Security Bulletins
Operator-facing response guides for active and recent security incidents affecting AI infrastructure, developer tooling, and the supply-chain surfaces that most pipelines depend on. Each bulletin links to its primary source and lists concrete steps to take if you were affected.
-
Catch-Up Bulletin, September 26 to October 2, 2026: NetScaler Under Active Exploitation, an Unpatched FortiMail Path Traversal, and the Zammad Zero-Days That Breached DIVD
Seven days, five products with confirmed exploitation in the wild, and one of them has no patch. The lead is Citrix NetScaler CVE-2026-88771 (CVSS v4 9.5), unauthenticated command execution against every ADC and Gateway in its default configuration with no feature required, which Cloud Software Group says has been exploited along with CVE-2026-88772; both reached KEV on September 27 and the bulletin CTX697096 carries six more CVEs. FortiMail CVE-2026-104286 (CVSS 9.8) is more urgent per host: an unauthenticated path traversal that Fortinet marks Known Exploited, where the solution column still reads "upcoming" for 8.0.2, 7.6.7 and 7.4.9 and the 7.2 branch gets no fix at all, so the only actions are the IBE workaround and hunting the published implant. Zammad CVE-2026-102489 and CVE-2026-102490 are the chain that breached DIVD itself on September 21, by DIVD's account driven by an autonomous AI agent, and both reached KEV on October 2 with an October 5 due date; go to 7.2.0, which satisfies both DIVD's advice and Zammad's own statement disputing part of it, while the escalation to root still has no published fix. Also covered: Cisco Catalyst SD-WAN Manager CVE-2026-76504, where one percent-encoded character bypasses authentication into the admin API; a critical Next.js RCE in
next/og; a PyJWT bypass that turns a public key into the HMAC secret; fifteen vm2 advisories, ten of them critical sandbox escapes; Apple CoreGraphics CVE-2026-86950; path traversal indecompress, whose unmaintained upstream will never be fixed; and a prototype-pollution gadget inpiscinathat preloads attacker code into every worker. Preserve evidence on any exposed NetScaler and then install 14.1-73.37 or 13.1-64.23; hunt FortiMail, then disable its IBE and get its webmail interface off the internet; run DIVD's log check and move Zammad to 7.2.0; patch vManage; and in one pass raise next to 16.3.6, pyjwt to 2.14.0 and vm2 to 3.11.7. Note one gap stated in the bulletin: the Citrix blog carrying the NetScaler indicators of compromise was unreachable, so none are reproduced. Updated October 4: both Zammad CVEs reached KEV, Zammad published a statement disputing DIVD's scope, and Fortinet revised its advisory, moving the surface to restrict from the management to the webmail interface and withdrawing its file hashes. -
KEV Supplement, September 13 to September 25, 2026: WordPress Core Under Active Exploitation, a Network-Reachable Kernel Flaw, and the Exploited Appliances the Catch-Up Could Not See
A supplement covering the KEV half of the gap the September 25 catch-up declared: that edition could not reach CISA KEV or any vendor advisory, and the window it could not see held 17 KEV additions. The lead is WordPress Core CVE-2026-87902, where an unauthenticated attacker makes
get_page_template()include a readable local PHP file from outside the active theme. Patchstack recorded first exploitation traffic at 11:49 UTC on September 22, the day WordPress shipped 7.1.2, and reported the next day that attackers had progressed to chaining it through PEAR'spearcmd.phpto write attacker-controlled PHP to disk. The CVE record puts every version below 7.1.2 in scope, and backports stop at 4.7, so older installs are affected with no fix. Also covered: three Linux kernel flaws added September 18, one of them (CVE-2025-39682) rated CVSS 9.8 with a network vector and no privileges required, unlike the other two; the Acronis Backup plugins for cPanel and WHM, Plesk and DirectAdmin (CVE-2026-87886), a local privilege escalation on exactly the control panels this audience self-hosts; Adobe Commerce and Magento (CVE-2026-71362, CVSS 9.1) for the second time in a month; MikroTik RouterOS (CVE-2026-67279), fixed in the same builds as the September 12 round-up's flaw; and nine more exploited products, seven at CVSS 9.3 or higher and eight unauthenticated. Search your web logs before updating WordPress, then update; reboot into a fixed kernel and prioritise hosts terminating kernel TLS; capture the Acronis permissions before updating the plugin; take the 2026-aug Magento release; restrict RouterOS SSH; and work the appliance table by exposure rather than by score. -
