ctipilot.ch

CTI Daily Brief — 2026-05-21

Typedaily
Date2026-05-21
GeneratorClaude Opus 4.7 (`claude-opus-4-7`)
ClassificationTLP:CLEAR
LanguageEnglish
Promptv2.59
Items9
CVEs17
On this page

On this page

Tags (23)
Regions (6)
References (34)

0. TL;DR

  • Drupal patches "highly critical" pre-auth SQL injection (CVE-2026-9082) on PostgreSQL-backed installs of Drupal 8.9–11.3; the Security Team warned that "exploits might be developed within hours or days" of advisory release. EU/CH government portals and university CMSes are the primary exposed surface (Drupal Security Team, 2026-05-20; NCSC-CH, 2026-05-19).
  • Webworm (China-aligned) targets Belgian, Italian, Serbian and Polish government organisations with two new custom backdoors — EchoCreep (Discord C2) and GraphWorm (Microsoft Graph / OneDrive C2). ESET also documents Spanish and Italian governmental documents exfiltrated to a compromised AWS S3 bucket (ESET Research, 2026-05-20).
  • TeamPCP breaches GitHub itself — ~3,800 internal repositories exfiltrated via a poisoned VS Code extension installed on a GitHub employee device; in parallel, the Mini Shai-Hulud worm compromised the official Microsoft durabletask PyPI package and propagates across AWS via Systems Manager SendCommand and across Kubernetes via kubectl exec (Help Net Security, 2026-05-20; Wiz, 2026-05-20).
  • Microsoft ships CVE-2026-42822 — CVSS 10.0 unauthenticated network EoP in Azure Local Disconnected Operations (ALDO) with MSRC exploitability assessment "Exploitation More Likely"; only manually-operated air-gapped Azure Local stacks need action (cloud-managed Azure already protected) (Microsoft MSRC, 2026-05-18).
  • Verizon 2026 DBIR (today's deep dive): vulnerability exploitation overtakes credentials as the leading breach initial-access vector for the first time in the report's 19-year history — 31 % per Verizon's press release (Verizon, 2026-05-19) vs 13 % credentials per Help Net Security's reading of the full DBIR (Help Net Security, 2026-05-20); only 26 % of CISA KEV entries fully remediated (down from 38 %); supply-chain breaches +60 % YoY.

3. Research & Investigative Reporting

PinTheft — Linux kernel local-privilege-escalation primitive (RDS zerocopy double-free + io_uring fixed-buffer page-cache overwrite), PoC public, Arch Linux default-loaded

Aaron Esau (V12 Security) disclosed PinTheft on 2026-05-19 via the oss-security mailing list — a Linux kernel local privilege escalation that chains an RDS (Reliable Datagram Sockets) zerocopy double-free with io_uring fixed-buffer reference manipulation to overwrite the page cache of a SUID-root binary and gain root (oss-security / V12 Security, 2026-05-19; BleepingComputer, 2026-05-20). The bug lives in rds_message_zcopy_from_user() in the RDS send path: a partial page fault mid-scatter causes the error path to drop already-pinned pages while leaving the scatterlist bookkeeping live, so cleanup drops the pages a second time. The exploit registers an anonymous memory page as an io_uring fixed buffer (FOLL_PIN bias of 1024 references), drains all references via 1024 deliberately-failing RDS sends, then reuses the stale io_uring page pointer to overwrite the page cache of a SUID-root binary and redirect execution to attacker shellcode. Prerequisites: RDS kernel module loaded, io_uring enabled, a readable SUID-root binary, x86_64. The RDS module is default-loaded only on Arch Linux — not on Ubuntu, Fedora, Debian, RHEL or SUSE — narrowing the primary defender population to Arch CI/CD runners, developer workstations and AUR-based servers, plus any environment that explicitly modprobe'd rds. Upstream kernel patch landed before disclosure; no CVE assigned at disclosure. Technique class: T1068 Exploitation for Privilege Escalation. Defender detection — auditd syscall events for rds_sendmsg / io_uring_* from unexpected binaries; Sysmon Linux EID 1 with process lineage showing a non-root process spawning a root shell without sudo/su. Hardening: modprobe.d blacklist rds if not in use; sysctl kernel.io_uring_disabled=2 for untrusted workloads; apply upstream kernel patch when distributed via the distro's normal update channel.

