Weekly Threat Bulletin – May 6th, 2026

Linux Cryptographic Code Flaw Offers Fast Route to Root

A local privilege escalation (LPE) vulnerability, dubbed Copy Fail (CVE-2026-31431), has been identified in the Linux kernel's `authencesn` cryptographic template. This logic flaw allows an unprivileged local user to write four controlled bytes into the page cache of any readable file on a Linux system, which can be leveraged to gain root access by modifying a setuid binary. A 10-line Python script serves as a proof-of-concept, capable of exploiting this vulnerability on nearly all Linux distributions released since 2017. While similar to Dirty Cow and Dirty Pipe, Copy Fail is more broadly applicable and does not require winning a race condition. Although not remotely exploitable on its own, it can be chained with other vulnerabilities like remote code execution or SSH compromise. This high-severity flaw (CVSS 7.8) is particularly concerning for multi-tenant Linux systems, shared-kernel containers, and CI runners, and presents a potential container escape primitive for Kubernetes nodes due to the shared page cache. Major Linux distributions, including Debian, Ubuntu, SUSE, and Red Hat, have begun issuing patches to address this issue, which was discovered by Theori researcher Taeyang Lee.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Apply the latest kernel security patches for CVE-2026-31431 to all affected Linux distributions, including Debian, Ubuntu, SUSE, and Red Hat.
• Initiate authenticated scans using your vulnerability management tool across all Linux hosts to identify systems vulnerable to CVE-2026-31431.
• Prioritize patching for systems identified as multi-tenant hosts, container hosts (especially Kubernetes nodes), and CI/CD runners to mitigate the highest-risk scenarios first.
• Configure your SIEM or log management platform to generate alerts for kernel log entries that contain errors referencing 'algif_aead' or 'AEAD socket operations' to detect potential exploitation of CVE-2026-31431.

Compliance Best Practices

• Investigate and pilot sandboxed container technologies, such as gVisor or Firecracker, for workloads that process untrusted input to provide stronger kernel isolation and reduce the risk of container escapes from kernel vulnerabilities.
• Establish a recurring program to review and enforce the principle of least privilege for user and service accounts on all Linux systems, particularly on shared or multi-tenant hosts.
• Evaluate and deploy a kernel runtime integrity monitoring solution to detect unauthorized in-memory modifications and suspicious kernel-level activity, providing a layer of defense against memory-based exploits like 'Copy Fail'.
• Implement a formal, recurring security review and hardening process for all external-facing services, including web applications, CI/CD systems, and remote access points like SSH, to minimize the risk of an initial compromise.

cPanel, WHM Emergency Update Fixes Critical Auth Bypass Bug

A critical authentication bypass vulnerability, identified as CVE-2026-41940 with a severity score of 9.8, affects cPanel and WebHost Manager (WHM) versions prior to the latest emergency updates. This flaw permits unauthenticated access to the control panel, enabling attackers to gain full control over hosting accounts, including websites, data, and email, or even the entire server if WHM is compromised. Such access allows for planting backdoors, redirecting users to malicious sites, data theft, sending spam, or establishing persistent server access for various illicit activities. Patched versions include 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.136.0.5, and 11.134.0.20. Administrators are advised to immediately apply the update by executing the command `/scripts/upcp –force`, and those on unsupported versions should upgrade to a supported release.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• On all servers running cPanel and WHM, execute the command `/scripts/upcp –force` to force an update to a patched version.
• Identify all servers running unsupported versions of cPanel and WHM and upgrade them to a supported version immediately to enable security patching.
• If patching cannot be performed immediately, block inbound traffic from the internet to TCP ports 2083, 2087, 2095, and 2096 on all servers running cPanel and WHM.
• Review cPanel, WHM, and server authentication logs for any unexpected or unauthorized logins, especially from unfamiliar IP addresses, that occurred before the patch was applied.
• Scan all web-accessible directories on cPanel and WHM servers for newly created or recently modified files, looking for potential web shells or other backdoors.

