Daily · 2026-05-29
🔴 Samba CVSS 10.0, Gogs 0-Day RCE, Charter & Carnival Breaches, GreyVibe AI Cyberespionage
Two critical RCV vulnerabilities lead: Samba CVE-2026-4480 (CVSS 10.0, unauthenticated RCE in printing subsystem) and Gogs 0-day (CVSS 9.4, unpatched with Metasploit module). Major breaches confirmed — Charter Communications (4.9M accounts) and Carnival Cruise (6M customers including SSNs). GreyVibe Russian hybrid threat group uses ChatGPT/Gemini for AI-powered cyberespionage across 5 campaign tracks. MicrosoftSystem64 npm supply chain malware abuses HuggingFace for stealthy exfiltration.
The Samba printing flaw is the day's defining story. CVE-2026-4480 is a CVSS 10.0 unauthenticated remote code execution: a crafted job description is passed to the shell through the %J substitution in the print command, with no authentication and no user interaction required. Not every deployment is exposed, since the print command must include %J and CUPS and iPrint backends are unaffected, but any enterprise running Samba as a Windows-compatible print server should treat versions 4.22.10, 4.23.8, and 4.24.3 as an emergency upgrade. Samba printing RCE
The Gogs argument injection is the other headline. A zero-day with no fix lets any authenticated user reach code execution through the rebase-before-merge path, and because open registration is the default, an unauthenticated attacker can register, create a repository, and exploit it. Rapid7 published a Metasploit module and counts 1,141 internet-facing instances; disabling registration and setting repository creation limits are the interim controls.
The breach disclosures are consequential. Carnival confirmed 5.99 million customers exposed, with Social Security numbers and passport numbers in the stolen data from a social-engineering compromise of an employee account, its third major incident, with notifications beginning more than six weeks after discovery. On the ransomware side, Microsoft dissected The Gentlemen, a self-propagating Go-based RaaS that attempts 21 remote execution paths per target host, which raises the bar for lateral movement containment.
Watchlist: emergency Samba patching where %J is in use, Gogs registration lockdown, and identity monitoring for anyone in the Carnival and Charter datasets.