https://blog.dansec.red/actors/sorry/Recent content in Sorry on DanSec DailyHugoen-gbSun, 03 May 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-05-03-cybersecurity-news/Sun, 03 May 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-05-03-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>The &ldquo;Sorry&rdquo; ransomware group is conducting mass exploitation of a critical cPanel vulnerability (CVE-2026-41940) to breach websites and encrypt data.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>CISA has added CVE-2026-31431, a Linux root access vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw impacts multiple Linux distributions and is currently being actively exploited.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>A Finnish teenager has been formally charged in connection with the Scattered Spider hacking spree.</li> <li>The &ldquo;Sorry&rdquo; ransomware group is actively exploiting the cPanel vulnerability (CVE-2026-41940) in widespread attacks.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>A new phishing kit called Bluekit, still under development, includes automated domain registration features and an integrated AI assistant to aid attackers.</li> <li>&ldquo;ConsentFix v3&rdquo; attacks are targeting Azure environments by automating OAuth abuse at scale, with the technique being circulated on hacker forums.</li> <li>Disneyland has introduced facial recognition technology for visitor identification.</li> <li>The NSA is testing Anthropic’s Mythos Preview tool to identify vulnerabilities.</li> </ul>