Welcome back! This month we bring you the latest in cloud security - supply chain attacks, exclusive data, and critical vulnerabilities.
The Wiz Research team is tracking a recent increase in high-impact Linux kernel local privilege escalation (LPE) vulnerabilities disclosed throughout April and May 2026. Researchers revealed several universal LPE vulnerabilities — including “CopyFail,” “Dirty Frag,” and “Fragnesia” — affecting core kernel subsystems and enabling attackers to gain root access, tamper with privileged binaries, steal sensitive file descriptors, and potentially escape containerized environments.
✨Highlights
Multiple Linux Kernel Privilege Escalation Vulnerabilities Disclosed in May
Multiple high-impact Linux kernel local privilege escalation (LPE) vulnerabilities were disclosed throughout April and May 2026, highlighting continued risk in low-level kernel subsystems. The most notable was CVE-2026-31431 (“CopyFail”), published on April 29, which abuses a flaw in the kernel’s AEAD crypto implementation (algif_aead) to overwrite page cache contents and modify privileged binaries at execution time, enabling root access and, in some scenarios, container escape. Shortly afterward, researchers disclosed “Dirty Frag” and “Fragnesia,” two additional universal Linux LPE techniques targeting the ESP/XFRM networking stack and related kernel subsystems. Dirty Frag leveraged flaws in ESP and RxRPC handling to achieve arbitrary writes into the kernel page cache, while Fragnesia abused the ESP-in-TCP subsystem to perform arbitrary byte writes into read-only files without race conditions. Another vulnerability, CVE-2026-46333, exposed a flaw in process teardown logic that allowed attackers to steal file descriptors from exiting privileged processes and access sensitive files such as /etc/shadow and SSH host private keys. Public proof-of-concept exploits for these vulnerabilities demonstrated successful exploitation across multiple major Linux distributions.
Learn more in our blogs (1, 2, 3)
Continued TeamPCP Supply Chain Activity Impacts Open Source and CI/CD Ecosystems
TeamPCP-linked supply chain activity continued throughout May 2026, with attackers compromising npm packages, PyPI packages, and CI/CD tooling. Researchers observed additional “Mini Shai-Hulud” style npm compromises targeting popular JavaScript ecosystems such as AntV, alongside malicious PyPI releases of durabletask containing credential-stealing malware designed to exfiltrate cloud, developer, and CI/CD secrets.
The campaign also impacted enterprise tooling, including the compromise of the Checkmarx AST Scanner Jenkins Plugin distribution chain. Attackers reportedly obtained publishing credentials, distributed a backdoored plugin through official channels, and inserted malicious code designed to steal credentials from Jenkins environments. The activity highlights TeamPCP’s continued focus on software supply chain attacks targeting developer infrastructure and trusted package ecosystems.
🐞 High Profile Vulnerabilities
Critical Vulnerabilities in PAN-OS Exploited in-the-Wild
On 2026-05-05, a critical vulnerability (CVE-2026-0300) was published for Palo Alto Networks PAN-OS that allows unauthenticated attackers to achieve remote code execution (RCE) with root privileges. The issue affects the User-ID Authentication Portal (Captive Portal) and is actively exploited in limited cases, particularly when exposed to untrusted networks or the public internet.
On 2026-05-13, a high severity authentication bypass vulnerability was published that affects the same version ranges of PAN-OS (CVE-2026-0265). Wiz is currently working on adding detection for this second vulnerability, but the existing detection for CVE-2026-0300 is applicable (as it checks for the same version constraints).
According to Wiz data, 22% of cloud environments have resources vulnerable to these vulnerabilities.
Learn more here https://security.paloaltonetworks.com/CVE-2026-0300
Multiple Remote Code Execution Vulnerabilities in Redis
Five vulnerabilities (CVE-2026-23479, CVE-2026-23631, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589) affecting Redis were identified by researchers during Wiz zeroday.cloud and have since been remediated. Several of these issues could allow authenticated attackers to achieve remote code execution (RCE), primarily due to memory safety flaws (use-after-free and invalid memory access). The vulnerabilities impact both core Redis functionality and optional modules. Exploitation requires authenticated access, but successful attacks could result in full system compromise, data exfiltration, or service disruption.
