🛡️ CISO Intel — Saturday, 09-05-2026

Due to API rate limiting, here is today’s briefing:

Alright, team. Grab your coffee, it’s a Saturday, and the bad guys clearly didn’t get the memo about long weekends. The wire’s been buzzing.

🔴 Critical Threats & Active Exploitation

• Instructure Canvas LMS — ShinyHunters ransomware has defaced login portals for thousands of schools worldwide, demanding ransom. They claim 275 million user records. This isn’t just data exfil; it’s active disruption during finals week. Expect immediate user impact and major PR headaches.
• Palo Alto Networks PAN-OS — CVE-2026-0300 (CVSS TBD - Critical) — An unauthenticated attacker can achieve remote code execution with root privileges on Internet-exposed PA-Series and VM-Series firewalls via specially crafted packets. Actively exploited by CL-STA-1132, a likely state-sponsored actor. Patch or enable Threat ID 510019 (Applications and Threats content version 9098) immediately.
• Ivanti Endpoint Manager Mobile (EPMM) — CVE-2026-6973 (CVSS 7.0, but CISA KEV) — Authenticated admin RCE due to improper input validation, exploited in limited zero-day attacks. CISA added this to the KEV catalog. Apply updates (12.6.1.1, 12.7.0.1, or 12.8.0.1) and rotate admin credentials. Assume compromise if you run affected versions.
• Linux Kernel — CVE-2026-43284, CVE-2026-43500 (“DirtyFrag”) (CVSS TBD) — Local privilege escalation vulnerabilities allowing an unprivileged user to gain root access. Public PoC is out. CVE-2026-43284 has patches available as of May 8, 2026. CVE-2026-43500 (RxRPC issue) is still unpatched. Disable rxrpc kernel modules if not in use. This is a classic kernel LPE, don’t sleep on it.

🛡️ CVEs Worth Your Attention

• CVE-2026-29201, CVE-2026-29202, CVE-2026-29203 | cPanel | CVSS TBD | three new vulnerabilities, details under embargo until patch release. | PoC: No (details embargoed)
• CVE-2026-23918 | Apache HTTP Server 2.4.66 | CVSS High | double free vulnerability, potential RCE. | PoC: No
• CVE-2026-5787 | Ivanti EPMM | CVSS 8.9 | Improper certificate validation, allows remote unauthenticated attacker to impersonate Sentry hosts. | PoC: No
• CVE-2026-5786 | Ivanti EPMM | CVSS 8.8 | Improper access control, allows remote authenticated attacker to gain administrative access. | PoC: No
• CVE-2026-5788 | Ivanti EPMM | CVSS 7.0 | Improper input validation, allows remote authenticated admin RCE. | PoC: No
• CVE-2026-7821 | Ivanti EPMM | CVSS TBD | Improper certificate validation, allows remote unauthenticated attacker to enroll devices, leading to info disclosure. | PoC: No

⚡ New TTPs & Attack Research

• ShinyHunters Canvas Defacement — This group is now escalating attacks beyond data theft to visible login page defacements, applying direct pressure for ransom. It’s a blend of T1059.004 (Command and Scripting Interpreter: JavaScript) and T1498 (Defacement) with a clear extortion motive.
• CL-STA-1132 PAN-OS Exploitation — A state-sponsored cluster is leveraging the CVE-2026-0300 zero-day for unauthenticated RCE, injecting shellcode into nginx, then meticulously cleaning logs (T1070.004). Post-exploitation includes Active Directory enumeration (T1087.002) and deploying tunneling tools like EarthWorm and ReverseSocks5 (T1572). High-end tradecraft.
• “DirtyFrag” Linux Kernel LPE — This newly disclosed LPE (T1068) manipulates Linux page cache behavior for reliable privilege escalation. The fact it’s been lurking since 2017/2023 and was potentially discovered with AI assistance is a red flag for future bug hunting.
• “HumanitarianBait” Infostealer Campaign — Phishing (T1566.001) using RAR archives with LNK files. Payloads hosted on GitHub Releases (T1105) to evade scrutiny, installing remote access tools like RustDesk or AnyDesk for persistent access. Smart evasion.
• Quasar Linux (QLNX) Malware — A new Linux RAT targeting developers and DevOps environments. Features rootkit, backdoor, and credential-stealing capabilities. Spreads through npm, PyPI, GitHub, AWS, Docker, and Kubernetes. Dynamically compiles rootkit components and PAM backdoors on infected systems. T1543.003, T1547.006, T1558.003. This is a supply chain nightmare.
• MuddyWater False-Flag — Iranian APT group using Microsoft Teams social engineering (T1566.002) as initial access, then deploying Chaos ransomware as a false flag for espionage and data theft. Don’t assume ransomware is just ransomware.

