Good morning. This is your security briefing for Sunday, May 03, 2026. We have sixteen articles to cover today. All attribution is by the article authors. All article analysis is automated.
Bloomberg reports that a Russian hacker has pleaded guilty to charges related to cyberattacks targeting oil and gas facility infrastructure. This represents a law enforcement action against state-aligned or criminal hacking activity directed at critical infrastructure in the energy sector.
Following on from the cPanel authentication bypass story we've been covering this week, Ctrl-Alt-Intel reports that an unknown threat actor has exploited the vulnerability to target South-East Asian military and government entities, including the Philippine Coast Guard, Philippine Air Force, and Lao Ministry of National Defence. The actor developed custom exploit chains combining SQL injection with remote code execution, achieving persistent access and exfiltrating over four gigabytes of sensitive data from Chinese railway-sector organizations, including national identification documents and bank details.
The United States Department of Justice announced that two American cybersecurity professionals, Ryan Goldberg and Kevin Martin, were sentenced to four years in prison for deploying ALPHV BlackCat ransomware against multiple U.S. victims between April and December 2023. The attackers operated as affiliates in a ransomware-as-a-service model, targeting critical infrastructure including medical and engineering firms, and exfiltrating sensitive data including patient information.
ClickUp disclosed a security incident from April 27th where 893 customer email addresses were exposed through their client-side feature flag configuration. Engineers had improperly embedded email addresses directly into feature flag targeting rules, which were accessible via Split dot I O's publicly queryable endpoint. An API token was also briefly exposed through the same mechanism before being disabled.
Check Point Research reports on VECT version 2, a Ransomware-as-a-Service program targeting Windows, Linux, and VMware ESXi systems that functions as an unintentional data wiper due to a critical cryptographic flaw. The malware loses three of four encryption nonces for files larger than 128 kilobytes, rendering seventy-five percent of large files permanently unrecoverable even with payment.
Cryptika Cybersecurity reports that Qilin ransomware operators are using PowerShell commands to enumerate RDP authentication history by extracting specific event logs from the Terminal Services Remote Connection Manager on compromised servers. This technique enables attackers to map network connections and identify privileged accounts for lateral movement while evading detection, as these logs are often not forwarded to SIEM systems.
Rohitashokgowd addresses detection rot in Microsoft Sentinel, where active detection rules appear healthy but fail to generate meaningful alerts due to broken data feeds, misconfigurations, or irrelevance. The article provides seven KQL queries to audit Sentinel workspaces and identify ineffective rules including silent zombies, shadow detectors, and broken feeds that create blind spots in threat detection.
Persistent Security Research Team released the Month of Bypasses project on GitHub, demonstrating proof-of-concept techniques that evade Microsoft Defender detection using alternative execution paths for the same MITRE ATT&CK techniques. The bypasses were discovered using AI-driven variant analysis and include techniques like SAM credential dumping and process injection, aimed at helping defenders identify security gaps before adversaries exploit them.
Google Bug Hunters announced enhancements to its Vulnerability Reward Programs for Android and Chrome to address AI-era security challenges. The enhanced programs incentivize security researchers to discover vulnerabilities in AI-powered features, including data poisoning attacks, model extraction attacks, and adversarial attacks against AI components.
Ikari released pydepgate, a static analysis tool designed to detect malicious code that executes during Python interpreter startup. The tool uses layered analysis to identify suspicious patterns including encoding abuse, dynamic execution, string obfuscation, and code density anomalies. It was developed in response to the March 2026 LiteLLM supply-chain compromise that exploited legitimate Python startup mechanisms like dot P T H files.
SEC West and wgnet both provide mitigation guidance for Copy Fail, a local privilege escalation and container escape vulnerability in the Linux kernel's algif aead component affecting all major distributions using kernels 4.14 through April 2026. The vulnerability allows attackers to corrupt shared page cache pages to overwrite in-memory setuid binaries, granting root access without modifying files on disk. Defenders should immediately patch and reboot systems, with interim mitigations including eBPF-based workarounds for systems unable to patch immediately.
Quarkslab identifies hidden risks in auditing Microsoft Entra ID application permissions, where permissions propagate transitively through ownership, federated identity, group memberships, and other indirect paths. The gap between configured and effective permissions creates privilege escalation risks as existing tools fail to map complete inheritance chains. Quarkslab released the QAZPT tool to help organizations audit these complex permission relationships.
Meltedd released VisualSploit, a tool that weaponizes MSBuild project files to execute embedded shellcode automatically when Visual Studio projects are opened, built, or restored. The technique exploits MSBuild's InitialTargets and RoslynCodeTaskFactory to inject a shellcode loader into project files, executing silently without user interaction, particularly when cloning repositories as cloned files lack Mark-of-the-Web protections.
SilentisVox released DoomSyscalls, a technique for executing clean indirect system calls that bypasses EDR solutions and kernel-level security checks. The method dynamically resolves System Service Numbers and syscall instruction addresses while employing return address spoofing using legitimate ntdll addresses to evade userland hooks and security validations.
GitHub hosted a webinar demonstrating how AI agents can automate and enhance malware reverse engineering by recovering hidden data, tracing complex logic, and automating repetitive analysis tasks. The system uses a Kali-based Docker container with standard reverse engineering tools integrated with Binary Ninja or Ghidra backends through Model Context Protocol, with live demonstrations covering string decryption, API-resolving logic, and analysis of multi-stage samples.
That concludes today's briefing.