Catch-Up Bulletin, September 13 to September 25, 2026: anyio TLS Spoofing Reaches Dependabot, Unauthenticated RCE in LMDeploy, and a Developer-Workstation Cluster in Amazon Q, Cline, and Rsdoctor
A thirteen-day round-up, and a deliberately narrower one: the build environment for this edition could not reach CISA KEV, any vendor PSIRT, or any research-team blog, so it covers the dependency and developer-tooling surface only and says so throughout. The lead is anyio CVE-2026-63374 (CVSS 9.3), TLS certificate spoofing for internationalized domains in the library underneath FastAPI, Starlette, and httpx, fixed in 4.14.2 on July 12 but only entered into the GitHub Advisory Database on September 18, which is when most teams' scanners began flagging it. Next is LMDeploy CVE-2025-66455 (CVSS 9.8), an unauthenticated pickle deserialization RCE in the DistServe endpoint of a widely used LLM serving stack, fixed in 0.16.0. A developer-workstation cluster landed together on September 24: Amazon Q's language server (CVE-2026-12957) runs workspace-defined commands when you open a crafted project and trust it, Cline (CVE-2026-59723) lets any page you visit drive its local dashboard into code execution, and Rsdoctor (CVE-2026-61782) serves your build source from an unauthenticated API bound to all interfaces. Also covered: two MCP servers with broken authentication (mcp-atlassian at CVSS 10.0, dbhub via DNS rebinding), Podman leaking host environment variables to malicious images, a RabbitMQ Go client parser desynchronization, and a roll-up of ZITADEL, OpenBao, hpack, and others. Re-resolve Python lockfiles with floors of anyio 4.14.2 and hpack 4.2.0; upgrade LMDeploy and firewall its DistServe endpoint; update Amazon Q (Language Servers for AWS 1.69.0, not 1.65.0), Cline, and Rsdoctor on workstations; upgrade mcp-atlassian, dbhub, Podman, and amqp091-go. Check your own vendor feeds for the edge and Patch Tuesday coverage this edition could not verify. September 28 update: CISA KEV and the CVE Program records are reachable again, and the KEV half of that gap is now covered: the window held 17 KEV additions, led by WordPress Core CVE-2026-87902. Non-KEV vendor advisories and Patch Tuesday remain uncovered for this window. See the KEV supplement.
-
Catch-Up Bulletin, August 28 to September 12, 2026: GitLab and Artifactory Exploited Within Days, the Trinitite npm Worm, Starlette and LiteLLM on CISA KEV, Magento StyleSmuggler, and an Edge-Appliance Roll-Up
A two-week round-up ranked by breadth of exposure. The lead is GitLab CVE-2026-85706 (CVSS 10.0), an unauthenticated arbitrary file read through the commits API, patched September 10 and probed within hours; next is JFrog Artifactory, where Wiz saw CVE-2026-42018 chained with CVE-2026-42016 from mid-August and CVE-2026-82329 on its own from September 1, both used to mint admin tokens and plant Rust backdoors. On npm, the Trinitite worm turned an exposed publish workflow into ten signed malicious versions of
@7nohe/openapi-react-query-codegen, with a wipe-on-revoke handler described by two independent analyses, and a May Shai-Hulud payload was republished through npm's new scanner. CISA added Starlette (under FastAPI), LiteLLM (MCP auth bypass), and Kestra (root RCE) to KEV for bugs fixed months ago; Magento was exploited three days before Adobe's hotfix; vLLM shipped seven advisories (six fixed by 0.29.0); and Cisco FMC, Citrix NetScaler, FortiGate CAPWAP, SonicWall SMA1000, MikroTik, N-central, ScreenConnect, Chrome, and Windows all had exploited flaws. Upgrade and audit any reachable GitLab or Artifactory; grep lockfiles for the Trinitite versions and isolate before revoking; upgrade Starlette, LiteLLM, and Kestra; hotfix and scan Magento stores; patch the listed appliances and hunt with the vendor's indicators. -
Catch-Up Bulletin, June 23 to August 28, 2026: The keyv npm Worm, Two Container-Escape Kernel Bugs, OpenSSH 10.4, and Actively Exploited GitLab, Metabase, and vCenter Flaws
