Daily · 2026-05-09
Dirty Frag Exploitation, Polish Water ICS Breaches, CISA 4-Day Ivanti Patch, ShinyHunters Extends Deadline
Microsoft confirms active Dirty Frag Linux kernel exploitation in the wild while CVE-2026-43500 remains unpatched. Polish intelligence reports ICS breaches at five water treatment plants attributed to APT28/APT29. CISA gives federal agencies four days to patch Ivanti EPMM zero-day.
Dirty Frag moved from disclosed to confirmed within a day. Microsoft telemetry shows active exploitation: external SSH connections spawning interactive shells, an ELF payload escalating via su, and post-exploitation aimed at authentication files and session harvesting. One of the two underlying flaws is patched in mainline, but the RxRPC vector remains open with no fix timeline, and it requires only normal user privileges.
The Polish water treatment plant breaches are the most consequential state-activity story. Poland's Internal Security Agency attributes intrusions at five municipal plants to APT28 and APT29 operating through hacktivist personas, with attackers reaching ICS systems and modifying operational parameters. Weak passwords and direct internet exposure were the entry points, the same failure mode as the water-utility campaigns tracked for weeks.
Ivanti's EPMM zero-day got the KEV treatment with a four-day federal deadline and over 850 exposed instances, and the ShinyHunters Canvas extortion deadline moved to May 12 with Harvard, MIT, and Cambridge among the listed institutions. RansomHouse's Trellix listing with April 17 intrusion screenshots keeps the source-code exposure active. PamDOORa, a PAM backdoor sold for $900 on Russian forums, is a cheap persistence technique worth hunting for.
Watchlist: CVE-2026-43500 patches, internet-exposed ICS controllers, EPMM patching by the May 10 deadline, and direct extortion outreach to affected schools.