Compliance Best Practices

• Establish and enforce a patch management policy that defines timelines for applying critical security updates to all internet-facing systems, including web hosting control panels like cPanel and WHM.
• Configure network firewalls to restrict access to administrative interfaces, including cPanel (port 2083) and WHM (port 2087), to only trusted IP addresses, such as corporate VPNs or specific administrative workstations.
• Implement a routine, authenticated vulnerability scanning program to regularly assess all servers, including those running cPanel and WHM, to identify missing patches and other security weaknesses.
• Develop and maintain a comprehensive inventory of all hardware and software assets, including details on software versions like cPanel/WHM, to quickly identify systems affected by future vulnerabilities.
• Implement network segmentation to isolate web hosting environments from internal corporate networks and to separate different hosting clients from each other, limiting the potential impact of a server compromise.

CVE-2026-4670: Improper Authentication Vulnerability in Progress MOVEit Automation [CRITICAL] CVSS 9.8

A critical improper authentication vulnerability, identified as CVE-2026-4670, exists in Progress Software MOVEit Automation, allowing for authentication bypass due to a primary weakness. This flaw affects MOVEit Automation versions from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, and all versions prior to 2024.0.0. With a CVSS v3 score of 9.8, this vulnerability is remotely exploitable without requiring authentication or user interaction (AV:N/AC:L/PR:N/UI:N), and can lead to complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The issue is categorized under CWE-305 (Authentication Bypass by Primary Weakness) and is considered automatable for exploitation.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately identify all instances of Progress MOVEit Automation and upgrade them to a patched version (e.g., 2025.0.9, 2024.1.8, or newer) as specified in the vendor advisory.
• If immediate patching is not feasible, restrict all network access to the MOVEit Automation web interface to only trusted IP addresses using a firewall. Deny all access from the public internet.
• Hunt for signs of compromise by reviewing MOVEit Automation audit and access logs for unusual login events, access from unexpected IP addresses, or unauthorized administrative actions.

Compliance Best Practices

• Implement a network segmentation strategy to isolate critical servers like MOVEit Automation into a secure enclave, with strict ingress and egress filtering rules that only permit traffic required for business functions.
• Establish a formal vulnerability management program that includes automated asset discovery, regular vulnerability scanning, risk-based prioritization, and defined service-level agreements (SLAs) for patching.
• Enhance security monitoring by ensuring all critical application logs, including those from MOVEit Automation, are ingested into a central SIEM. Develop and deploy correlation rules to automatically detect and alert on indicators of authentication bypass or other unauthorized activities.

New Wave of DPRK Attacks Uses AI-Inserted npm Malware, Fake Firms, and RATs

North Korean actor Famous Chollima, also known as Shifty Corsair, is conducting a new series of cyberattacks, including the "PromptMink" and "Contagious Interview" campaigns, which leverage AI-generated code, fake companies, and sophisticated supply chain tactics. The PromptMink campaign utilizes malicious npm packages, such as "@validate-sdk/v2" and "@hash-validator/v2," to steal credentials and crypto-wallet information, employing layered dependencies, typosquatting, and Vercel-hosted command-and-control infrastructure. This malware has evolved from JavaScript to Rust-based binaries, targeting Windows, Linux, and macOS, with capabilities to exfiltrate sensitive files, system information, and install SSH keys for persistence. Concurrently, the "Contagious Interview" campaign, encompassing operations like "OtterCookie," "graphalgo," and "Contagious Trader," targets developers through fake job offers and companies such as Veltrix Capital and Blockmerce, distributing Remote Access Trojans (RATs) and malware like OtterCookie. OtterCookie, a JavaScript malware, establishes C2 via Socket.IO WebSocket to steal documents, crypto keys, and clipboard content, while "graphalgo" uses social engineering on platforms like LinkedIn to deliver RATs that ping attackers via Telegram or Slack. These campaigns demonstrate a continuous evolution in techniques, including the "Matryoshka Doll approach" for malware delivery, to compromise developer environments and exfiltrate sensitive data.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Scan all developer workstations and CI/CD build environments for the presence of the malicious npm package “@validate-sdk/v2” and other related malicious packages mentioned in associated reporting, such as “@hash-validator/v2”.
• Add known C2 domains associated with the PromptMink campaign, such as 'ipfs-url-validator.vercel.app', to your network blocklists in your firewall, DNS sinkhole, and web proxy.
• Use your Endpoint Detection and Response (EDR) tool to hunt for the unauthorized creation of new SSH keys in user directories on developer workstations and servers.
• Configure and run EDR or SIEM queries to detect suspicious processes that are scanning for or accessing environment files (e.g., .env), cloud credential files (e.g., ~/.aws/credentials), or cryptocurrency wallet data.