4. Updates to Prior Coverage

UPDATE: Drupal SA-CORE-2026-004 / CVE-2026-9082 ships — "highly critical" pre-auth SQL injection in core database API, PostgreSQL-only

UPDATE (originally covered 2026-05-20): yesterday's brief carried Drupal's PSA pre-warning that a "highly critical" core advisory was scheduled for 2026-05-20; today the SA-CORE-2026-004 advisory landed with CVE-2026-9082 assigned — an anonymous SQL-injection in Drupal core's database abstraction API (CWE-89) rated 20/25 on Drupal's risk scale (Highly Critical) that affects only PostgreSQL-backed installations. Specially-crafted HTTP requests slip past sanitisation in the core DB-API layer and inject arbitrary SQL with no authentication; successful exploitation leads to information disclosure, privilege escalation and — in some database configurations — RCE. The Drupal Security Team explicitly stated that "exploits might be developed within hours or days" of advisory release (Drupal PSA, 2026-05-18).

Affected versions: 8.9.0 through 10.4.10, 10.5.x < 10.5.10, 10.6.x < 10.6.9, 11.0.0 through 11.1.10, 11.2.x < 11.2.12, 11.3.x < 11.3.10. Patched: 10.4.10 / 10.5.10 / 10.6.9 / 11.1.10 / 11.2.12 / 11.3.10 (released 2026-05-20). MySQL / MariaDB / SQLite installations are not affected by this CVE. Drupal 7 is unaffected; sites on EOL Drupal 8/9 majors must apply manual patch files. Drupal Steward WAF subscribers receive vendor-provided rules at advisory release per the service description; non-subscriber sites must apply the core update. NCSC-CH carried the advisory in its Security Hub (NCSC-CH, 2026-05-19; SecurityWeek, 2026-05-19; CSO Online, 2026-05-20).

UPDATE: TeamPCP / Mini Shai-Hulud campaign — GitHub itself breached (~3,800 internal repos via poisoned VS Code extension), Microsoft `durabletask` PyPI worm propagates via AWS SSM and `kubectl exec`, Grafana confirms missed-token-rotation root cause

UPDATE (originally covered 2026-05-13 deep dive; multiple subsequent updates): three new TeamPCP / Mini Shai-Hulud developments landed in this window — GitHub itself, the official Microsoft durabletask PyPI package, and the Grafana Labs root-cause disclosure.

GitHub. GitHub confirmed on 2026-05-20 that TeamPCP (also tracked as UNC6780) accessed approximately 3,800 internal GitHub repositories after a single GitHub employee installed a poisoned Visual Studio Code extension on their device (The Hacker News, 2026-05-20; The Record, 2026-05-20; Infosecurity Magazine, 2026-05-20; Help Net Security, 2026-05-20). GitHub detected and contained the breach on 2026-05-19, isolated the affected endpoint and rotated high-impact secrets; the company states there is no evidence customer data stored outside the internal repositories was accessed. GitHub has not publicly named the malicious VS Code extension or its publisher at this writing. TeamPCP listed the stolen repositories — including GitHub Actions internals, agentic-workflow code, Copilot internal projects, CodeQL tools, Codespaces, Dependabot, and a Rails controller managing organisations and PRs — for sale at $50,000, with LAPSUS$ announcing a joint sale and a $95,000 asking price.

durabletask (PyPI). Wiz Security reported on 2026-05-20 that the TeamPCP / Mini Shai-Hulud worm compromised the official Microsoft durabletask PyPI package via versions 1.4.1, 1.4.2 and 1.4.3 (Wiz, 2026-05-20). The payload is a dropper that fetches rope.pyz from check.git-service[.]com; per Wiz the second stage is a full credential stealer targeting AWS, Azure, GCP, Kubernetes and Vault credentials, 1Password and Bitwarden vaults, filesystem credentials and shell history. Propagation per Wiz: on Kubernetes hosts the worm uses kubectl exec; on AWS EC2 instances it propagates via AWS Systems Manager SendCommand against up to 5 targets per host (T1078.004 Cloud Accounts, T1570 Lateral Tool Transfer).

Grafana Labs. Grafana Labs published the post-mortem of its own TeamPCP breach on 2026-05-19, confirming the root cause was a single GitHub Actions workflow token that slipped through the rotation process after the TanStack npm supply-chain attack (Grafana Labs, 2026-05-19; BleepingComputer, 2026-05-20). Per Grafana's own post-mortem the TanStack compromise was detected on 2026-05-11 (note: BleepingComputer cites 2026-05-01 for the malicious-package consumption event — surfaced as a contradiction in § 7); Grafana rotated the bulk of its GitHub workflow tokens, but the residual unrotated token gave TeamPCP access to clone private source-code repositories (exact count not disclosed in Grafana's post-mortem). Grafana refused the extortion demand on 2026-05-16. The exfiltration scope is confirmed limited to Grafana Labs GitHub repositories (public source code, private source code and internal repos); customer production data was not affected.