🏗️ DevSecOps & Cloud Security

• Quasar Linux (QLNX) Malware — Directly impacts DevOps toolchains and cloud platforms (npm, PyPI, GitHub, AWS, Docker, Kubernetes). Review your CI/CD pipeline security and artifact integrity.
• Datadog Security Labs — Released a useful article on “Kubernetes security fundamentals: Secrets.” Good refresher for your container teams.
• Snowflake — Added tuple format support for ingress private endpoint identifiers in network rules. A small but positive security feature enhancement for PrivateLink users.

🔧 Patches & Vendor Releases

• cPanel — Patch released today, May 8, 2026, for CVE-2026-29201, CVE-2026-29202, CVE-2026-29203. Most managed hosting customers will get it automatically. 🟢 solid fix
• Linux Kernel — Patches for CVE-2026-43284 (DirtyFrag) are out. CVE-2026-43500 still pending. 🟡 partial/workaround needed (for CVE-2026-43500)
• Palo Alto Networks PAN-OS — Threat ID 510019 (Applications and Threats content version 9098) helps block attacks for CVE-2026-0300. Not a full patch, but a critical mitigation. 🟡 partial/workaround needed
• Ivanti EPMM — Updates to versions 12.6.1.1, 12.7.0.1, or 12.8.0.1 address multiple CVEs. 🟢 solid fix
• Apache HTTP Server — Version 2.4.67 fixes CVE-2026-23918. 🟢 solid fix
• MOVEit Automation — Security updates issued for two vulnerabilities, including a high-severity auth bypass. 🟢 solid fix

🧪 Threat Intel & Malware

• ShinyHunters — This ransomware group is making headlines by not just exfiltrating data from Instructure Canvas but actively defacing login pages to force ransom payments. They claim 275 million records from 9,000 schools.
• Akira Ransomware — Claimed responsibility for a data breach at Lautrec Ltd. in September 2025, which exposed sensitive PII and financial data. Disclosure to state AGs occurred yesterday.
• Safepay Ransomware — Responsible for a June 2025 breach at MemberSource Credit Union, exfiltrating 50 GB of data including SSNs and financial info. Public disclosure yesterday.
• PLAY Ransomware — Attacked Highmark Companies in November 2025, exposing full names, SSNs, financial, and health info. Disclosure yesterday.
• CL-STA-1132 — A sophisticated, likely state-sponsored group, actively exploiting the PAN-OS zero-day. Their tradecraft includes extensive log cleanup and Active Directory enumeration.
• Quasar Linux (QLNX) — A new, dangerous Linux malware implant. Targets developer and DevOps environments, acting as a rootkit, backdoor, and credential stealer. Its ability to dynamically compile modules on the fly makes it resilient.
• PCPJack — A credential-stealing framework spreading across exposed cloud infrastructure, linked to the TeamPCP supply chain attacks earlier this year. It’s designed to cover its tracks.
• MuddyWater (Iranian APT) — Observed conducting false-flag operations using Microsoft Teams social engineering, then deploying Chaos ransomware as a smokescreen for espionage and data theft. Attribution matters.

🌐 Industry, Brand & Internet Security

• Instructure Canvas LMS Breach — This is a massive concentration risk event for the education sector. Thousands of schools, millions of records, and critical systems offline during finals. The downstream impact on students and faculty is immense. This is what “business risk” looks like in practice.
• Multiple Ransomware Disclosures — Lautrec Ltd., MemberSource Credit Union, and Highmark Companies all publicly disclosed breaches from last year (Akira, Safepay, PLAY respectively) yesterday. These delayed disclosures highlight the long tail of ransomware incidents and regulatory reporting requirements.
• DigiCert Security Incident — Attackers infiltrated internal systems and stole 27 code signing certificates. This is a supply chain integrity nightmare. If your certificate authority is compromised, trust evaporates.
• Daemon Tools Lite Supply Chain Attack — Malicious code injected into installers between April 8 and May 5. Yet another reminder to verify software downloads, even from legitimate vendors.
• Terrorism Risk Insurance Program (TRIP) & Cyber — Discussion is ongoing regarding the application of TRIA to cyberattacks. The difficulty of attribution in cyber makes it hard to trigger “terrorism” clauses, potentially leaving companies exposed. This is a CISO-level discussion for your risk and legal teams.

🤖 AI & LLM Security

• AI for Bug Discovery — Speculation that AI assisted in discovering the long-standing “DirtyFrag” Linux kernel vulnerabilities. This is a double-edged sword: AI helps defenders, but also attackers.
• New AI Security Products — Operant AI launched Endpoint Protector for securing AI agents and MCP tools. Sysdig introduced “Headless Cloud Security” for agentic AI defense. VIAVI released CyberFlood CF1000 for validating AI data center security. The market is reacting to the AI threat surface.
• Anthropic Mythos & OpenAI GPT-5.5 — Anthropic’s Mythos is aiding Mozilla in bug fixing, and OpenAI is formalizing trusted-