Good morning. This is your security briefing for Wednesday, May 13, 2026. We're covering 13 articles today. All attribution is by the article authors. All article analysis is automated.
Broadcom's Threat Hunter Team reports that Iranian state-sponsored group Seedworm, also known as MuddyWater, conducted a global espionage campaign in the first quarter of 2026. The operation targeted nine organizations across nine countries in sectors including industrial, electronics, education, financial, and public institutions. The group used DLL sideloading techniques with legitimate executables, orchestrated by Node scripts to deploy PowerShell-based reconnaissance tools, credential stealers, and tunneling infrastructure for data exfiltration, demonstrating increasingly mature tradecraft and improved operational security.
Google Threat Intelligence reports that state-sponsored threat actors, including groups linked to China and North Korea, are now leveraging artificial intelligence at industrial scale for vulnerability exploitation, autonomous malware operations, and initial access. Russia-nexus actors are using AI-driven development for evasion techniques, while adversaries across the board are targeting AI software dependencies through supply chain attacks, marking a shift from experimentation to operational deployment of generative models in cyber operations.
A researcher known as S12 documented a kernel-level detection method for remote thread creation on Windows systems. The technique uses system callbacks to identify when malware uses threading APIs for code injection by comparing creator and target process identifiers. This detection approach is fundamental to endpoint detection solutions and addresses common injection techniques used by tools like Cobalt Strike and Metasploit.
The Debian Release Team has enforced reproducible builds for all packages in the distribution. This means all packages must now produce identical binary outputs from the same source code across different build environments. The initiative enhances supply chain security by making it easier to detect tampering or malicious code insertion, as any deviation from expected outputs becomes immediately apparent.
Cloudflare's security team detailed their response to the Copy Fail Linux kernel vulnerability, which allows local privilege escalation through an out-of-bounds write in the authentication wrapper. The vulnerability affects systems with the algif underscore aead kernel module loaded, enabling attackers to corrupt arbitrary readable files. Cloudflare's behavioral detection systems identified the exploit pattern within minutes, preventing any impact to their environment.
Researchers at zero day dot click discovered a remote code execution vulnerability in Claude Code, which has been fixed in version 2.1.118. The flaw allowed attackers to craft malicious deeplinks exploiting insecure command-line argument parsing to inject session start hooks that execute arbitrary commands. The vulnerability originated from naive parsing using starts-with methods that failed to differentiate between legitimate CLI flags and injected arguments, bypassing security warnings for previously trusted repositories.
AMD disclosed a vulnerability in the CPU operation cache of Zen 2-based processors that allows privilege escalation through improper isolation of shared resources. The flaw affects AMD EPYC and Ryzen series processors and can be exploited to corrupt instructions executed at higher privilege levels. AMD and operating system vendors have released mitigations including OS updates for EPYC processors and BIOS updates for Ryzen processors.
A researcher has disclosed a new unpatched local privilege escalation vulnerability in the Linux kernel dubbed Dirty Frag. The vulnerability chains two flaws involving page-cache writes to allow attackers with local access to gain root privileges. It is considered a successor to the actively exploited Copy Fail vulnerability and was reported to kernel maintainers on April 30, 2026.
Daniel Stenberg reports that AI tool Mythos analyzed curl and reported five vulnerabilities, but only one low-severity flaw was confirmed by the curl security team. The vulnerability will be published as a CVE with curl version 8.21 in late June. The analysis highlighted that AI-powered code analyzers can find security flaws, but Mythos did not uncover significantly more issues than traditional methods.
XLab's Cyber Threat Insight and Analysis System reports that threat actor Mr underscore Rot13 is actively exploiting a critical authentication bypass vulnerability in cPanel and WHM to deploy backdoors and steal credentials. The group uses a Go-written infector to implant SSH keys and malicious code, then deploys a trojan named filemanager with command and control infrastructure active since 2020. Over 2,000 attacker IPs globally have been detected exploiting this vulnerability for mining, ransomware, and botnet operations.
Hussein Muhaisen analyzed the TeamPCP campaign which deployed malware through compromised Telnyx Python SDK versions using multi-stage steganography. Malicious payloads were hidden in WAV audio files fetched from command and control servers, which when decoded drop a credential stealer disguised as an MS build executable into the Windows Startup folder. The attack chain involves base64 decoding, XOR decryption, and embedded PNG files containing additional payload stages.
A project called esp32 dash c5 dash deauth has been released as a dual-band Wi-Fi deauthentication toolkit utilizing the ESP32 dash C5 microcontroller controlled via Bluetooth Low Energy. It enables scanning and deauthentication attacks on both 2.4 gigahertz and 5 gigahertz Wi-Fi networks by sending spoofed management frames using a patched library. The tool is designed for authorized network testing and can cause denial-of-service conditions by forcing disconnection of targeted devices.
A pull request merged 182 new code signing certificates into the LOLRMM repository, which tracks certificates used by Remote Management and Monitoring tools. Important safety warnings were added to entries containing certificates from Microsoft and Google, alerting users that these certificates are also used to sign legitimate software and should not be blindly blocked to avoid false positives.
That concludes today's briefing.