Daily · 2026-05-05
🔴 Copy Fail Exploited, 🏛️ AiTM Phishing 35K Users, 📦 PyTorch Backdoored, 🌐 Apache RCE, 💰 Everest Hits TSYS
CISA confirms active exploitation of the Copy Fail Linux kernel vulnerability as it enters the KEV catalog. A sophisticated Microsoft-documented AiTM phishing campaign targeted 35,000 users across 13,000 organizations, while the PyTorch Lightning supply chain attack deployed the ShaiWorm credential stealer to millions of developers. Organizations should immediately patch Copy Fail, Apache HTTP Server, and Android devices, and rotate credentials if PyTorch Lightning 2.6.3 was used.
Copy Fail is the day's defining story. CISA added CVE-2026-31431 to its Known Exploited Vulnerabilities catalog with active in-the-wild exploitation confirmed, and the flaw grants unprivileged root on every major distribution since 2017, including container escape. The disclosure drew criticism for leaning on AI-generated analysis that obscured the technical severity, which is a reminder to judge exploit quality on its own terms.
The PyTorch Lightning backdoor is the day's supply-chain headline. Version 2.6.3 on PyPI hides the same Bun runtime download and obfuscated payload pattern as the Mini Shai-Hulud campaign, and the ShaiWorm stealer targets .env files, browser data, and cloud credentials, marking AI developers as the intended victims. Microsoft's code-of-conduct phishing campaign hit 35,000 users across 13,000 organizations with a multi-stage AiTM chain that bypasses non-phishing-resistant MFA.
Patch debt is heavy. Apache HTTP Server's HTTP/2 double-free requires 2.4.67, the Android adbd zero-click flaw requires the May security patch, and the Everest ransomware claim against TSYS is the second major financial-sector claim in three days. Microsoft Edge loading every saved password into cleartext memory at startup is by design, a finding terminal-server shops should act on. The DigiCert attack chain is now fully documented: a malicious screensaver that slipped past a malfunctioning sensor led to 60 fraudulent EV certificates.
Watchlist: kernel updates for Copy Fail, PyPI package pins, Apache and Android patch status, and Edge password storage on shared infrastructure.