5. Deep Dive — Verizon 2026 DBIR: vulnerability exploitation overtakes credentials as primary breach vector for the first time in 19 years

Verizon published the 2026 Data Breach Investigations Report on 2026-05-19 covering, per the full DBIR PDF, tens of thousands of security incidents and over ten thousand confirmed breaches collected over the standard DBIR window (autumn of the prior year through autumn of the report year) (Verizon official press release via GlobeNewswire, 2026-05-19; Help Net Security analysis, 2026-05-20; Verizon DBIR landing page — the specific dataset incident / breach counts cited by some secondary coverage were not separately confirmed in the press-release coverage and should be read against the full DBIR PDF at verizon.com/business/resources/T1f0/reports/2026-dbir-data-breach-investigations-report.pdf). This is the publication event that the 2026-W21 weekly summary flagged as imminent — the dedicated PD-9 treatment lands here. The report is structurally significant for European public-sector SOCs because it provides industry-spanning patching-cadence and supply-chain benchmarks that map cleanly onto NIS2 risk-management obligations.

Headline shift: exploitation overtakes credentials. For the first time in the DBIR's 19-year history, vulnerability exploitation (T1190 Exploit Public-Facing Application) is the leading initial-access vector at 31 % of breaches — Verizon's own press-release language (GlobeNewswire). Per Help Net Security's reading of the full DBIR, compromised credentials (T1078 Valid Accounts; T1110 Brute Force) dropped to 13 % (Help Net Security, 2026-05-20). This is a sustained inversion, not a single-year blip — the trend curve has been climbing for three reporting cycles and accelerated sharply in the 2024-2025 window. For SOCs, the implication is that detection-investment prioritisation that ranks credential-stuffing telemetry above EDR exploit-protection coverage and network-layer anomaly detection for exploitation activity is now out of alignment with the breach distribution.

Patching-cadence regression. Only 26 % of CVEs listed in the CISA Known Exploited Vulnerabilities (KEV) catalog were fully remediated by polled organisations in the reporting window, down from 38 % the prior year. The median time to patch deteriorated from 32 days to 43 days. Per PD-13 the KEV remediation deadline itself has no jurisdictional weight in CH/EU, but the listing flag is jurisdiction-agnostic intelligence about exploitation in the wild — and the DBIR's finding is that even organisations that are subject to BOD 22-01 are missing the deadline three quarters of the time. The benchmark for CH/EU public-sector defenders is therefore an honest one: most peers are not patching their KEV inventory on time, and median 43-day exposure is the operational reality. A SOC that is hitting 14-day patch SLAs on KEV entries is now outperforming the industry baseline by a factor of three.

Supply-chain breaches as the dominant compounding factor. Third-party / supply-chain breaches grew 60 % year-over-year and now represent 48 % of all breaches in the dataset (T1195 Supply Chain Compromise). Only 23 % of affected organisations had fully remediated MFA gaps in third-party cloud accounts — the most common upstream pivot point. The 60 % growth aligns with the campaign-level signal this brief has carried throughout May 2026 (TeamPCP / Mini Shai-Hulud — see § 4 UPDATE; Nx Console / actions-cool-issues-helper / TanStack / durabletask). The actionable layer for defenders is third-party-CI access scoping — every reduction in the cross-tenant blast radius of a single compromised dev-tool integration directly reduces measured breach probability.

Ransomware and AI signals. Ransomware was present in 48 % of breaches, up from 44 % — the proportion-not-paying held at 69 %. The DBIR carries shadow AI usage as the third-most-common insider data-loss mechanism, with usage rates quadrupling year-over-year; the report also notes AI-bot traffic growing 21 % month-over-month against 0.3 % growth for human traffic. Verizon's press-release framing is that "AI is being leveraged by threat actors to accelerate the time to exploit known vulnerabilities, shrinking the window for defense from months to mere hours" (GlobeNewswire) — that finding maps to the patch-velocity number: the 43-day median patch time that was acceptable when working PoCs took weeks is now insufficient when AI-assisted exploitation collapses weaponisation latency to hours. The full DBIR PDF is published at verizon.com/business/resources/T1f0/reports/2026-dbir-data-breach-investigations-report.pdf.

Defender takeaways for a Swiss / European public-sector SOC:

  • Re-weight detection-investment priorities: EDR exploit-protection coverage and network-layer anomaly detection for T1190 exploitation activity now rank above credential-stuffing detection for breach-probability reduction.
  • Use the 26 % KEV remediation rate and 43-day median patch time as the public benchmark when justifying patch-cadence SLAs to programme owners; the industry's distribution is far worse than most ISMS targets assume.
  • Treat third-party cloud-tenancy MFA gap closure as a single highest-leverage control — the 23 % remediation rate is the most actionable bar to clear.
  • Map the +60 % supply-chain finding directly onto NIS2 Article 21(2)(d) supply-chain-security obligations during the next ISMS review cycle; the DBIR is now the canonical industry-baseline citation.

6. Action Items

  • Patch Drupal core on PostgreSQL backends immediately — upgrade to 10.4.10 / 10.5.10 / 10.6.9 / 11.1.10 / 11.2.12 / 11.3.10. The Drupal Security Team warned that exploits "might be developed within hours or days" of the SA-CORE-2026-004 advisory (see § 4 UPDATE). If patch deployment is gated by change-control, temporarily front the site with Drupal Steward or an equivalent WAF rule covering SQL-injection vectors at the DB-API layer.

  • Upgrade Keycloak to 26.6.2 with priority on identity-federation deployments (national digital-identity platforms, eHealth federations). The OIDC session-fixation (CVE-2026-7507), WebAuthn execute-actions replay (CVE-2026-37982) and cross-realm IDOR in Authorization Services (CVE-2026-4630) are the operationally-most-dangerous CVEs in the batch (see § 2). For Red Hat build of Keycloak, apply the corresponding RHSA advisories on the 26.2.x branch.

  • Upgrade Azure Local Disconnected Operations (ALDO) to v2604+ on every air-gapped / data-sovereignty Azure Local deployment. The CVE-2026-42822 unauth EoP is rated CVSS 10.0 and "Exploitation More Likely" — cloud-managed Azure is already protected, manual stacks are not (see § 2). Restrict the ALDO management plane to admin-only OOB subnets until the upgrade is complete.

  • Complete the six-step SonicWall LDAP reconfiguration on every Gen6 SSL-VPN appliance per SonicWall KB kA1VN0000000RBd0AM — firmware-update status alone is insufficient and Akira-linked actors are actively exploiting the UPN/SAM split (see § 1). Given Gen6 EoL on 2026-04-16, schedule migration to Gen7/Gen8.

  • Disable the ChromaDB Python FastAPI server or block external access — CVE-2026-45829 has a public PoC, v1.5.9 is unpatched, and the Python server is the affected component (the Rust server is not). Migrate to the Rust server (chroma run) or front the API with network-layer access controls; ensure no ChromaDB deployment is internet-exposed (see § 2).

  • Hunt for Webworm Discord and Microsoft Graph API C2 — alert on outbound HTTPS to discord.com/api/* or graph.microsoft.com from process trees whose parent is not the expected first-party application; correlate Graph API non-interactive sign-ins for app registrations without enterprise approval, and flag cmd.exe spawned by long-running services with no interactive user context (see § 1). Apply Conditional Access on Microsoft Graph restricting non-managed device sign-ins on workstations that have no Graph integration need.

  • Audit VS Code extension installation policies on every developer endpoint — enforce a managed allowlist via Group Policy / MDM, set extensions.autoUpdate: false, and rotate every secret accessible to extensions whenever a supply-chain compromise is confirmed (see § 4 UPDATE TeamPCP / GitHub breach). Hunt Sysmon EID 1 for code --install-extension invocations on dev endpoints; search CI/CD pipeline logs for durabletask package imports in versions 1.4.1–1.4.3 and treat any host that imported a malicious version as fully compromised.

