Security daily

Synthesized by Clarity (Claude) from 38 sources · May contain errors — spot one? [email protected] · Methodology →

cPanel, MOVEit, and Shai-Hulud Worm Hit Trust Stack at Once

Sources
38
Words
1,105
Read
6min

Topics AI Regulation Agentic AI Data Infrastructure

◆ The signal

Three critical exploits are hitting trust infrastructure simultaneously this week: cPanel CVE-2026-41940 (CVSS 9.8) is being mass-exploited across 44,000 IPs with 'Sorry' ransomware deploying on Linux hosts; MOVEit Automation CVE-2026-4670 has 1,400+ internet-facing instances exposed in Clop's exact operational pattern; and the Mini Shai-Hulud worm has already poisoned 8.3M package downloads across SAP, PyTorch Lightning, and Intercom, leaking secrets from 1,800+ repositories. Patch cPanel and MOVEit this weekend, freeze poisoned lockfile versions today, and rotate every CI/CD secret touched between April 29 and May 4.

◆ INTELLIGENCE MAP

Intelligence map

  1. 01

    Trust Infrastructure Under Mass Exploitation

    act now

    cPanel (44K IPs, ransomware), MOVEit (1,400 exposed, Clop-shaped), Mini Shai-Hulud (8.3M downloads poisoned), and DigiCert (60 certs revoked after .scr social engineering) were all compromised in the same 7-day window. The common thread: infrastructure customers trust by default.

    44,000
    exposed cPanel IPs
    3
    sources
    • cPanel exposed IPs
    • MOVEit instances
    • Shai-Hulud downloads
    • DigiCert certs revoked
    • Leaked repositories
    1. cPanel IPs44,000 IPs
    2. Shai-Hulud downloads8,300,000 pkg DLs
    3. MOVEit instances1400 exposed
    4. Repos leaking secrets1800 repos
  2. 02

    AI-Generated PoC Flood Degrades SOC Triage Capacity

    act now

    CVE-2026-31431 (Linux kernel LPE, KEV-listed, 9 years in codebase) triggered an AI-generated copycat PoC flood that analysts cannot reliably separate from working exploits. NVD is simultaneously scaling back enrichment to only KEV/critical software. At BSidesSF 2026, 16 teams fully solved the CTF with LLM architectures vs. 1 in 2025.

    16x
    CTF solver increase
    3
    sources
    • CVE age in kernel
    • BSidesSF teams (2026)
    • BSidesSF teams (2025)
    • Patch window (tier-1)
    1. 2025 CTF AI solvers1
    2. 2026 CTF AI solvers16+1500%
  3. 03

    AccountDumpling + Salt Typhoon: New Campaign TTPs

    monitor

    AccountDumpling phishes from Google AppSheet infrastructure, passing SPF/DKIM/DMARC by design — 30,000+ Facebook accounts compromised. Salt Typhoon breached IBM's Italian MSP subsidiary (Sistemi Informativi), gaining adjacency to Italian government infrastructure. Both bypass standard detection: one exploits email authentication trust, the other exploits managed-service trust.

    30,000+
    accounts compromised
    2
    sources
    • AppSheet compromises
    • Email auth bypassed
    • Salt Typhoon target
    • Downstream exposure
    1. 01AppSheet phishing30K+ victims
    2. 02IBM Italy MSP breachGov adjacency
    3. 03Netlify/Vercel lures4 families
    4. 04Telegram bot exfil2FA + IDs
  4. 04

    NHI/Agent Identity Hits Enterprise Consolidation Point

    monitor

    Cisco paid $400M for Astrix, SAP is actively blocking unauthorized AI agents (OpenClaw named), and Google shipped AI Control Center — all in the same week. Non-human identities outnumber humans 40:1. The market has priced in that agent identity is a Tier-1 control gap; orgs without an NHI inventory are now behind the vendor curve.

    $400M
    Cisco-Astrix deal
    7
    sources
    • Cisco-Astrix price
    • NHI-to-human ratio
    • Fortune 50 w/ agents
    • Vendors launching NHI
    1. Cisco (Astrix)$400M
    2. Sierra valuation$15,800M
    3. Anthropic JV$1500M
    4. OpenAI JV$4000M
  5. 05

    AI Governance Regime Change: Pre-Release Vetting Crystallizes

    background

    EU is evaluating Anthropic's Mythos for banking software vulnerability scanning. White House EO on pre-release model review is in draft. Open-source 'Theoretical Mythos' replication effort launched same day. xAI admitted in court to distilling OpenAI models, setting distillation precedent. Model governance is shifting from voluntary to mandatory within 12 months.

    60%
    autonomous AI R&D by 2028
    6
    sources
    • Mythos EU scope
    • Autonomous AI prob.
    • Distillation precedent
    • Model review horizon
    1. Mythos withheldAnthropic self-restraint
    2. Open-source cloneTheoretical Mythos launched
    3. EU evaluationBanking vuln scanning
    4. White House EOPre-release review draft
    5. Regulatory enforcement6-18 months estimated

◆ DEEP DIVES

Deep dives

  1. 01

    Four Trust Anchors Breached in Seven Days — The Infrastructure Layer Is the Target

    act now

    What Happened

    Between April 29 and May 5, four categories of infrastructure that security teams are told to trust by default were compromised in parallel: a certificate authority (DigiCert), package registries (npm/PyPI via Mini Shai-Hulud), a web hosting control plane (cPanel), and a managed file transfer vendor (MOVEit). Different actors. The calendar overlap is almost certainly coincidence. The combined blast radius is not.

    cPanel CVE-2026-41940 — Mass Exploitation Active

    CRLF injection authentication bypass in cPanel/WHM 11.40+. CVSS 9.8. KnownHost places first exploitation in late February. Watchtowr published a PoC on April 30. Mass exploitation followed, visible across 44,000 Shadowserver-fingerprinted IPs. The 'Sorry' ransomware is landing on Linux hosts. Ctrl-Alt-Intel flags targeted activity against SE Asian government/military and MSPs in Philippines, Laos, Cambodia, South Africa, and the US.

    MOVEit Automation CVE-2026-4670 — The Clop Window Is Open

    Pre-auth, zero-interaction bypass. Fixed in 2025.1.5, 2025.0.9, 2024.1.8. Daniel Card counted 1,400+ internet-exposed instances via Shodan, including US state and local government. This is the sixth MOVEit vulnerability cycle since 2023. Clop's operating model is to hold access, build tooling, and fire at the entire population in a single window. That makes this a pre-campaign signal, not an incident. NYDFS fined Delta Dental $2.25M for its 2023 MOVEit response the same week.

    Mini Shai-Hulud — Supply Chain Worm

    Attributed to TeamPCP by Wiz. Self-propagating secret-harvester using preinstall scripts in npm and PyPI to exfiltrate GitHub tokens, npm tokens, and cloud credentials. Affected packages: SAP mbt v1.2.48, @cap-js/db-service v2.10.1, @cap-js/postgres v2.2.2, @cap-js/sqlite v2.2.2, plus compromised PyTorch Lightning and intercom-client releases. Reported scope: 8.3M downloads, 1,800+ repositories leaking credentials. Stolen tokens are used to poison further packages. The loop is the point.

    DigiCert Certificate Theft

    Entry was a .scr file disguised as a customer screenshot, delivered through DigiCert's customer support chat. Four prior attempts were blocked. The fifth landed. Result: 60 certificates revoked. Any DigiCert-signed binary ingested between April 2 and May 2 requires revalidation. Attacker-signed payloads are confirmed in the wild.

    The attackers did not breach the perimeter. They breached the parties the perimeter trusts — the CA, the package registries, the hosting control plane, and the MFT vendor.

