Cybersecurity Brief – 2026-05-10

Sun, 10 May 2026 00:00:00 +0000

Major Incidents or Breaches

The JDownloader website was compromised to distribute malicious installers for both Windows and Linux users. The Windows installer deployed a Python-based RAT (Remote Access Trojan).
NVIDIA confirmed a data breach affecting GeForce NOW users in Armenia, exposing user information.
Trellix experienced a source code repository breach, with the RansomHouse threat group claiming responsibility and leaking proof-of-intrusion images.
Zara suffered a data breach exposing personal information of over 197,000 customers.
Instructure, the company behind the Canvas educational platform, was hit by a second attack claimed by ShinyHunters, with PII of hundreds of millions at risk. The attack also resulted in defacement of school login portals and ransom demands.
The Canvas system, used by thousands of educational institutions, went offline due to a cyberattack, disrupting students during finals.
AI firm Braintrust reported a breach in which attackers accessed an AWS account and compromised AI provider secrets, prompting API key rotation.
Polish Security Agency reported ICS (Industrial Control Systems) breaches at five water treatment plants, where attackers gained the ability to modify operational parameters, posing a direct risk to public water supplies.

Newly Discovered Vulnerabilities

cPanel released updates for three newly discovered vulnerabilities in cPanel and Web Host Manager (WHM), which could allow privilege escalation, code execution, and denial-of-service attacks.
A new Linux local privilege escalation vulnerability, “Dirty Frag,” was disclosed, following closely after the “Copy Fail” vulnerability (CVE-2026-31431).
CISA issued an emergency directive for U.S. federal agencies to patch a high-severity Ivanti Endpoint Manager Mobile (EPMM) vulnerability exploited as a zero-day within four days.

Notable Threat Actor Activity

A previously undocumented Brazilian banking trojan, TCLBANKER, was identified targeting 59 banking, fintech, and cryptocurrency platforms via WhatsApp and Outlook-based worms.
Quasar Linux RAT (QLNX), a new Linux remote access trojan, is targeting developer systems to steal credentials and facilitate software supply chain compromise.
ShinyHunters escalated attacks against the Canvas platform, moving from data theft to ransom-driven defacement of school login portals.
RansomHouse claimed responsibility for the Trellix source code repository breach.
A malicious repository on Hugging Face impersonated an OpenAI project to deliver information-stealing malware to Windows users.

Trends, Tools, or Tactics of Interest

Reports indicate the time between initial phishing email delivery and full organizational compromise has reduced to seconds, highlighting increased attack speed and automation.
Fraudulent Android apps masquerading as call history tools were discovered on Google Play Store, tricking users into unauthorized payments and amassing 7.3 million downloads.
Research into SOC operations revealed a trend of missed low-severity threats, with data from 25 million alerts showing that at least one significant threat per week is overlooked due to alert fatigue and volume.
Attacker use of Windows Phone Link to steal one-time passwords (OTPs) was highlighted in recent malware campaigns.
A report noted that Microsoft Edge loads saved passwords into memory in plaintext at startup, which could be exploited by attackers with local access.
A hackable robot lawn mower was identified as a potential new vector for physical and digital attacks due to security weaknesses.

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated a four-day patch window for federal agencies to address critical vulnerabilities, reflecting an ongoing shift toward shorter patch cycles.
The US government is reportedly moving toward a 72-hour patch cycle for critical vulnerabilities affecting federal systems.

Cybersecurity Brief – 2026-05-09

Sat, 09 May 2026 00:00:00 +0000

Major Incidents or Breaches

NVIDIA confirmed a data breach affecting GeForce NOW users in Armenia, with user information exposed.
Trellix source code repository breach was claimed by the RansomHouse threat group, who leaked images as proof of intrusion.
Zara suffered a data breach exposing personal information of 197,000 customers, as reported by Have I Been Pwned.
Instructure, the edtech company behind the Canvas learning platform, experienced a second attack claimed by ShinyHunters; PII of hundreds of millions potentially at risk.
The Canvas system used by thousands of schools and universities was taken offline by a cyberattack, disrupting operations during final exams.
ShinyHunters escalated their attacks on Canvas by defacing school login portals with ransom messages.
AI firm Braintrust suffered a breach in which hackers accessed an AWS account and compromised AI provider secrets, prompting API key rotation.
The Polish Security Agency reported ICS breaches at five water treatment plants, where attackers gained the ability to modify operational parameters, posing a direct risk to public water supply.

Newly Discovered Vulnerabilities

cPanel released patches for three vulnerabilities in cPanel and Web Host Manager (WHM) that could allow privilege escalation, code execution, and denial-of-service.
A new local privilege escalation (LPE) vulnerability in the Linux kernel, dubbed “Dirty Frag,” was disclosed, following the recent “Copy Fail” (CVE-2026-31431) vulnerability.
Quasar Linux RAT (QLNX), a previously undocumented Linux remote access trojan, was identified targeting developer systems, enabling credential theft and post-compromise activity.
Microsoft Edge was found to load saved passwords into system memory in plaintext on startup, making them susceptible to theft if the device is already compromised; Microsoft states this is “by design.”
Ivanti Endpoint Manager Mobile (EPMM) was subject to a high-severity zero-day vulnerability exploited in the wild, prompting urgent patching directives.

Notable Threat Actor Activity

RansomHouse claimed responsibility for the Trellix source code breach and published proof of access.
ShinyHunters continued their campaign against Instructure/Canvas, including login portal defacement and ransom demands.
TCLBANKER, a newly identified Brazilian banking trojan, was observed targeting 59 banking, fintech, and cryptocurrency platforms via WhatsApp and Outlook-based worms.
Fraudulent Android apps on Google Play, purporting to provide call history access, were discovered stealing user payments after 7.3 million downloads.
Malware leveraging Windows Phone Link to steal one-time passwords (OTPs) was reported in active use.
PamDOORa, a new Linux backdoor, was identified in the wild.
A train hacker was arrested in connection with cyberattacks on critical infrastructure.

Trends, Tools, or Tactics of Interest

The time between phishing email delivery and full organizational compromise has reportedly shrunk to seconds, highlighting increasing attack speed.
Analysis of 25 million SOC alerts revealed that low-severity threats are frequently missed, with at least one missed threat per week in large enterprises.
Overwhelmed SOC teams are unable to keep pace with attacker speed; AI is being promoted as a tool to accelerate alert triage and investigation.
Cybersecurity is increasingly intersecting with geopolitical and cognitive warfare, particularly noted in the African context.
Attackers are increasingly targeting software supply chains by compromising developer credentials and systems.
Attackers are exploiting social engineering and fraudulent apps at scale via official app stores.

Regulatory or Policy Developments Affecting the Security Industry

CISA mandated U.S. federal agencies to patch the Ivanti EPMM zero-day vulnerability within four days.
The US government is targeting 72-hour patch cycles for critical vulnerabilities.
A new frontrunner for the CISA Director position was reported.

Zara on DanSec Daily

Cybersecurity Brief – 2026-05-10

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2026-05-09

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry