ClarityBeta

Security & Threat Intelligence

The Watch

6 min read · 1,105 words · 3 moves to watch
The Signal

Three critical exploits are hitting trust infrastructure simultaneously this week

Patch cPanel and MOVEit this weekend, freeze poisoned lockfile versions today, and rotate every CI/CD secret touched between April 29 and May 4.

In Play

  1. Trust Infrastructure Under Mass Exploitation

    cPanel (44K IPs, ransomware), MOVEit (1,400 exposed, Clop-shaped), Mini Shai-Hulud (8.3M downloads poisoned), and DigiCert (60 certs revoked after .scr social engineering) were all compromised in the same 7-day window. The common thread: infrastructure customers trust by default.

    Ask Clarity

  2. AI-Generated PoC Flood Degrades SOC Triage Capacity

    CVE-2026-31431 (Linux kernel LPE, KEV-listed, 9 years in codebase) triggered an AI-generated copycat PoC flood that analysts cannot reliably separate from working exploits. NVD is simultaneously scaling back enrichment to only KEV/critical software. At BSidesSF 2026, 16 teams fully solved the CTF with LLM architectures vs. 1 in 2025.

    Ask Clarity

  3. AccountDumpling + Salt Typhoon: New Campaign TTPs

    AccountDumpling phishes from Google AppSheet infrastructure, passing SPF/DKIM/DMARC by design — 30,000+ Facebook accounts compromised. Salt Typhoon breached IBM's Italian MSP subsidiary (Sistemi Informativi), gaining adjacency to Italian government infrastructure. Both bypass standard detection: one exploits email authentication trust, the other exploits managed-service trust.

    Ask Clarity

  4. NHI/Agent Identity Hits Enterprise Consolidation Point

    Cisco paid $400M for Astrix, SAP is actively blocking unauthorized AI agents (OpenClaw named), and Google shipped AI Control Center — all in the same week. Non-human identities outnumber humans 40:1. The market has priced in that agent identity is a Tier-1 control gap; orgs without an NHI inventory are now behind the vendor curve.

    Ask Clarity

  5. AI Governance Regime Change: Pre-Release Vetting Crystallizes

    EU is evaluating Anthropic's Mythos for banking software vulnerability scanning. White House EO on pre-release model review is in draft. Open-source 'Theoretical Mythos' replication effort launched same day. xAI admitted in court to distilling OpenAI models, setting distillation precedent. Model governance is shifting from voluntary to mandatory within 12 months.

    Ask Clarity

Deep Dives

Four Trust Anchors Breached in Seven Days — The Infrastructure Layer Is the Target

What Happened

Between April 29 and May 5, four categories of infrastructure that security teams are told to trust by default were compromised in parallel: a certificate authority (DigiCert), package registries (npm/PyPI via Mini Shai-Hulud), a web hosting control plane (cPanel), and a managed file transfer vendor (MOVEit). Different actors. The calendar overlap is almost certainly coincidence. The combined blast radius is not.

cPanel CVE-2026-41940 — Mass Exploitation Active

CRLF injection authentication bypass in cPanel/WHM 11.40+. CVSS 9.8. KnownHost places first exploitation in late February. Watchtowr published a PoC on April 30. Mass exploitation followed, visible across 44,000 Shadowserver-fingerprinted IPs. The 'Sorry' ransomware is landing on Linux hosts. Ctrl-Alt-Intel flags targeted activity against SE Asian government/military and MSPs in Philippines, Laos, Cambodia, South Africa, and the US.

MOVEit Automation CVE-2026-4670 — The Clop Window Is Open

Pre-auth, zero-interaction bypass. Fixed in 2025.1.5, 2025.0.9, 2024.1.8. Daniel Card counted 1,400+ internet-exposed instances via Shodan, including US state and local government. This is the sixth MOVEit vulnerability cycle since 2023. Clop's operating model is to hold access, build tooling, and fire at the entire population in a single window. That makes this a pre-campaign signal, not an incident. NYDFS fined Delta Dental $2.25M for its 2023 MOVEit response the same week.

Mini Shai-Hulud — Supply Chain Worm

Attributed to TeamPCP by Wiz. Self-propagating secret-harvester using preinstall scripts in npm and PyPI to exfiltrate GitHub tokens, npm tokens, and cloud credentials. Affected packages: SAP mbt v1.2.48, @cap-js/db-service v2.10.1, @cap-js/postgres v2.2.2, @cap-js/sqlite v2.2.2, plus compromised PyTorch Lightning and intercom-client releases. Reported scope: 8.3M downloads, 1,800+ repositories leaking credentials. Stolen tokens are used to poison further packages. The loop is the point.

DigiCert Certificate Theft

Entry was a .scr file disguised as a customer screenshot, delivered through DigiCert's customer support chat. Four prior attempts were blocked. The fifth landed. Result: 60 certificates revoked. Any DigiCert-signed binary ingested between April 2 and May 2 requires revalidation. Attacker-signed payloads are confirmed in the wild.

The attackers did not breach the perimeter. They breached the parties the perimeter trusts — the CA, the package registries, the hosting control plane, and the MFT vendor.

What to do

  1. Patch cPanel/WHM immediately and run the May 4 refined detection script against 90 days of access logs for CRLF injection patterns

  2. Patch MOVEit Automation to 2025.1.5/2025.0.9/2024.1.8 and remove all instances from public internet behind VPN/ZTNA by end of weekend

  3. Freeze builds resolving to poisoned SAP/Lightning/intercom-client versions and rotate every CI/CD secret from April 29–May 4

  4. Revalidate all DigiCert-signed binaries ingested April 2–May 2 and tighten CRL/OCSP refresh to ≤24 hours across fleet

AI-Generated Exploit Noise Is Degrading Your Triage Pipeline — And NVD Just Cut Enrichment

The Convergence

Three developments hit the same SOC bottleneck simultaneously: a flood of AI-generated copycat PoCs for CVE-2026-31431, the NVD announcing scope cuts to enrichment, and empirical proof at BSidesSF 2026 that AI-assisted exploitation has reached parity with human operators.

CVE-2026-31431: The Triage Problem

CISA added this Linux kernel privilege-escalation flaw to KEV this week. The bug has been in mainline since 2017 — nine years undetected. It is a post-foothold local privilege escalation: chain it with any RCE, webshell, or compromised CI runner and it returns root. Major distros have patches available.

The novel dimension: Theori's disclosure was itself AI-generated, and the downstream PoC flood is largely AI-generated. Some PoCs work. Some are weaponized (trojanized). Most are noise. Signature-based triage degrades when the PoC corpus multiplies overnight. Analysts cannot reliably separate working exploits from hallucinated ones before their shift ends.

NVD Scope Cut

NVD announced it is scaling back CVE enrichment to only KEV entries, government-used, or 'critical' software — explicitly citing AI-generated vulnerability volume. Every vulnerability scanner, SBOM analyzer, and patch tool assuming universal NVD enrichment will develop blind spots. Alternative enrichment pipelines (CISA KEV + EPSS) move from nice-to-have to primary signal.

BSidesSF 2026: Offensive AI Parity Is Empirical

16 teams fully solved the BSidesSF 2026 CTF using coordinator-LLM architectures (Claude Opus 4.6 + GPT-5.4-mini in parallel), up from 1 team in 2025. Easy-to-medium exploitation is now a compute-spend problem. Detection engineering must assume faster time-to-exploit and broader opportunistic targeting, not just APT scenarios.

A nine-year-old Linux kernel bug is being exploited in the wild while AI-generated noise makes triage a full-time job and NVD cuts the data your tools depend on. The triage pipeline itself is under attack.

