ShinyHunters Cripples Canvas in Massive Education Breach; Linux Kernel Hit by 'Dirty Frag' Zero-Day
Summary
A tumultuous period in cybersecurity ending May 9, 2026, was dominated by a large-scale extortion attack by ShinyHunters on the Canvas LMS, disrupting nearly 9,000 educational institutions globally. Concurrently, a critical zero-day vulnerability chain dubbed 'Dirty Frag' was disclosed, allowing root privilege escalation across major Linux distributions. Other significant events include active exploitation of a Palo Alto Networks firewall flaw, a supply chain attack on DAEMON Tools, and continued campaigns by state-sponsored actors like APT28 and financially motivated groups like Black Basta, highlighting threats across software supply chains, critical infrastructure, and educational sectors.
Today New Articles
Estonia Reports 1,100+ Cyber Incidents in April, Driven by Phishing and Service Outages
Estonia's Information System Authority (RIA) reported 1,138 cyber incidents in April 2026, highlighting a month of significant digital disruption. The incidents included repeated outages of critical services like the Health Insurance Fund's digital prescriptio...
German Defense Industry Under Siege from Supply Chain Attacks, Cyber Chief Warns
Germany's cyber warfare commander, Vice-Admiral Thomas Daum, has warned of a significant increase in cyberattacks targeting the country's defense industry and its supply chain. This surge coincides with Germany's major rearmament efforts and public support for...
Virginia Man with Cybercrime History Convicted for Deleting 96 Government Databases
A Virginia man named Akhter, who has a prior history of federal cybercrime convictions, was found guilty on May 8, 2026, for the deliberate destruction of 96 government databases. Akhter, a former database administrator, faces a potential sentence of up to 21...
Article Updates
Cybersecurity Stocks Tumble as Fears Mount Over AI's Hacking Prowess
Update:The Anthropic Mythos AI model, previously a source of market concern, has now demonstrated its capability by discovering 271 new vulnerabilities in Firefox 150 and the decade-old 'CopyFail' Linux LPE (CVE-2026-31431). This influx of AI-discovered flaws is comp...
OpenAI Launches GPT-5.4-Cyber, a Specialized AI Model for Defensive Cybersecurity
Update:OpenAI has unveiled GPT-5.5-Cyber, an updated specialized AI model for cybersecurity professionals, building on the previous 5.4 version. This iteration is being rolled out in a limited preview to vetted experts focused on critical infrastructure defense and h...
DAEMON Tools Installers Trojanized in Sophisticated Supply Chain Attack
Update:Kaspersky researchers have provided new details on the DAEMON Tools supply chain attack, confirming it ran for 27 days, from April 8 to May 5, 2026. The vendor has since released a clean version 12.6, ending the compromise window. The attack, which used digita...
Silver Fox APT Targets India and Russia with New 'ABCDoor' Backdoor
Update:The SilverFox APT campaign, active since December 2025, has expanded its targeting beyond India and Russia to include organizations in Indonesia and South Africa. New analysis reveals the Python-based ABCDoor backdoor possesses extensive capabilities, includin...
Critical Unpatched 'Dirty Frag' Linux Zero-Day Allows Instant Root Access
Update:Further analysis of the 'Dirty Frag' Linux kernel zero-day reveals it's an exploit chain involving two vulnerabilities: CVE-2026-43284 (xfrm-ESP/IPsec) and the newly identified CVE-2026-43500 (RxRPC subsystem). A public Proof-of-Concept (PoC) exploit is now av...
Palo Alto Networks Firewall Zero-Day Exploited in the Wild, CISA Orders Urgent Patch
Update:New reports highlight a critical four-day gap between CISA's May 9 deadline for federal agencies to apply mitigations for CVE-2026-0300 and Palo Alto Networks' expected patch release on May 13. This creates a high-pressure situation for defenders, forcing orga...
Russian APT28 Exploits Windows Shell Zero-Click Flaw for NTLM Theft
Update:Further analysis indicates that CVE-2026-32202 is a patch-differential vulnerability, arising from an incomplete Microsoft fix for an earlier zero-day, CVE-2026-21510. APT28 initially exploited CVE-2026-21510 from December 2025. Despite a Microsoft patch in Fe...