A nine-week round-up of what mattered most for this audience. The lead item is the August 4 keyv / CHAINDROP npm worm: a compromised maintainer account trojanized
keyv,flat-cache,file-entry-cache,cacheable-request, andcache-manager(over two billion combined monthly installs), then spread to 440+ packages, stealing cloud, GitHub, npm, Kubernetes, Vault, and AI-tool credentials and persisting through hooks in.claude/settings.jsonand.vscode/tasks.json. Also covered: GhostLock (CVE-2026-43499) and RefluXFS (CVE-2026-64600), two local-root kernel bugs that escape default containers with no runtime mitigation; the OpenSSH 10.4 client use-after-free (CVE-2026-60002); GitLab CVE-2026-19478, Metabase CVE-2026-72898, and vCenter CVE-2026-59310, all exploited within days of disclosure; the AsyncAPI import-time npm compromise; Langflow on CISA KEV; the Node.js July 29 release; the RubyGems legacy key leak; and an edge-appliance roll-up. Sweep every machine that ran npm install since August 4 for the CHAINDROP IOCs, remove persistence and then rotate; reboot into fixed kernels; update OpenSSH; patch and audit any exposed GitLab, Metabase, or vCenter. September 12 update: the Cisco FMC hotfix list this bulletin could not fetch is now in the edge section of the newer round-up, and libssh2 still has no release after 1.11.1; see the August 28 to September 12 catch-up. -
libssh2 Client-Side Heap-Overflow RCE (CVE-2026-55200) and Pre-Auth DoS (CVE-2026-55199): No Fixed Release Yet, Pin to the Patch Commits
Two vulnerabilities in libssh2, the client-side SSH library embedded in curl/libcurl, many Git builds, the PHP
ssh2extension, and router/IoT and infrastructure tooling, were published on June 16-17, 2026 (credit: Tristan Madani). CVE-2026-55200 (CVSS 9.2, NVD rates it CRITICAL) is an out-of-bounds heap write inssh2_transport_read()that fails to bound thepacket_lengthfield: a malicious or MITM SSH peer can send an oversized packet, corrupt the heap, and potentially reach remote code execution in the process linking libssh2. CVE-2026-55199 (CVSS 8.2) is a pre-auth DoS in theSSH_MSG_EXT_INFOhandler that pins a client in a CPU loop for 60+ seconds. Both fire before authentication, both require the client to connect out to a hostile server (this is a client library, not a server, so it is not internet-facing sshd exposure despite some headlines). All releases through 1.11.1 are affected, and there is no fixed release tag yet: the fixes exist only asmastercommits (97acf3dffor the RCE,17626857for the DoS). No confirmed in-the-wild exploitation. Inventory everything that links libssh2 (including vendored and firmware copies), track your distro's backported build or pin to the fix commits, and verify SSH host keys so a machine-in-the-middle cannot swap in a hostile server. -
AUR Supply-Chain Compromise (Atomic Arch, 400+ Packages), Check pacman -Qm, Rotate Credentials, Reinstall if a Rootkit Landed
Around June 11, 2026 an attacker mass-adopted more than 400 orphaned packages in the Arch User Repository and edited their
PKGBUILD/.installfiles to run a malicious post-install hook that pulls a rogue npm package (atomic-lockfile; a later, separately reported wave usedjs-digestvia Bun). The bundled native Linux binary is both a credential infostealer (GitHub, SSH, HashiCorp Vault, browser stores, Slack/Discord/Teams/Telegram, env vars, crypto wallets) and an eBPF rootkit that hides its own processes, files, and connections. Because the AUR install hook runs underpacmanas root, the rootkit can load with kernel privilege on any host that installed or rebuilt an affected package in the window, so treat such hosts as potentially compromised. Sonatype named it "Atomic Arch" (Sonatype-2026-003775, CVSS 8.7); there is no CVE. The official Arch[core]/[extra]repos are not affected, only the AUR. Arch staff removed the malicious commits around 17:30 UTC June 12 and banned the accounts. If any Arch or Arch-derived machine installed or rebuilt an AUR package on or after June 11: cross-reference yourpacman -Qmset against the affected list, checkbpftool map listfor thehidden_pids/hidden_names/hidden_inodesmaps, rotate every credential the host could reach from a clean machine, and reinstall from scratch if the rootkit is confirmed. -
HTTP/2 Bomb Remote Memory-Exhaustion DoS (CVE-2026-49975): Cap Header Count or Disable HTTP/2 on nginx, Apache, IIS, Envoy, and Pingora