What This Changes

AssumptionOld RealityNew Reality
PoC qualityHuman-authored, reviewableAI-generated at volume; trojanized variants mixed in
NVD completenessUniversal enrichmentKEV/critical only; gaps on secondary CVEs
Exploitation speedDays-to-weeks post-advisoryHours; AI-assisted tooling compresses to compute spend
Adversary skill floorRequires domain expertise16x more teams solving CTFs with LLM orchestration

What to do

  1. Patch CVE-2026-31431 across all Linux fleets (hosts, containers, K8s nodes) with internet-exposed and multi-tenant systems first within 72 hours

  2. Issue PoC handling guidance: no execution of third-party CVE-2026-31431 PoCs outside isolated detonation environments; prefer vendor/distro patches as ground truth

  3. Add CISA KEV + EPSS as primary vulnerability prioritization signals and build alternative enrichment pipeline independent of NVD

  4. Update vuln-intel intake workflow to flag AI-authored advisories for mandatory human technical validation before they trigger patch SLAs

Two New Campaigns Bypass Standard Defenses: AppSheet Email Auth and MSP Trust

AccountDumpling: Authenticated Phishing via Google AppSheet

The operators are Vietnamese-linked. The mail is sent from Google's own AppSheet infrastructure, which passes SPF, DKIM, and DMARC by design for google.com-adjacent senders. Most gateway policies were written for Workspace sending paths, not AppSheet. Nothing is spoofed. The mail is legitimately authenticated.

Four lure families are in rotation: Netlify-hosted fake Facebook help centers, Vercel-hosted security and blue-badge verification flows, Google Drive PDFs fronting live phishing panels, and recruiter-style approaches. Credentials, government IDs, and 2FA codes are funneled into Telegram bots for takeover and resale. Current confirmed scope: 30,000+ compromised Facebook business accounts.

The gap is structural, not tactical. Sender-reputation filters do not flag google.com-adjacent infrastructure. URL-reputation systems lag on Netlify and Vercel disposable domains. The technique will outlive this actor because the authentication math favors the attacker until Google changes it.

Salt Typhoon → IBM Italy → Italian Government

Publicly: IBM has confirmed the April 2026 breach of Sistemi Informativi, its Italian MSP subsidiary, and says it was "identified and contained." Not publicly: La Repubblica attributes the intrusion to Salt Typhoon. The subsidiary runs IT infrastructure for Italian public agencies and critical industries. Scope is undisclosed and may not yet be known internally.

Salt Typhoon's 2025–2026 roster reads like an MSP-pivot playbook: Viasat, Canadian telecoms, the US Army National Guard, the Dutch government. The access path of choice is Citrix and Cisco zero-days, not phishing. One MSP compromise yields downstream access to every client on the books, and clients rarely see MSP-side telemetry.

Campaign Comparison

CampaignVectorDefense GapUrgency
AccountDumplingGoogle AppSheet-origin phishingSender reputation bypassed; Netlify/Vercel URL gapsHigh (days)
Salt Typhoon via MSPCitrix/Cisco zero-day → supply chainThird-party standing privileges; weak MSP telemetryHigh (weeks)
When attackers send mail from Google's own infrastructure and pivot through IBM's own subsidiary, the trust model your defenses rely on is the attack surface.

What to do

  1. Block or quarantine [email protected] senders and add URL rules for Netlify/Vercel-hosted Facebook/Meta brand impersonation pages within 48 hours

  2. Audit MSP and managed-infrastructure access: enumerate third-party standing credentials, revoke persistent admin, enforce JIT access with session recording for Citrix/Cisco-adjacent vendors

  3. Hunt for 90 days of AppSheet-originated mail in your tenant and flag any with Netlify/Vercel/Google Drive URLs for user notification

  4. Confirm EDR telemetry from vendor-managed hosts lands in your SIEM, not just the MSP's tooling

The bottom line

Three critical exploits are hitting trust infrastructure simultaneously — cPanel ransomware across 44,000 hosts, MOVEit in Clop's crosshairs with 1,400 exposed instances, and a supply-chain worm that leaked secrets from 1,800 repositories — while AI-generated PoC noise is degrading the SOC's ability to triage, and NVD just cut its enrichment scope. Patch cPanel and MOVEit this weekend, quarantine poisoned npm/PyPI packages and rotate CI secrets today, and stop trusting any AI-generated exploit code or advisory without human validation.