Compliance Best Practices

• Implement a Software Composition Analysis (SCA) tool to scan all software dependencies for known vulnerabilities, malicious packages, and typosquatting attempts before they are used in development or production environments.
• Review and enforce the principle of least privilege for all developer accounts and service principals, ensuring they only have the minimum necessary permissions to access code repositories, cloud resources, and CI/CD pipelines.
• Develop and implement a recurring security awareness training program for the development team, focusing on identifying social engineering attacks that leverage fake job offers, suspicious code repositories, and unsolicited technical tasks.
• Establish a private or proxied package registry (e.g., for npm, PyPI) that caches and serves only approved, vetted open-source packages to developers, preventing direct downloads from public repositories.
• Implement a network egress filtering policy on firewalls that denies outbound traffic by default from developer environments and allows only necessary protocols and destinations required for business operations.

What Type of 'C2 on a Sleep Cycle' Do They Leave Behind? Novel Chinese Spy Group Found in Critical Networks in Poland, Asia

A novel China-linked threat group, tracked as Shadow-Earth-053, has infiltrated over a dozen critical networks in Poland and several Asian countries, including Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, and Taiwan, since December 2024. This group, along with a related entity, Shadow-Earth-054, primarily gains initial access by exploiting vulnerable Microsoft Exchange Servers, specifically the ProxyLogon vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065), and in some cases, React2Shell (CVE-2025-55182) for Linux systems. After initial compromise, the attackers deploy web shells like Godzilla and the custom ShadowPad backdoor, sometimes delivering it via legitimate tools such as AnyDesk. To evade detection, they utilize tools like RingQ to pack malicious binaries, rename legitimate Windows system binaries, and use domain names impersonating products or security companies. Lateral movement is achieved using Windows Management Instrumentation Command-line (WMIC) and credential harvesting tools like Evil-CreateDump. The targeting of government agencies, defense contractors, technology firms, and transportation industries, particularly in a NATO country like Poland, suggests a strategic focus on espionage and the prepositioning of assets for potential long-term sabotage, echoing tactics observed in previous Chinese campaigns like Salt Typhoon and Volt Typhoon.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately apply all available security updates for on-premises Microsoft Exchange Servers, prioritizing the patch chain for ProxyLogon (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065).
• Identify all servers using vulnerable React Server Components and apply the security patch for the React2Shell vulnerability (CVE-2025-55182).
• Scan the file systems of all public-facing web servers, especially Microsoft Exchange, for known web shells like Godzilla and for any recently created or modified script files (e.g., .aspx, .php).
• Query SIEM and endpoint logs for suspicious use of the Windows Management Instrumentation Command-line (wmic.exe), particularly for remote process execution or service creation originating from internet-facing servers.
• Conduct an immediate audit of all remote access software, such as AnyDesk, to identify unauthorized installations and review logs from authorized instances for connections to or from unusual IP addresses.

Compliance Best Practices

• Implement a comprehensive vulnerability management program that includes automated asset discovery, risk-based prioritization, and enforceable service-level agreements (SLAs) for patching all software, especially on internet-facing systems.
• Design and implement a network segmentation strategy to isolate critical infrastructure, like email and database servers, into secured zones with strict access controls, preventing direct communication from user workstations.
• Continuously tune Endpoint Detection and Response (EDR) rules to detect behavioral anomalies, such as legitimate Windows processes (e.g., wmic.exe, powershell.exe) running from non-standard directories or being initiated by unusual parent processes.
• Enforce the principle of least privilege by implementing a tiered administrative access model where administrator accounts for servers and domain controllers are separate from standard user accounts and cannot be used for daily tasks like email or web browsing.
• Develop a business case and migration plan to move from on-premises Microsoft Exchange to a managed cloud email platform to reduce the organization's attack surface and security management overhead.