Researcher Quang Luong published a writeup and public PoC for the "HTTP/2 Bomb," a remote denial-of-service that lets one attacker on a home connection drive a vulnerable web server to allocate tens of gigabytes of memory in seconds, unauthenticated. It chains an HPACK indexed-reference bomb (one wire byte expands to a full header allocation, repeated thousands of times) with a zero-byte flow-control window that stops the server ever freeing that memory, and reproduces in the default HTTP/2 config of nginx 1.29.7 and earlier, Apache httpd 2.4.67 and earlier, Microsoft IIS (Windows Server 2025), Envoy 1.37.2 and earlier, and Cloudflare Pingora 0.8.0. Amplification runs up to ~5,700:1 (Envoy). The Apache variant is CVE-2026-49975. nginx fixed it in 1.29.8 (7 Apr 2026, the
max_headersdirective, default 1000); Apache in standalone mod_http2 v2.0.41 (27 May 2026); IIS, Pingora, and most current Envoy releases had no fix at publication. PoC is public; no confirmed in-the-wild exploitation. This is availability impact only, not RCE or data exposure (the NVD 9.8 overstates a pure DoS). If you terminate HTTP/2 directly on an internet-facing instance, get onto a fixed build (nginx 1.29.8+, Apache mod_http2 v2.0.41+) or, where none exists, disable HTTP/2 or front the listener with a proxy that enforces a hard header-count cap plus per-connection memory limits. -
TrapDoor Crypto Stealer Across npm, PyPI, and Crates.io (34+ Lure Packages), Grep Your Lockfiles and Rotate Wallet Keys
Socket disclosed TrapDoor, a single coordinated campaign that published at least 34 malicious packages and 384+ versions across npm, PyPI, and Crates.io at once. These are not hijacks of popular libraries but net-new lures named to attract crypto, DeFi, Solana, Sui/Move, AI, and security developers (
wallet-security-checker,defi-threat-scanner,move-compiler-tools, and similar). Onnpm install(postinstall),import(PyPI), orcargo build(build.rs), a shared payload steals Sui/Solana/Aptos and web3 wallet data and seed phrases, SSH keys, AWS credentials, GitHub tokens, browser data, environment variables, and API keys, exfiltrating to attacker GitHub infrastructure (ddjidd564.github.io); a secondary vector injects hidden-Unicode instructions into.cursorrules/CLAUDE.mdvia PRs. Socket reports a median detection of 5m27s and that some packages were still live at writing, but published no C2 IPs, hashes, or wallet addresses, so package names are the detection signal. Grep every npm, pip, and cargo lockfile for the named packages; if any host installed, imported, or built one, treat it as wallet- and credential-compromised: move crypto funds to a fresh wallet on a clean device, rotate every reachable secret, rebuild clean, and review your repos' AI config files. -
Next.js WebSocket Upgrade SSRF (CVE-2026-44578): Patch Self-Hosted Deployments, Jump to 15.5.18 or 16.2.6 Not 15.5.16 / 16.2.5
Vercel's May 6 coordinated security release for Next.js includes
GHSA-c4j6-fc7j-m34r, a pre-auth server-side request forgery in the WebSocket upgrade handler of self-hosted Next.js applications running on the built-in Node.js server. An unauthenticated attacker who can reach the origin can cause it to proxy HTTP requests to arbitrary internal or external destinations, including cloud instance metadata services (IMDS at169.254.169.254) and any internal-only service reachable from the origin host. The MITRE CVE record (published May 13) lists CVSS 3.1 base 8.6 HIGH (CWE-918). Affected:next >= 13.4.13 < 15.5.16and>= 16.0.0 < 16.2.5. Vercel-hosted and Netlify-Functions-only deployments are not affected. PoC code is public; no confirmed in-the-wild exploitation as of publication. Upgradenextto 15.5.18 or 16.2.6 (not the minimum 15.5.16 / 16.2.5, which leaves the May 7 Turbopack follow-up open), enforce IMDSv2 with hop-limit 1 on cloud VMs hosting Next.js origins, and if you cannot patch immediately, drop or 403 unsolicitedUpgrade: websocketrequests at your reverse proxy. -
mistralai PyPI 2.4.6 Compromise: Credential Stealer with Geofenced rm -rf Branch, Pin Below 2.4.6 and Triage Linux Hosts
Microsoft Threat Intelligence disclosed that version
