📰 DAILY THREAT BRIEFING
Wednesday, May 6, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of May 6, 2026.

  1. Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years
    — Unit 42

    Copy Fail (CVE-2026-31431) is a critical Linux kernel LPE that allows stealthy root access. This flaw impacts millions of systems. Read our …
  2. New stealthy Quasar Linux malware targets software developers
    — Bleeping Computer

    A previously undocumented Linux implant named Quasar Linux (QLNX) is targeting developers' systems with a mix of rootkit, backdoor, and cred…
  3. Instructure hacker claims data theft from 8,800 schools, universities
    — Bleeping Computer

    The hacker behind a breach at education technology giant Instructure claims to have stolen 280 million data records for students and staff f…
  4. Trellix Source Code Breach Highlights Growing Supply Chain Threats
    — Dark Reading

    Info is scant, but such breaches can reveal where a security product's controls are located and how detections are designed, giving attacker…
  5. DAEMON Tools trojanized in supply-chain attack to deploy backdoor
    — Bleeping Computer

    Hackers trojanized installers for the DAEMON Tools software and since April 8, delivered a backdoor to thousands of systems that downloaded …
  6. Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
    — The Hacker News

    The Apache Software Foundation (ASF) has released security updates to address several security vulnerabilities in the HTTP Server, including…
  7. DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware
    — The Hacker News

    A newly identified supply chain attack targeting DAEMON Tools software has compromised its installers to serve a malicious payload, accordin…
  8. Microsoft Edge Stores Passwords in Process Memory, Posing Enterprise Risk
    — Dark Reading

    A proof-of-concept exploit (PoC) shows how someone with admin privileges can exploit the issue to steal passwords, and thus use them to enga…
  9. Cleartext Passwords in MS Edge? In 2026?, (Mon, May 4th)
    — SANS ISC

    Yup, that is for real.
  10. China-Linked UAT-8302 Targets Governments Using Shared APT Malware Across Regions
    — The Hacker News

    A sophisticated China-nexus advanced persistent threat (APT) group has been attributed to attacks targeting government entities in South Ame…
  11. How the Story of a USB Penetration Test Went Viral
    — Dark Reading

    Two decades ago Dark Reading posted its first blockbuster — a column by a pen tester who sprinkled rigged thumb drives around a credit uni…
  12. SSL.com rotates their root certificate today, (Tue, May 5th)
    — SANS ISC

    I just got an email from SSL.com last night, they are rotating  out their root certificate today (M…

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (5759 in last 30 days).
Critical: 3 · High: 6 · Medium: 1 · Low: 0. View full dashboard →

  1. CVE-2026-41950
    — CVSS 6.5 (MEDIUM)

    Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file U…
  2. CVE-2026-7857
    — CVSS 7.2 (HIGH)

    A vulnerability has been found in D-Link DI-8100 16.07.26A1. This vulnerability affects the function sprintf of the file /user_group.asp of the component CGI Handler. The manipulation leads to buffer overflow. The attack…
  3. CVE-2026-7856
    — CVSS 7.2 (HIGH)

    A flaw has been found in D-Link DI-8100 16.07.26A1. This affects an unknown part of the file /url_member.asp of the component Web Management Interface. Executing a manipulation of the argument Name can lead to buffer ove…
  4. CVE-2026-44331
    — CVSS 8.1 (HIGH)

    In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is …
  5. CVE-2026-7855
    — CVSS 8.8 (HIGH)

    A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function tggl_asp of the file /tggl.asp of the component HTTP Request Handler. Performing a manipulation of the argument Name resul…
  6. CVE-2026-7854
    — CVSS 9.8 (CRITICAL)

    A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POST Parameter Handler. Such manipulation le…
  7. CVE-2026-42997
    — CVSS 7.7 (HIGH)

    An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone toke…
  8. CVE-2026-27960
    — CVSS 9.8 (CRITICAL)

    OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticate…
  9. CVE-2026-7853
    — CVSS 9.8 (CRITICAL)

    A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp of the component HTTP Handler. This manipulation of the argument enable/time causes buffer overfl…
  10. CVE-2026-7851
    — CVSS 7.2 (HIGH)

    A vulnerability was identified in D-Link DI-8100 16.07.26A1. This affects the function sprintf of the file yyxz.asp. The manipulation of the argument ID leads to stack-based buffer overflow. The attack is possible to be …

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · May 6, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com