🔴 Cisco CVSS 10.0 Zero-Day, 📧 Exchange OWA Exploited, 🐧 Copy Fail Kernel LPE, 🤖 PraisonAI Exploited, 📞 BlackFile Vishing

Copy Fail is the day's defining story. CVE-2026-31431 is a deterministic local privilege escalation present in the Linux kernel since 2017 that grants root in seconds on every major distribution with a 700-byte script, and it escapes containers. CISA's May 15 remediation deadline has already passed, and Microsoft Defender has observed limited in-the-wild testing. Every Linux fleet needs a patch or mitigation decision now. Linux kernel Copy Fail zero-day (CVE-2026-31431) grants unprivileged root access

Forty-eight hours after Microsoft's first zero-day-free Patch Tuesday in nearly two years, CVE-2026-42897 is under active exploitation: a cross-site scripting flaw in Exchange OWA that fires when a victim opens a crafted email. No permanent patch exists, and Microsoft's emergency mitigation is the Exchange Emergency Mitigation Service with URL Rewrite protection. On-premises Exchange remains the weakest link in the mail stack. Microsoft Exchange Server zero-day CVE-2026-42897: active OWA spoofing, no permanent patch

A public Metasploit module for the Cisco SD-WAN flaw, the seventh exploited SD-WAN CVE of the year, makes the vulnerability scriptable for anyone before CISA's May 17 deadline. Pwn2Own Berlin has paid out more than $900,000 across 39 zero-days in two days, including Exchange and AI coding agents. Google's Project Zero writeup of a full Pixel 10 zero-click chain is the reference text for how deep mobile exploitation can go without interaction.

Watchlist: kernel patch status on container hosts, Exchange Emergency Mitigation Service enabled, and SD-WAN controller logs.