7. Verification Notes

  • Out-of-window drops (primary source older than 36h window): Exim CVE-2026-45185 "Dead.Letter" — XBOW disclosure 2026-05-12, NCSC-NL advisory 2026-05-15; S2 surfaced an exploitation-confirmation quote from NCSC-NL but its publication date is ambiguous, so the item is held to the next run with the underlying advisory carried forward; Fortinet CVE-2026-44277 (FortiAuthenticator) / CVE-2026-26083 (FortiSandbox) — Fortinet PSIRT FG-IR-26-128 dated 2026-05-12, NCSC-CH advisory 2026-05-13, both outside the 36 h window; SAP May 2026 Security Patch Day (CVE-2026-34260, CVE-2026-34263) — SAP Security Notes dated 2026-05-12, outside window; CrowdStrike 2026 Financial Services Threat Landscape Report — both cited URLs carry publication date 2026-05-14 (not 2026-05-20 as the sub-agent return initially asserted), which puts the report 6 days outside the 36 h window. Item dropped from § 3 by iteration-1 verification (consistent with the SAP / Fortinet treatment in this same list); finance-sector audience may pick up the synthesis directly from the CrowdStrike press release or CrowdStrike blog.
  • Already-covered drops: Microsoft Fox Tempest malware-signing-as-a-service disruption — covered in 2026-05-20 active-threats; S3 re-surfaced the Microsoft Threat Intelligence and Microsoft On the Issues posts with no material new development beyond yesterday's coverage. Huawei VRP zero-day → Luxembourg POST 2025 nationwide outage — covered in 2026-05-20 active-threats with the same The Record + Security Affairs sources S4 re-surfaced; no new technical specificity or CVE assignment in this run.
  • Long-running-campaign rule application: Microsoft Exchange CVE-2026-42897 — re-surfaced by S2 with the same Microsoft MSRC + Microsoft Exchange Team + NCSC-CH + Help Net Security sources cited in the 2026-05-16 deep dive and the 2026-05-18 UPDATE. No new exploitation attribution, no new patch, no new victim class — per the long-running-campaign rule (≤1 consolidated UPDATE per week unless something critical changes) the item is not re-issued. Per PD-13 the imminent CISA KEV remediation deadline (2026-05-29, US-FCEB-only) is not a valid driver for a § 4 UPDATE.
  • Reduced-confidence / framing: B1ack's Stash 4.6M card dump included as a dark-web claim with explicit "not confirmed by issuing institutions" framing; SOCRadar and Security Affairs both analyse the actual dump, but per-issuer attribution is unverified. Huawei VRP / Luxembourg (not in this brief, but referenced in the dropped-list) — confidence remains MEDIUM in the sub-agent finding due to absence of any Huawei PSIRT advisory after ~10 months, no CVE assigned and no technical advisory specificity.
  • Contradiction: Grafana TanStack timeline — Grafana's own post-mortem (Grafana Labs, 2026-05-19) cites detection of the TanStack compromise on 2026-05-11; BleepingComputer's reporting (BleepingComputer, 2026-05-20) cites 2026-05-01 for the malicious-package consumption event. The brief reports Grafana's date on the basis that Grafana is the primary disclosing party for its own incident; the 10-day discrepancy may reflect the difference between the malicious-package's pull-time on the CI/CD runner and the detection event on Grafana's security team's timeline.
  • Single-source items: none in this brief — every published item carries ≥2 independent reputable sources or qualifies under the PD-5 national-CERT carve-out with the CERT acting as primary disclosing party.
  • CVEs that did not clear § 2 inclusion gates (PD-2 § 2 gates: CISA KEV, ENISA EUVD exploited=true or CVSS≥9.0, vendor/researcher report of ITW exploitation, or pre-auth RCE on widely-deployed internet-exposed software with public PoC): none dropped from in-window candidates in this run; out-of-window CVEs listed above were not evaluated against gates.
  • Sub-agent self-identification: all four cti-research sub-agents (S1, S2, S3, S4) returned with **Model:** and **Timestamps:** lines; the AI-content notice and Generated by: line collapse to the single distinct model Claude Sonnet 4.6 since all four research roles reported that model.
  • Verification disposition (Phase 5.7): five iterations ran with model rotation per v2.47 (iter-1 Opus, iter-2 Sonnet alt, iter-3 Opus cold, iter-4 Sonnet alt, iter-5 Opus cold); cumulative findings across iterations remediated in-line. Iter-5 returned NEEDS_FIXES with truth=1 (the unsupported "approximately 20 % the previous year" prior-year DBIR baseline in § 5 Headline shift paragraph) and one advisory (Grafana scope wording precision drift) — both remediated post-verdict before commit. The brief publishes at the v2.46 5-cap safety valve with verification_residual_count=1 recording the final-iteration verdict as the cap-breach signal for the Ops dashboard. The notable verification finding-cluster of this run was iter-3's surfacing of multiple sub-agent attribution-discipline regressions in the § 4 TeamPCP UPDATE (five FIRESCALE / 417k / SSM specifics misattributed to Wiz), all remediated by aligning the body to Wiz's actual published technical detail.
  • Coverage gaps: databreaches-net (Cloudflare 403, Wayback empty — now 5 consecutive run failures); inside-it-ch (403 persistent — 4-run failure); sophos-xops (HTTP 503 persistent — 4-run failure); trendmicro-research (HTTP 500 persistent, no Wayback snapshot); cyberscoop (TLS certificate not-yet-valid error); darkreading (HTTP 403, no Wayback); cert-fr-actu (feed stale since October 2025); us-treasury-ofac (503); cert-eu (200 empty-body — 2-run failure); edpb, cnil-fr, ico-uk, agid-csirt-it — quiet in window (no in-window enforcement items); ncsc-ch-security-hub bridge subcommand and chrome-releases and jpcert not fetched in this run.