Daily · 2026-05-21
🛡️ Defender Zero-Days Exploited, 🔑 Linux SSH Key Flaw, ☁️ DigiCert CA Breach, 🎯 TeamPCP Supply Chain, 🛡️ NVIDIA Triton 9.8
Microsoft warns of two actively exploited Defender zero-days (CVE-2026-41091, CVE-2026-45498) added to CISA KEV; DigiCert reveals 60 code-signing certificates stolen via malicious screenshot attack on customer support; TeamPCP supply chain campaign widens to Microsoft DurableTask Python client (400K monthly downloads) while Grafana confirms missed token rotation and GitHub details 3,800-repo breach via Nx Console VS Code extension; nine-year-old Linux kernel flaw (CVE-2026-46333) enables SSH key and shadow file exfiltration; NVIDIA Triton Inference Server patches 8 CVEs including 9.8 auth bypass; Drupal releases critical security update with expected public exploit within hours; CloudZ RAT abuses Microsoft Phone Link for SMS OTP interception; Verizon DBIR 2026 shows vulnerability exploitation overtaking credential theft as top breach vector.
Actively exploited zero-days in Microsoft Defender define the day. CVE-2026-41091 and CVE-2026-45498, privilege escalation to SYSTEM in the Malware Protection Engine and denial of service in the Antimalware Platform, are both in the CISA KEV catalog with a June 3 federal deadline. Because Defender runs on nearly every Windows endpoint, a privilege escalation inside the antivirus engine is an especially attractive target, and the emergency patch should be treated as mandatory, not routine. Microsoft Defender zero-days
The ssh-keysign-pwn race condition in the Linux kernel is a six-year-old logic flaw that lets an unprivileged user steal SSH host keys and /etc/shadow contents. It works on default YAMA settings and has working exploits on current Debian and Ubuntu releases, which makes it one of the more consequential kernel disclosures in some time. Linux ssh-keysign-pwn
The DigiCert breach shows a chat-based social engineering chain that stole 60 code-signing certificates, and the SonicWall MFA bypass shows patched appliances that remained vulnerable because a required post-update LDAP step was skipped. Verizon's DBIR confirms the direction: vulnerability exploitation has overtaken credential theft as the top breach vector, with only 26 percent of KEV-listed flaws remediated in time.
Watchlist: Defender engine update status, kernel patch deployment for CVE-2026-46333, code-signing certificate inventory, and SonicWall LDAP reconfiguration checks.