#shai-hulud · kyber.today

July 27, 2026

Two Live Exploits and a Bench of Fresh Offensive Tooling

GitLab default-config RCE received a full technical write-up detailing memory-corruption bugs in the Oj JSON parser, and a working NGINX RCE exploit (CVE-2026-42533) was open-sourced. A Linux kernel local privilege-escalation flaw (CVE-2026-31431) affects all mainstream distributions with no vendor patches yet, while a Fortinet FortiClient kernel driver vulnerability enables credential theft. Multiple new offensive tools emerged including Nocturne (Windows loader), NaX (C2 beacon), beignet (macOS shellcode), Waypoint (EDR-bypass driver), and RootHound (Linux privilege-escalation mapper). Claude Opus 5 achieved 30.2% on ARC-AGI-3 benchmark while WallBreaker jailbreak claims emerged targeting the model. Supply-chain attacks continued with malicious npm/PyPI packages including a Shai-Hulud worm variant and a disguised @copilot-mcp/apex macOS infostealer.

June 17, 2026

Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists

A critical day for AI and enterprise security: Microsoft 365 Copilot was patched for the "SearchLeak" one-click exfiltration vulnerability (CVE-2026-42824), while Novo Nordisk confirmed a breach exposing trained AI models and proprietary training data to extortionists. Multiple actively-exploited flaws emerged in Fortinet FortiSandbox, Joomla JCE, Cisco Catalyst SD-WAN Manager, LiteSpeed cPanel, and Palo Alto GlobalProtect, alongside supply-chain compromises affecting Arch Linux AUR, JetBrains Marketplace, and npm packages. Major APTs including UNC6508, SprySOCKS (FishMonger), ScarCruft, and SideCopy expanded targeting of medical research, defense, and developer communities.