Good morning. This is your security briefing for Monday, May 04, 2026. We have 18 articles to cover today. All attribution is by the article authors. All article analysis is automated.
Following up on a story from earlier this week, Australia's Cyber Security Centre is reporting active exploitation of the critical cPanel and WHM authentication bypass vulnerability within Australia. This is the same vulnerability initially disclosed targeting South-East Asian military entities, affecting all versions released after 2013, and patches were made available on April 30th.
Trend Micro reports on a China-aligned threat group designated SHADOW-EARTH-053, conducting cyberespionage against government and critical infrastructure across Asia since December 2024. The group exploits unpatched Microsoft Exchange and IIS vulnerabilities, deploys GODZILLA web shells, and stages ShadowPad modular malware to maintain persistent access, with targets spanning Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, Taiwan, and Poland.
ThatTotallyRealMyth has released a public repository containing Indicators of Compromise for detecting Impacket toolset activity. The research identifies protocol-level and implementation-level fingerprints of Impacket and its example tools that are difficult for attackers to modify, designed to assist defenders in detection and help red teamers improve their operational security.
Cisco Research has published a study examining the vulnerability of widely used cryptographic protocols to quantum computing threats and assessing the current status of post-quantum cryptography integration. The research focuses on critical network and security protocols that rely on public-key cryptographic primitives like RSA for key exchange and authentication, which are vulnerable to quantum attacks.
Talos Intelligence reports that defenders are deploying AI-powered honeypots that use generative AI to rapidly create sophisticated deceptive environments designed to trap and analyze malicious AI agents. These honeypots leverage frameworks like ChatGPT to simulate systems such as Linux shells or IoT devices, exploiting the lack of awareness in automated AI-driven attacks.
Ukrainian authorities detained a three-person hacker group in Lviv Oblast that compromised over 610,000 Roblox gaming accounts using stolen cookies to bypass authentication. The group verified hundreds of files containing valuable accounts with virtual currency and rare items, selling them on Russian platforms for nearly 10 million Ukrainian hryvnia in cryptocurrency payments between October 2025 and January 2026.
Trellix has disclosed unauthorized access to a portion of their source code repository. The company states there is no evidence the source code release or distribution process was affected, or that the code has been exploited, and an investigation is underway with forensic experts and law enforcement involvement.
TrustedSec details an attack technique exploiting Active Directory WriteGPLink permissions combined with ARP spoofing to hijack Group Policy Object UNC paths. Attackers can achieve SYSTEM-level code execution via malicious MSI deployment, capture authentication hashes through drive map spoofing with WebDAV downgrade, or execute malicious logon scripts, leveraging tools like BloodHound, arpspoof, and Impacket for privilege escalation without modifying SYSVOL or DNS records.
A VS Code extension called CodeNeedle has been released for offensive security operations that enables covert remote JavaScript code execution in target development environments. The tool operates by starting a local HTTP server that accepts and executes arbitrary JavaScript with full Node.js privileges, providing filesystem access and system interaction capabilities while running stealthily without user interface elements.
A platform called copy.golf is hosting a competition where security researchers develop minimized exploit payloads targeting the Copy Fail vulnerability, with submissions ranked by byte size. Exploits are submitted as Python scripts or binaries designed to achieve privilege escalation, demonstrating active refinement of compact exploit code that can evade detection through size optimization.
Socket and Semgrep are both reporting a major supply chain attack affecting multiple package ecosystems. Malicious Ruby gems and Go modules were published targeting developers and CI/CD environments to steal credentials including SSH keys, AWS credentials, and GitHub tokens, while the intercom PHP package version on Packagist and the npm intercom package were compromised on the same day as part of the Mini Shai-Hulud campaign. The malware uses obfuscation techniques, downloads the Bun JavaScript runtime, and exfiltrates sensitive credentials, affecting approximately 400,000 weekly downloads across backend services and continuous integration pipelines.
Version 2.6.3 of the Lightning Python package on PyPI was compromised with malicious code that executes upon import. The payload downloads the Bun JavaScript runtime and executes an obfuscated script designed to exfiltrate cloud credentials from AWS, Azure, and GCP, environment variables, browser credentials, and GitHub tokens, with capability for arbitrary code execution.
The Ransom-ISAC team reports a critical zero-day vulnerability in a WHQL-signed Windows kernel driver attributed to Dragon Breath APT, a Chinese state-adjacent threat actor. The driver allows local administrators to terminate protected processes including EDR and AV solutions, features kernel-level process manipulation capabilities functionally identical to previously used tooling, and the valid signature enables persistent kernel execution while bypassing HVCI and PPL protections.
Ctrl-Alt-Intel reports that a Qilin ransomware affiliate is actively exploiting vulnerabilities in WatchGuard and Fortinet network appliances to gain initial access to organizations, primarily in Germany and the US. The threat actors deploy Sliver command and control framework on compromised appliances and use Chisel for reverse SOCKS tunneling to pivot into internal networks before deploying Qilin ransomware targeting Linux, ESXi, and Nutanix systems.
Varonis Threat Labs discovered Bluekit, an AI-powered phishing kit that consolidates over 40 website templates, automated domain purchasing, two-factor authentication spoofing, antibot cloaking, and AI-driven features including voice cloning into a single platform. The kit targets email providers, cloud accounts, developer platforms, social media, retail, and cryptocurrency services, significantly lowering the barrier to entry for sophisticated phishing attacks by streamlining the entire workflow.
A new tool called IRQL, or Incident Response Query Language, has been released as a collection of KQL functions designed to simplify security log analysis by providing a consistent, analyst-friendly dialect. It addresses schema drift and complexity in raw Kusto queries through reusable selector functions that unify security data, aiming to accelerate threat hunting and reduce analyst cognitive load.
Security researchers have created the Holy Grail PCAP, a comprehensive packet capture file designed to test all 1,600-plus Wireshark protocol dissectors for vulnerabilities. The project includes two open-source tools for code coverage and coverage-guided fuzzing, and has already discovered multiple zero-day vulnerabilities in Wireshark dissector code across various versions.
That concludes today's briefing.