2.4.6of the official Mistral AI Python client on PyPI has been compromised. Code injected intomistralai/client/__init__.pyexecutes on import, downloads a second-stage payload from83.142.209.194/transformers.pyzto/tmp/transformers.pyzon Linux, and installs persistence aspgsql-monitor.servicewith a companionpgmonitor.py. The second-stage filename deliberately mimics Hugging Face Transformers to blend into ML developer environments. The main payload is a credential stealer; a geofenced destructive branch has a 1-in-6 chance of executingrm -rf /when the system appears to be in Israel or Iran, and the malware avoids Russian-language environments. PyPI's cached listing shows the legitimate 2.x line ending at2.0.1(March 12, 2026), which makes the jump to 2.4.6 itself anomalous and is consistent with quarantine action. Capmistralai < 2.4.6(or pin exactly to2.0.1) everywhere, block egress to 83.142.209.194, hunt for/tmp/transformers.pyzand the systemd unit on every Linux host that ranimport mistralaisince 2.4.6 was published, and rotate credentials reachable from those hosts. -
Ollama Bleeding Llama and Windows Auto-Update RCE: Patch, Restrict Exposure, Disable Windows Auto-Update
Cyera Research disclosed CVE-2026-7482 ("Bleeding Llama"), a CVSS 9.1 unauthenticated heap out-of-bounds read in Ollama's GGUF model loader that leaks system prompts, API keys, environment variables, and other users' conversation data in three HTTP calls. Cyera estimates ~300,000 Ollama servers are internet-exposed; the upstream
/api/createand/api/pushendpoints have no authentication by default. The fix shipped in 0.17.1 on Feb 25 but was not flagged as a security update, so many operators are unknowingly still vulnerable. Separately, Striga and CERT Polska published CVE-2026-42248 and CVE-2026-42249 on April 29: a path traversal plus no-op-signature-verification chain in Ollama's Windows auto-updater that produces persistent silent code execution at every login. That chain has no patch as of May 10, including in v0.23.2 (May 7); the vendor stopped responding to Striga's reports in January and CERT Polska had to take over coordination. Upgrade to 0.23.2 to close Bleeding Llama, bind to 127.0.0.1 or put an auth proxy in front of any reachable instance, rotate secrets that were ever in the Ollama process environment, and on Windows additionally disable auto-download updates and remove the Ollama shortcut from the Startup folder. -
Dirty Frag (CVE-2026-43284, CVE-2026-43500), Second Linux Kernel LPE in a Week, Bypasses the Copy Fail Mitigation
Hyunwoo Kim (@v4bel) publicly disclosed "Dirty Frag" on oss-security after the embargo was broken by an unrelated third party. The chain combines two page-cache write primitives, one in the IPsec ESP path (
esp4/esp6, CVE-2026-43284, rated 7.8 HIGH by CISA-ADP and Important by Red Hat) and one inrxrpc(CVE-2026-43500, NVD pending), and gives unprivileged local users root in a single command on affected systems. Critically, the Copy Fail mitigation (algif_aeadblacklist) does not block Dirty Frag. A second public exploit, "Copy Fail 2: Electric Boogaloo," targets the same vulnerability under a different name. AlmaLinux is the only mainstream distribution shipping patched kernels (testing repo) at publication; Red Hat has published RHSB-2026-003 and is expediting kernel updates; Ubuntu, SUSE, and CloudLinux updates are in build. Apply the three-module modprobe blacklist now and patch when your distribution ships. -
DigiCert Misissuance via Support-Channel Compromise (Bug 2033170), 60 EV Code-Signing Certificates Revoked, 27 Used to Sign Malware
DigiCert's Final Incident Report on the Mozilla CA compliance tracker (Bug 2033170) describes how a threat actor compromised a customer support analyst's machine through the support chat channel using a
.screxecutable disguised as a screenshot (endpoint security blocked four delivery attempts, the fifth succeeded), then used internal support-portal access to harvest initialization codes for ordered-but-not-yet-retrieved EV code-signing certificates. 27 certificates explicitly attributed to the threat actor were used to sign malware in the wild; 33 more were revoked precautionarily. 60 revocations total across four DigiCert intermediate CAs. Detection of the second compromised machine (ENDPOINT2) came from an external researcher's tip eleven days after DigiCert had concluded the original investigation, not from DigiCert's own monitoring; the EDR onENDPOINT2had not been functioning correctly. DigiCert's three contributing factors (file-type filtering on the support channel did not block.scr, EDR coverage was inconsistent, initialization codes were not adequately protected) generalize beyond the immediate incident to anyone running a customer-attachment intake channel or an internal "view-as-customer" tool. -