    Action items

    • Patch cPanel/WHM immediately and run the May 4 refined detection script against 90 days of access logs for CRLF injection patterns
    • Patch MOVEit Automation to 2025.1.5/2025.0.9/2024.1.8 and remove all instances from public internet behind VPN/ZTNA by end of weekend
    • Freeze builds resolving to poisoned SAP/Lightning/intercom-client versions and rotate every CI/CD secret from April 29–May 4
    • Revalidate all DigiCert-signed binaries ingested April 2–May 2 and tighten CRL/OCSP refresh to ≤24 hours across fleet

    Sources:SANS NewsBites · TLDR InfoSec · CyberScoop

  2. 02

    AI-Generated Exploit Noise Is Degrading Your Triage Pipeline — And NVD Just Cut Enrichment

    act now

    The Convergence

    Three developments hit the same SOC bottleneck simultaneously: a flood of AI-generated copycat PoCs for CVE-2026-31431, the NVD announcing scope cuts to enrichment, and empirical proof at BSidesSF 2026 that AI-assisted exploitation has reached parity with human operators.

    CVE-2026-31431: The Triage Problem

    CISA added this Linux kernel privilege-escalation flaw to KEV this week. The bug has been in mainline since 2017 — nine years undetected. It is a post-foothold local privilege escalation: chain it with any RCE, webshell, or compromised CI runner and it returns root. Major distros have patches available.

    The novel dimension: Theori's disclosure was itself AI-generated, and the downstream PoC flood is largely AI-generated. Some PoCs work. Some are weaponized (trojanized). Most are noise. Signature-based triage degrades when the PoC corpus multiplies overnight. Analysts cannot reliably separate working exploits from hallucinated ones before their shift ends.

    NVD Scope Cut

    NVD announced it is scaling back CVE enrichment to only KEV entries, government-used, or 'critical' software — explicitly citing AI-generated vulnerability volume. Every vulnerability scanner, SBOM analyzer, and patch tool assuming universal NVD enrichment will develop blind spots. Alternative enrichment pipelines (CISA KEV + EPSS) move from nice-to-have to primary signal.

    BSidesSF 2026: Offensive AI Parity Is Empirical

    16 teams fully solved the BSidesSF 2026 CTF using coordinator-LLM architectures (Claude Opus 4.6 + GPT-5.4-mini in parallel), up from 1 team in 2025. Easy-to-medium exploitation is now a compute-spend problem. Detection engineering must assume faster time-to-exploit and broader opportunistic targeting, not just APT scenarios.

    A nine-year-old Linux kernel bug is being exploited in the wild while AI-generated noise makes triage a full-time job and NVD cuts the data your tools depend on. The triage pipeline itself is under attack.

    What This Changes

    AssumptionOld RealityNew Reality
    PoC qualityHuman-authored, reviewableAI-generated at volume; trojanized variants mixed in
    NVD completenessUniversal enrichmentKEV/critical only; gaps on secondary CVEs
    Exploitation speedDays-to-weeks post-advisoryHours; AI-assisted tooling compresses to compute spend
    Adversary skill floorRequires domain expertise16x more teams solving CTFs with LLM orchestration

    Action items

    • Patch CVE-2026-31431 across all Linux fleets (hosts, containers, K8s nodes) with internet-exposed and multi-tenant systems first within 72 hours
    • Issue PoC handling guidance: no execution of third-party CVE-2026-31431 PoCs outside isolated detonation environments; prefer vendor/distro patches as ground truth
    • Add CISA KEV + EPSS as primary vulnerability prioritization signals and build alternative enrichment pipeline independent of NVD
    • Update vuln-intel intake workflow to flag AI-authored advisories for mandatory human technical validation before they trigger patch SLAs

    Sources:CyberScoop · TLDR InfoSec · Techpresso · Last Week in AI

  3. 03

    Two New Campaigns Bypass Standard Defenses: AppSheet Email Auth and MSP Trust

    monitor

    AccountDumpling: Authenticated Phishing via Google AppSheet

    The operators are Vietnamese-linked. The mail is sent from Google's own AppSheet infrastructure, which passes SPF, DKIM, and DMARC by design for google.com-adjacent senders. Most gateway policies were written for Workspace sending paths, not AppSheet. Nothing is spoofed. The mail is legitimately authenticated.

    Four lure families are in rotation: Netlify-hosted fake Facebook help centers, Vercel-hosted security and blue-badge verification flows, Google Drive PDFs fronting live phishing panels, and recruiter-style approaches. Credentials, government IDs, and 2FA codes are funneled into Telegram bots for takeover and resale. Current confirmed scope: 30,000+ compromised Facebook business accounts.

