Daily · 2026-05-27
Windows Kernel LPE DigiCert CA Compromise KnowledgeDeliver Zero-Day WhatsApp Zero-Click Charter Breach Fragnesia Linux LPE
Critical: Windows kernel LPE bypasses all browser sandboxes (CVE-2026-40369, public PoC), DigiCert CA compromised via support chat — stolen EV certs signed Zhong Stealer malware (60 certs revoked), KnowledgeDeliver zero-day exploited for Cobalt Strike via hardcoded machine keys, zero-click WhatsApp takeover chain on iOS 16 targeting 200+ victims. Gaps from Reddit: DigiCert, Fragnesia Linux LPE regression (CVE-2026-46300), NIST/NVD halts universal CVE enrichment (29K CVEs abandoned). Priority actions: apply May 2026 Patch Tuesday, audit ASP.NET machine keys, review NVD blind spots, deploy endpoint coverage on support systems.
The DigiCert compromise is the day's defining story. A threat actor posing as a customer in support chat delivered a malicious screensaver file that compromised two endpoints, then used a customer-view proxy feature to extract initialization codes for pending EV code-signing orders. Twenty-seven stolen certificates signed Zhong Stealer, letting it bypass SmartScreen and trust checks, and DigiCert revoked 60 certificates across 13 countries, including Lenovo, Palit, and Tencent customers. Root causes were operational: an endpoint with no sensor, weak controls around certificate initialization codes, and a portal that forwarded attacker attachments to staff. DigiCert CA compromise
The patching pressure is the Windows kernel LPE. A researcher released a full exploit for CVE-2026-40369, which lets any unprivileged process, even a sandboxed browser renderer, reach SYSTEM deterministically; the May Patch Tuesday update is the only fix. Fragnesia adds the Linux counterpart: a regression from the Dirty Frag patch creates another page-cache write primitive (CVE-2026-46300) in kernels before May 13, with a public PoC.
Two more items carry consequence. A zero-click WhatsApp takeover chaining CVE-2025-43300 and CVE-2025-55177 is actively hijacking iOS 16 accounts, roughly 200 victims in three months, with sessions invisible in Linked Devices. Separately, NIST ended universal NVD enrichment: about 29,000 CVEs now carry no CVSS, CPE, or CWE data from NIST, so NVD-dependent workflows will silently miss affected products.
Watchlist: apply the May Windows updates, patch or quarantine Linux hosts on pre-May 13 kernels, treat iOS 16 devices as replaceable, and cross-check vulnerability data against vendor advisories.