PAN-OS Captive Portal Pre-Auth RCE-as-Root (CVE-2026-0300): Mitigate Now; Some Fixes Not Due Until May 28
Palo Alto Networks PSIRT disclosed a buffer overflow in PAN-OS's User-ID Authentication Portal (Captive Portal) that lets an unauthenticated attacker reach root on PA-Series and VM-Series firewalls by sending specially crafted packets. CVSS-BT 9.3 CRITICAL, urgency HIGHEST, exploit maturity marked ATTACKED: vendor-confirmed in-the-wild exploitation already observed against portals exposed to untrusted IPs or the public internet. Patches are not yet available for every affected branch; fix ETAs span May 13 and May 28, 2026. Threat Prevention signature available 5 May for PAN-OS 11.1+; PAN-OS 10.2 customers must rely on the workaround. Prisma Access, Cloud NGFW, and Panorama are not affected. Restrict the portal to trusted internal zones now or disable it entirely; treat any internet-exposed firewall during the active-exploitation window as potentially compromised.
-
DAEMON Tools Supply-Chain Compromise (Apr 8 – Ongoing), Trojanized Installers Signed With Vendor's Legitimate Cert
Kaspersky GReAT disclosed that DAEMON Tools, a widely used Windows disk-image-mounting utility, has been distributing malware-laden installers from its official site since April 8, 2026, signed with the legitimate AVB Disc Soft Authenticode certificate. Three binaries (
DTHelper.exe,DiscSoftBusServiceLite.exe,DTShellHlp.exe) in versions 12.5.0.2421 through 12.5.0.2434 are tampered to launch a backdoor at every startup, beaconing to a typosquat C2 (env-check.daemontools[.]cc). Thousands of infections across 100+ countries; ~10% in business environments. ~12 hosts in government, scientific, manufacturing, retail, and education sectors in Russia, Belarus, and Thailand received targeted second-stage backdoors, including a multi-protocol "QUIC RAT." Chinese- language artifacts noted in the implants but no formal attribution. Campaign reported as still active. Vendor notified; no public advisory yet. Hash-check the affected binaries, hunt the dropped payloads, block the C2, and treat the Authenticode signature as no defense. -
cPanel & WHM Authentication Bypass (CVE-2026-41940), Patch Now and Hunt for Pre-Patch Compromise
cPanel (WebPros) released emergency patches April 28 for what its release notes called "an issue with session loading and saving." The bug was assigned CVE-2026-41940 the next day with CVSS 9.8: an unauthenticated CRLF injection in
cpsrvd's session-handling code that lets a remote attacker promote a pre-auth session torooton WHM, bypassing both password and 2FA gates. Per the cPanel advisory, affects cPanel software including DNSOnly across all versions after 11.40, plus WP Squared. watchTowr Labs published the full chain and a public Detection Artifact Generator on April 29; Searchlight Cyber separately documented that simply closing WHM/cPanel ports is not full containment because cPanel's per-vhost/___proxy_subdomain_whm/path keeps the same endpoints reachable on 80/443. KnownHost reports execution attempts in the wild as early as February 23, 2026, well before the public advisory; Rapid7's Shodan figure puts internet-exposed cPanel instances at roughly 1.5 million. Patch immediately, then hunt/var/cpanel/sessions/for injection artifacts. -
PyTorch Lightning 2.6.2 / 2.6.3 Compromised on PyPI, What to Do If You Installed It
Aikido, Socket, and StepSecurity confirm that two new releases of the popular
lightningPython package (PyTorch Lightning, 31k+ GitHub stars, hundreds of thousands of daily downloads) contain a credential-stealing payload injected into__init__.py. The malware runs on everyimport lightning, downloads an 11 MB Bun-based JavaScript payload, and exfiltrates encrypted credentials to public GitHub repos created under the victim's own account, using commit identities that impersonate Anthropic's Claude Code. PyPI has quarantined the project. Same campaign as the Bitwarden CLI and SAP npm compromises ("Mini Shai-Hulud"). Last pre-incident release: 2.6.1, but the entirelightningproject is currently quarantined on PyPI, so reinstall from a verified internal artifact rather than PyPI itself. -