    The gap is structural, not tactical. Sender-reputation filters do not flag google.com-adjacent infrastructure. URL-reputation systems lag on Netlify and Vercel disposable domains. The technique will outlive this actor because the authentication math favors the attacker until Google changes it.

    Salt Typhoon → IBM Italy → Italian Government

    Publicly: IBM has confirmed the April 2026 breach of Sistemi Informativi, its Italian MSP subsidiary, and says it was "identified and contained." Not publicly: La Repubblica attributes the intrusion to Salt Typhoon. The subsidiary runs IT infrastructure for Italian public agencies and critical industries. Scope is undisclosed and may not yet be known internally.

    Salt Typhoon's 2025–2026 roster reads like an MSP-pivot playbook: Viasat, Canadian telecoms, the US Army National Guard, the Dutch government. The access path of choice is Citrix and Cisco zero-days, not phishing. One MSP compromise yields downstream access to every client on the books, and clients rarely see MSP-side telemetry.

    Campaign Comparison

    CampaignVectorDefense GapUrgency
    AccountDumplingGoogle AppSheet-origin phishingSender reputation bypassed; Netlify/Vercel URL gapsHigh (days)
    Salt Typhoon via MSPCitrix/Cisco zero-day → supply chainThird-party standing privileges; weak MSP telemetryHigh (weeks)
    When attackers send mail from Google's own infrastructure and pivot through IBM's own subsidiary, the trust model your defenses rely on is the attack surface.

    Action items

    • Block or quarantine [email protected] senders and add URL rules for Netlify/Vercel-hosted Facebook/Meta brand impersonation pages within 48 hours
    • Audit MSP and managed-infrastructure access: enumerate third-party standing credentials, revoke persistent admin, enforce JIT access with session recording for Citrix/Cisco-adjacent vendors
    • Hunt for 90 days of AppSheet-originated mail in your tenant and flag any with Netlify/Vercel/Google Drive URLs for user notification
    • Confirm EDR telemetry from vendor-managed hosts lands in your SIEM, not just the MSP's tooling

    Sources:TLDR InfoSec · SANS NewsBites

◆ QUICK HITS

Quick hits

  • Update: Cisco confirmed $400M Astrix acquisition — NHI controls now bundling into Duo/ISE; existing Astrix customers should lock integration commitments before deal closes and roadmap visibility degrades

    TLDR IT

  • Update: xAI Custom Voices ships free 60-second voice cloning via API — same stack powering Starlink's automated support; enterprise vishing cost drops to zero, mandate non-voice second factor on all privileged resets

    Simplifying AI

  • Two ex-Sygnia/DigitalMint incident responders sentenced to 4 years for running ALPHV BlackCat affiliate operations; a third faces 20 years — add IR retainer vetting to insider-threat controls

    SANS NewsBites

  • Lazarus Group exploited LayerZero bridge bug to drain $292M from KelpDAO — enumerate any internal or vendor DeFi integration depending on LayerZero cross-chain messaging

    TLDR Crypto

  • Chinese 'industrial-scale' jailbreaking of US AI models formally attributed by White House — LLM abuse-detection logs now dual-use national-security evidence; set retention to ≥12 months with legal-hold quality

    Last Week in AI

  • Google confirms prompt injection in the wild: white-text SEO payloads targeting AI crawlers on live web pages — inventory every RAG pipeline ingesting web content and deploy indirect-prompt-injection sanitization

    Benedict Evans

  • FEMITBOT weaponizes Telegram Mini Apps for Android malware delivery outside Play Store telemetry — restrict Mini Apps on managed Android devices via MDM

    TLDR Crypto

  • OpenAI Codex now imports configs/agents/plugins from Claude Cowork in one click — block import endpoint pending governance review; audit last 30 days for unauthorized cross-platform migrations

    ben's bites

  • AI email summaries misrepresent source content 33% of the time with 82-87% front-half bias — issue SOC policy that AI summaries are not authoritative for IR triage; require full-source reads for alert-related email

    TLDR Marketing

◆ Bottom line

The take.

