CMS SQL Injection Fuels ClickFix Malware Campaign.** Over 700 sites have been compromised via a critical SQLi flaw (CVE-2026-26980, CVSS 9.4) in Ghost CMS. Attackers steal admin API keys to inject malicious JavaScript, redirecting users to ClickFix malware campaigns. Reference: [The Hacker News: Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks](https://thehackernews.com/2026/05/ghost-cms-cve-2026-26980-exploited-to.html)

* **Tycoon2FA Phishing Platform Resurfaces Post-Takedown.** Despite a global law enforcement takedown, the Tycoon2FA phishing-as-a-service platform, which specializes in adversary-in-the-middle (AiTM) attacks to bypass MFA, has resumed operations, posing a continued high risk to Microsoft 365 and Gmail accounts. Reference: [The Hacker News: Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,0](https://thehackernews.com/2026/03/europol-led-operation-takes-down-tycoon.html)

* **First AI-Generated Zero-Day Targets 2FA Bypass.** Google Threat Intelligence identified a zero-day exploit, likely AI-generated, that bypasses two-factor authentication in a popular open-source web administration tool. This marks a significant evolution in attacker tooling. Reference: [Infosecurity Magazine: Hackers Observed Using AI to Develop Zero-Day for the First Time](https://www.infosecurity-magazine.com/news/hackers-using-ai-zero-day-first/)

## 📋 Patches & Updates

* **Microsoft Defender Privilege Escalation/DoS (CVE-2026-45498 & CVE-2026-41091).** Two vulnerabilities in Microsoft Defender Antimalware Platform are under active exploitation, allowing privilege escalation and denial of service. Patches are available in version 4.18.2604+. Reference: [Microsoft Security Response Center: CVE-2026-45498 Microsoft Defender Denial of Service Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498)

* **Linux Kernel 'Dirty Frag' LPE Vulnerability (CVE-2026-43284).** A critical local privilege escalation flaw in the Linux kernel (versions 4.11 to 6.7) is being actively exploited. Patches are not yet available for all affected distributions; monitor vendor advisories closely. Reference: [SC Media: New Linux privilege escalation flaw ‘Fragnesia’ disclosed; PoC available](https://www.scworld.com/news/new-linux-privilege-escalation-flaw-fragnesia-disclosed-poc-available)

* **Exim Mail Server Multiple Critical RCE Flaws.** Multiple critical vulnerabilities in Exim (versions 4.97 through 4.99.2 with GnuTLS) allow remote code execution and denial of service. Update to Exim 4.99.3 or later. Reference: [BleepingComputer: New critical Exim mailer flaw allows remote code execution](https://www.bleepingcomputer.com/news/security/new-critical-exim-mailer-flaw-allows-remote-code-execution/)

* **Windows BitLocker Bypass (YellowKey - CVE-2026-45585).** A zero-day vulnerability allows physical attackers to bypass BitLocker encryption via the Windows Recovery Environment. Microsoft has released mitigations but no patch yet for affected Windows 11/Server 2025 versions. Reference: [The Hacker News: Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Expl](https://thehackernews.com/2026/05/microsoft-releases-mitigation-for.html)

## Today's Priorities 1. **Patch Immediately:** Apply critical patches for **Microsoft SharePoint**, **Cisco SD-WAN**, **cPanel**, and **Trend Micro Apex One** due to active exploitation. 2. **Audit GitHub Security:** Review internal and third-party GitHub repositories for unauthorized commits, suspicious CI/CD workflows, and exposed secrets. Enforce MFA and review installed extensions. 3. **Review CISA KEV Catalog:** Verify patching status for newly added CVEs, especially **Drupal CVE-2026-9082** and **Cisco CVE-2026-20127**. 4. **Assess Linux Kernel Exposure:** Identify systems running vulnerable Linux kernel versions (4.11-6.7) and monitor for vendor patches for the 'Dirty Frag' LPE flaw.

## 🔗 References

• [Microsoft Security Response Center: CVE-2026-45659 Microsoft SharePoint Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659)
• [The Hacker News: GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension](https://thehackernews.com/2026/05/github-internal-repositories-breached.html)
• [FortiGuard Threat Signal: cPanel & WHM Authentication Bypass](https://fortiguard.fortinet.com/threat-signal-report/6447)
• [SC Media: 10.0 Cisco Catalyst SD-WAN Controller bug added to CISA’s KEV list](https://www.scworld.com/news/10.0-cisco-catalyst-sd-wan-controller-bug-added-to-cisas-kev-list)
• [BleepingComputer: KnowledgeDeliver flaw exploited as a zero-day to install web shells](https://www.bleepingcomputer.com/news/security/knowledgedeliver-flaw-exploited-as-a-zero-day-to-install-web-shells/)