Copy Fail (CVE-2026-31431), Public PoC for Linux Kernel LPE Across Mainstream Distros Since 2017
Theori's Xint Code team disclosed "Copy Fail," a logic flaw in the Linux kernel's
algif_aeadcrypto socket interface. A 732-byte Python PoC (already public on GitHub) was directly demonstrated against Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16, with no race window and no kernel-version-specific offsets. The page-cache primitive crosses container boundaries, making this critical for Kubernetes nodes, self-hosted CI runners, and any cloud SaaS running tenant code. May 4 update: WSL2 is confirmed vulnerable; Microsoft is shipping the patched WSL2 kernel via the May 12 Patch Tuesday rollout. CISA added the CVE to the KEV catalog on May 1 with a federal patch deadline of May 15. Microsoft Defender reports preliminary in-the-wild testing activity. May 8 update: thealgif_aeadmitigation does not block the new Dirty Frag chain; hosts hardened against Copy Fail need a separate mitigation. -
GitHub Push-Pipeline RCE (CVE-2026-3854), Patched on github.com, GHES Admins Must Upgrade
Wiz Research and GitHub disclosed a critical RCE in GitHub's internal git push pipeline. A single
git pushwith crafted-opush options achieved arbitrary command execution as thegitservice user via X-Stat header injection. Reported March 4, fixed on github.com the same day, GHES patches released March 10, public disclosure April 28. github.com / GHEC: no action needed. GHES self-hosters: upgrade immediately. No exploitation found in GitHub's forensic review. CVSS 8.7 per Wiz. -
Bitwarden CLI 2026.4.0 Compromised on npm, What to Do If You Installed It
Socket reports
@bitwarden/cliversion2026.4.0on npm was compromised, with malicious code inbw1.jsexecuted via a preinstall hook. Bitwarden's April 23 statement confirms the package was live on the npm delivery path for roughly 90 minutes, between 5:57 PM and 7:30 PM ET on April 22. Same C2 infrastructure as the Apr 22 Checkmarx compromise (audit.checkmarx[.]cx), with self-propagation via npm-token theft. Targets developer credentials, cloud secrets, GitHub tokens, npm tokens, and Claude/MCP configuration files. Bitwarden says vault data and production systems were not compromised; Chrome extension and MCP server are reported unaffected. -
Checkmarx KICS Docker Hub Compromise, What to Do If You Pulled the Affected Images
Attackers overwrote legitimate
checkmarx/kicsDocker tags (v2.1.20,v2.1.20-debian,alpine,debian,latest) with poisoned versions and published counterfeitv2.1.21/v2.1.21-debiantags. The modified KICS binary harvests secrets from any IaC files it scans and exfiltrates toaudit.checkmarx[.]cx. Related Open VSX extensionscx-dev-assist(1.17.0, 1.19.0) andast-results(2.63.0, 2.66.0) were also flagged for fetching and executing remote code via the Bun runtime. -
xinference PyPI Compromise, What to Do If You Installed It
Three xinference releases (
2.6.0,2.6.1,2.6.2) were trojanized on PyPI with code in__init__.pythat runs on every import. The payload harvests SSH keys, Git credentials, AWS material (IMDS, Secrets Manager, SSM), Kubernetes tokens, Docker auth,.envfiles, and TLS keys, exfiltrating towhereisitat[.]lucyatemysuperbox[.]space. Attribution to TeamPCP is contested. -
Lovable BOLA Exposure, What to Do If You Built an App on Lovable
A researcher disclosed a Broken Object Level Authorization flaw in Lovable's
/projects/{id}/*endpoints that reportedly allowed unauthenticated access to source code, chat history with embedded secrets, and Supabase service keys for projects created before approximately November 2025. Lovable disputed the framing and has not, based on public sources reviewed, published a formal incident bulletin. -
Vercel × Context.ai OAuth Supply-Chain Breach, What to Do as a Vercel Customer
A compromise of Context.ai (per Hudson Rock, traced to a Lumma Stealer infection on a Context.ai employee originating from a Roblox cheat download) led to OAuth-token abuse against a Vercel employee's Google Workspace via Context.ai's Chrome extension, and subsequent enumeration and decryption of customer environment variables not marked sensitive. Vercel's April 23 update expanded customer notifications after broader log review and flagged additional accounts with prior, independent compromise.