Good morning. This is your security briefing for Saturday, May 02, 2026. We analyzed 9 articles covering threat actor campaigns, artificial intelligence security guidance, supply chain compromises, and several critical vulnerabilities. All attribution is by the article authors. All article analysis is automated.
Kaspersky Lab reports on a Silver Fox threat group campaign that ran from December 2025 through January 2026, targeting organizations across India, Russia, Indonesia, and other countries with fake tax notification phishing emails. The attackers deployed a modified RustSL loader to deliver ValleyRAT malware along with a previously undocumented backdoor called ABCDoor, which has actually been in use since late 2024. Organizations in industrial, consulting, retail, and transportation sectors across six countries were affected by this operation.
International cybersecurity agencies including CISA, the Australian Signals Directorate, NSA, and cybersecurity centers from Canada, New Zealand, and the United Kingdom have released joint guidance on securing agentic artificial intelligence systems. These AI agents autonomously reason, plan, and take actions within IT environments, creating security risks including privilege escalation, prompt injection, data poisoning, cascading failures, and accountability challenges for government agencies, critical infrastructure, and large organizations deploying these technologies.
The UK National Cyber Security Centre is warning organizations to prepare for a significant wave of software patches addressing accumulated technical debt across all software types. AI-enabled exploitation capabilities are driving this anticipated forced correction, as attackers can now identify and exploit vulnerabilities at scale. The NCSC recommends prioritizing external attack surfaces, enabling automatic patching where possible, and implementing frequent update processes.
Anadnet reports on a long-dormant backdoor in the Quick Page Post Redirect Plugin for WordPress that was intentionally introduced by its author in 2020 and remained hidden for approximately five years, affecting over 70,000 websites. The backdoor used an external update mechanism that bypassed WordPress dot org to inject content for parasite search engine optimization and enabled remote code execution. The malicious version persisted until the command and control server at anadnet dot com went offline.
ZeroPath has disclosed a SQL injection vulnerability in ProFTPD's mod SQL extension affecting versions 1.3.9 and earlier. The flaw allows authentication bypass, privilege escalation, and potentially remote code execution when the server connects to PostgreSQL with superuser privileges. The vulnerability stems from improper sanitization in a function that handles logging statements with attacker-controlled input.
SonicWall has disclosed three vulnerabilities affecting Gen 6, Gen 7, and Gen 8 firewall platforms, with one rated high severity and two medium severity. Firmware updates are required for all affected generations, with specific patched versions now available. Temporary workarounds include disabling HTTP and HTTPS management along with SSL VPN, restricting access to SSH only until the updates can be applied.
Cato Networks researchers discovered critical vulnerabilities in NVIDIA NeMo and Meta PyTorch that enable remote code execution through malicious AI model files. The NeMo flaw involves hardcoded trust settings that automatically execute attacker-controlled code, while PyTorch's safety mechanism can be bypassed via heap buffer overflow. These vulnerabilities affect GPU clusters and machine learning pipelines, potentially granting attackers full system access to production infrastructure containing cloud credentials and sensitive data.
Atos researchers demonstrate techniques to bypass hardware dependencies in Windows kernel-mode drivers, enabling exploitation of vulnerabilities in Bring Your Own Vulnerable Driver attacks. The research details methods for manipulating Windows Plug and Play architecture to load and interact with drivers without their intended hardware present, allowing attackers to exploit hardware-gated driver vulnerabilities for privilege escalation and security control bypass.
Huntress reports that the Komari command and control agent, originally a legitimate monitoring tool, is being repurposed by threat actors to establish command and control channels on compromised systems. Attackers exploit the tool's inherent monitoring and reporting capabilities to blend malicious communications with normal network traffic, making detection more difficult. The tool requires no additional weaponization as its existing features are sufficient for command and control operations.
That concludes today's briefing.