Daily Cybersecurity News - May 11, 2026

Linux kernels just got hit with Dirty Frag, a local root exploit chain popping up in attacks after public disclosure.

CVE-2026-43284 and CVE-2026-43500 chain flaws in xfrm-ESP IPsec and RxRPC code. Unprivileged users splice page cache pages into sockets, then trigger in-place decryption to overwrite setuid binaries like su. Microsoft spots limited in-the-wild activity.

Hits kernels from 4.10 to 7.0 across Ubuntu 24.04, RHEL 10, Fedora 44, AlmaLinux, Amazon Linux. Works on container hosts too, risks host escapes.

Researcher Hyunwoo Kim dropped working C PoC on github[.]com/V4bel/dirtyfrag before patches landed.

Operation HookedWing runs a credential-phishing campaign that hit over 500 organizations across aviation, energy, and government sectors.

Attackers send emails posing as HR or Microsoft alerts with links to github[.]io pages mimicking Outlook logins. Those pages pull in dynamic forms from compromised C2 servers to snag credentials, IP, and geolocation.

Core Outlook phishing tricks stay the same over four years. Newer twists include obfuscated GitHub domains and personalized loading screens.

Over 100 github[.]io domains and two dozen C2 servers fuel the infrastructure.

Criminals faked an OpenAI Privacy Filter repo on Hugging Face to push malware at devs.

The repo, named Open OSS privacy filter, cloned the legit open-weight model and topped the trending list. It delivered a Rust-based info stealer targeting Windows users who pulled the package.

Impersonating a hot AI model to climb trending ranks is a slick supply chain play. No named group behind it, just opportunistic thieves chasing quick installs.

Repo pulled 244K downloads before Hugging Face yanked it.

Google Threat Intelligence found the first zero-day exploit they believe hackers built with AI.

The Python script targets 2FA in a popular open-source web admin tool. GTIG disrupted the attack before mass exploitation and patched the vendor.

Evidence includes LLM hallmarks like educational docstrings and a hallucinated CVSS score. High confidence from code analysis, though the exact model stays unknown; they rule out Gemini.

This marks GTIG's first identified case of AI-developed zero-day use in threats.

Attackers now use large language models to craft exploits and run complex attacks.

Google's Threat Intelligence Group spotted threat actors training on a repo with 85,000 real-world vulnerabilities. UNC2814 prompted Gemini to hunt RCE bugs in TP-Link firmware. North Korea's Silent Chollima fired thousands of prompts to dissect CVEs and test PoCs.

Google bases this on observed actor behavior, not a broad survey. Real examples beat vendor hype, though public LLMs often refuse exploit help.

Wooyun-legacy repo spans 2010-2016 vuln cases.

UK regulator ICO fined South Staffordshire Water £963,900 for a Cl0p ransomware breach. Hackers lurked undetected for nearly two years before dumping customer data.

The attack exposed personal details of 633,887 customers and staff. Cl0p published the stolen data online in August 2022 after no ransom payment.

Operators remain untouched in safe havens. This hits the victim company hard with fines and data fallout, no disruption to the ransomware crew.

ICO cited inadequate monitoring and slow breach detection as key failures.

Sasha Levin proposed Killswitch, a runtime toggle to neuter vulnerable kernel functions. Admins get an emergency brake for zero-days before patches land.

Privileged users write to securityfs, forcing the function to skip its body and return a fixed error value. Mitigation hits instantly, lasts till reboot. Targets built-in code like Copy Fail in AF_ALG.

Fills the gap left by module unloading, which skips most kernel vulns. Not prior art; function-level disabling feels fresh for core kernel paths. Blue teams win big here.

Patch under review on LKML.