Daily Cybersecurity News - May 12, 2026

Linux kernel hands root to any local user through a clean page cache overwrite. Theori dropped a working PoC that roots major distros unmodified.

Attackers chain AF_ALG sockets with splice() to trigger a 4-byte out-of-bounds write in authencesn, tainting setuid binaries like su.CVE-2026-31431, CVSS 7.8, disclosed April 29 with public PoC.

Hits kernels from 4.14 to 6.19 across Ubuntu 24.04, RHEL, SUSE, Amazon Linux, Debian. Breaks containers and shared-host CI/CD runners.

732-byte Python script exploits them all using only standard libraries.

Linux kernels just got hit with Dirty Frag, a local root exploit chaining two page-cache bugs that unprivileged users trigger via network sockets.

Attackers abuse unsafe crypto processing in esp4/esp6 and rxrpc paths to overwrite files like /usr/bin/su in memory. Tracked as CVE-2026-43284 and CVE-2026-43500, both CVSS 7.8. Microsoft spots limited exploitation already.

Hits RHEL 10, Ubuntu 24.04, Fedora 44, AlmaLinux 10, CentOS Stream 10, openSUSE Tumbleweed. Breaks containers and multi-tenant hosts lacking Copy Fail fixes.

Researcher dropped working C PoC on GitHub May 7.

Attackers bypass cPanel authentication to seize full admin control and plant persistent backdoors.

CVE-2026-41940 scores CVSS 9.8. Unauth remotes inject CRLF via Basic Auth into session files for root WHM access. Mr_Rot13 actor exploits it actively to drop Filemanager trojan.

Hits all cPanel/WHM versions post-11.40 up to patches like 11.136.0.5. Web hosts with exposed 2087 port face root compromise and customer data theft.

Over 2,000 attacker IPs scan worldwide.

Mini Shai-Hulud strikes again. TeamPCP compromised TanStack npm packages with millions of weekly downloads.

They hijack GitHub Actions via pull_request_target flaws, cache poisoning, and OIDC token scrapes from runner memory. Preinstall scripts fetch Bun runtime payloads that steal secrets and self-propagate to more packages like UiPath and Mistral AI.

Reuses Shai-Hulud worm core from April SAP hits but adds triple exfil over Session messenger and git-tanstack[.]com. Russian locale checks keep it from running at home.

Campaign hit 172 packages across npm and PyPI in 48 hours on May 11-12, 2026.

TeamPCP compromised Checkmarx's official Jenkins AST plugin with an infostealer.

They breached the GitHub repo, renamed it to mock Checkmarx, and pushed a rogue version (2026.5.09) to the Jenkins Marketplace. The backdoor steals credentials from CI/CD pipelines scanning code with Checkmarx.

This cybercrime crew favors supply chain hits on security tools. They reuse stolen creds from prior attacks like Trivy.

Second Checkmarx strike in six weeks, with Dune-themed malware naming like Shai-Hulud.

Cybercrime actors tapped AI to craft a zero-day that slips past 2FA in a popular open-source web admin tool.

They built a Python script exploiting a hardcoded trust flaw in the 2FA logic. Valid credentials get them in, then the bypass grants full admin access for mass exploitation.

AI hallmarks like educational docstrings and a hallucinated CVSS score scream LLM generation. This compresses vuln discovery to weaponization into days.

Google's GTIG caught it pre-mass deployment and coordinated a vendor fix on May 11, 2026.

GhostLock dropped from Kim Dvash at Israel Aerospace Industries. Low-priv domain user locks files on local drives or SMB shares, ransomware impact without encryption.

Tool calls CreateFileW with dwShareMode set to zero for exclusive deny-share handles. Recursively scans shares with 32 parallel threads, holds handles indefinitely to trigger sharing violations.

Not new tech, just documented API behavior since NT 3.1. No CVE, no patch coming; evades EDR and ransomware detectors by skipping writes entirely. Red teams will love the simplicity.

Python tool on github[.]com/kimd155/ghostlock.