Three critical exploits are hitting trust infrastructure simultaneously — cPanel ransomware across 44,000 hosts, MOVEit in Clop's crosshairs with 1,400 exposed instances, and a supply-chain worm that leaked secrets from 1,800 repositories — while AI-generated PoC noise is degrading the SOC's ability to triage, and NVD just cut its enrichment scope. Patch cPanel and MOVEit this weekend, quarantine poisoned npm/PyPI packages and rotate CI secrets today, and stop trusting any AI-generated exploit code or advisory without human validation.

— Promit, reading as Security ·

Frequently asked

Which patches should I prioritize this weekend and in what order?
Patch cPanel/WHM first because CVE-2026-41940 (CVSS 9.8) is under mass exploitation across 44,000 IPs with 'Sorry' ransomware landing on Linux hosts. Patch MOVEit Automation to 2025.1.5, 2025.0.9, or 2024.1.8 next and pull instances behind VPN/ZTNA — 1,400+ are internet-facing in Clop's exact pre-campaign pattern. Then patch CVE-2026-31431 across Linux fleets within 72 hours.
Which specific package versions do I need to freeze for the Mini Shai-Hulud worm?
Freeze SAP mbt v1.2.48, @cap-js/db-service v2.10.1, @cap-js/postgres v2.2.2, and @cap-js/sqlite v2.2.2, plus the compromised PyTorch Lightning and intercom-client releases. The worm uses preinstall scripts to exfiltrate GitHub, npm, and cloud tokens, then uses those tokens to poison further packages — 8.3M downloads and 1,800+ leaking repos so far.
Which CI/CD secrets need rotation and what's the exposure window?
Rotate every CI/CD secret touched between April 29 and May 4, including GitHub tokens, npm publish tokens, and cloud credentials referenced in any build resolving to poisoned SAP, PyTorch Lightning, or intercom-client versions. Assume tokens are already exfiltrated and being used for lateral package poisoning; rotation before revocation of poisoned lockfile versions leaves the loop open.
How should analysts handle the flood of AI-generated PoCs for CVE-2026-31431?
Do not execute third-party PoCs outside isolated detonation environments — some are trojanized, most are hallucinated, and signature-based triage cannot separate them at shift speed. Treat vendor and distro patches as ground truth for remediation, and flag AI-authored advisories for mandatory human technical validation before they trigger patch SLAs.
Why do AppSheet phishing emails bypass SPF, DKIM, and DMARC?
Mail sent from Google's AppSheet infrastructure is legitimately authenticated as google.com-adjacent, so nothing is spoofed and standard sender-reputation filters pass it. Most gateway policies were written for Workspace sending paths, not AppSheet. Block or quarantine [email protected] senders and add URL rules for Netlify- and Vercel-hosted Meta brand impersonation pages.

◆ Same day, different angle

Read this day as…

  1. 15 shared

    Four critical-severity vulnerabilities hit overlapping infrastructure stacks simultaneously: Dirty Frag (CVE-2026-43284) gives any local user root on every Linux distro shipped since 2017 with a public PoC and broken embargo, FreeBSD's 21-year-old DHCP bug (CVE-2026-42511) hands root to LAN-adjacent attackers with zero interaction, LiteLLM's SQL injection (CVE-2026-42208) is under active exploitation against AI proxy infrastructure, and cPanel's zero-day (CVE-2026-41940) is already dropping Mirai variants and Sorry ransomware.

    Four root-level vulnerabilities hit your Linux, FreeBSD, AI proxy, and hosting layers simultaneously — Dirty Frag alone affects every distro…

  2. 13 shared

    Two credential-theft campaigns are live in CI/CD pipelines.

    Your CI/CD pipelines are under active attack from two directions — a TeamPCP Jenkins backdoor (third vector since February) and an npm worm…

  3. 13 shared

    Anthropic's Claude Mythos Preview has autonomously discovered thousands of high-severity zero-day vulnerabilities across every major OS, browser, and the Linux kernel — including bugs undetected for 27 years — and Alex Stamos estimates open-weight models will replicate this capability within 6 months.

    AI just discovered thousands of zero-days in every major OS and browser, and open-weight models will replicate this capability within 6 mont…

◆ Recent in security

Keep reading.

Spot an error? [email protected]