The News.
Daily intel.
Daily breach reporting, CVE disclosures, malware analyses, and threat campaigns. Yesterday's incidents, this morning's coverage — written by practitioners for the analysts and defenders who need it first.
Canvas LMS Breach Escalates: 275M Records, 9,000 Schools, May 12 Ransom Deadline
ShinyHunters escalated its Canvas/Instructure breach by defacing 9,000 school login portals. 275M records exposed including names, emails, student IDs. Ransom deadline May 12, 2026.
Claude AI Independently Targeted SCADA Systems in Mexican Water Utility Cyberattack
Dragos 2026 OT report reveals threat actors used Claude AI to build a 17,000-line attack framework that autonomously identified and targeted a SCADA system at a Mexican water utility.
xlabs_v1 Mirai Botnet Exploits ADB to Build IoT DDoS-for-Hire Network
Hunt.io exposes xlabs_v1, a Mirai-derived botnet hijacking IoT devices via exposed ADB on port 5555 to power a commercial DDoS-for-hire operation with 21 flood variants.
Adversary-in-the-Middle Phishing Campaign Hits GoDaddy ManageWP via Google Ads
Guardio Labs exposes an AitM phishing campaign using Google sponsored ads to steal ManageWP credentials and bypass 2FA in real time, targeting WordPress administrators managing hundreds of sites each.
CVE-2026-26956: Critical vm2 Sandbox Escape via WebAssembly Hits 1.3M-Download Node.js Library
CVE-2026-26956 (CVSS 9.8) lets attackers escape the vm2 Node.js sandbox via WebAssembly exception handling. Patch to 3.10.5 immediately — vm2 has 1.3M weekly downloads.
VoidStealer Bypasses Chrome App-Bound Encryption Without Code Injection or Privilege Escalation
VoidStealer v2.0 bypasses Chrome's App-Bound Encryption using a hidden debugger to extract the master decryption key from RAM without code injection or elevated privileges.
Dirty Frag: Public Root Exploit Hits All Major Linux Distros, Partial Patch Only
Dirty Frag (CVE-2026-43284, CVE-2026-43500) is a Linux kernel LPE chain with a working public exploit. One CVE patched in mainline; RxRPC component remains unpatched. All major distros at risk.
CVE-2026-0300: Critical PAN-OS Zero-Day Gives Attackers Root Access to Firewalls
CVE-2026-0300 is a critical buffer overflow in Palo Alto PAN-OS firewalls actively exploited since April 9 by state-sponsored actors. CVSS 9.3, no patch until May 13.
CVE-2026-0300: Unauthenticated Root RCE Zero-Day Actively Exploited in Palo Alto PAN-OS
CVE-2026-0300 is a CVSS 9.3 buffer overflow in PAN-OS User-ID Authentication Portal allowing root RCE. CISA KEV confirmed. Patches arrive May 13.