According to Wiz data, 40% of cloud environments have resources vulnerable to these vulnerabilities.
Learn more here https://redis.io/blog/security-advisory-cve202623479-cve202625243-cve-2026-25588-cve202625589-cve-2026-23631/
Critical Sandbox Escape Vulnerability in vm2
A critical sandbox escape vulnerability in vm2 (CVE-2026-26956) allows attacker-controlled JavaScript to break out of the sandbox and execute arbitrary commands on the host Node.js process. The issue impacts environments that rely on vm2 for isolating untrusted code, effectively bypassing a core security boundary and enabling host compromise under certain conditions.
According to Wiz data, 2% of cloud environments have resources vulnerable to this vulnerability.
Learn more here https://socket.dev/blog/free-certified-patches-for-critical-vm2-sandbox-escape
NGINX Rift: Buffer Overflow Vulnerability in NGINX
Researchers disclosed details for CVE-2026-42945 (“NGINX Rift”), an 18-year-old heap corruption vulnerability in NGINX that can allow unauthenticated remote code execution (RCE) through crafted HTTP requests. While the vulnerability affects a broad range of NGINX and F5 products dating back to 2008, researchers scanned 1,465 NGINX configurations from 528 popular GitHub repositories and found no vulnerable configurations in widely used open-source projects, suggesting the required vulnerable configuration pattern is relatively uncommon in practice.
Learn more here https://enclave.ai/blog/nginx-rift-impact-in-the-wild-we-scanned-1465-configs-from-528-popular-repos
🔓Security incidents & campaigns
JINX-0164 Targeting Cryptocurrency Development Infrastructure
Wiz Research identified an active campaign targeting cryptocurrency organizations and software development environments through social engineering, malicious meeting lures, and supply chain compromise activity. Attackers used fake business outreach and trojanized software to deliver malware capable of stealing browser credentials, cryptocurrency wallets, cloud secrets, SSH keys, and CI/CD credentials. The campaign also involved attempts to compromise GitHub repositories and overwrite GitHub Actions secrets from infected endpoints. Based on the targeting patterns, infrastructure, and operational tradecraft observed, Wiz Research assesses with moderate confidence that the activity overlaps with DPRK-linked cryptocurrency-focused threat operations.
Learn more in our blog https://www.wiz.io/blog/threat-actors-target-crypto-orgs
DDoS Botnet Leveraging Jenkins Misconfigurations for Initial Access
A newly observed DDoS botnet campaign exploits misconfigured Jenkins instances to gain remote code execution and deploy multi-platform malware. The activity, identified via honeypot telemetry, demonstrates continued opportunistic targeting of internet-facing CI/CD infrastructure, with infected hosts used to launch UDP, TCP, and application-layer attacks.
Learn more here https://www.darktrace.com/blog/darktrace-malware-analysis-jenkins-honeypot-reveals-emerging-botnet-targeting-online-games
TeamPCP Claims Breach of Internal GitHub Repositories
GitHub disclosed that it is investigating unauthorized access to internal repositories after the threat actor group TeamPCP claimed to have compromised and exfiltrated internal GitHub data, allegedly including approximately 4,000 private repositories containing source code related to GitHub’s platform and internal organizations. At the time of writing, GitHub stated that it has not identified evidence of impact to customer repositories, enterprises, or organizations outside of its internal systems.
Learn more here https://x.com/github/status/2056884788179726685?s=20
Megalodon Campaign Backdoors GitHub Repositories via CI Workflow Compromise
Researchers disclosed a large-scale software supply chain campaign dubbed “Megalodon,” in which attackers reportedly compromised thousands of GitHub repositories by injecting malicious GitHub Actions workflows designed to exfiltrate secrets and cloud credentials. The campaign is believed to have affected over 5,500 repositories within several hours and included the compromise of npm package releases associated with impacted repositories.
Learn more here https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows/
Supply Chain Campaign Targeting Composer and GitHub Repositories
Researchers identified multiple coordinated software supply chain attacks targeting Composer/Packagist packages and upstream GitHub repositories. The activity involved malicious postinstall hooks, compromised Git tags, CI/CD payload execution, and credential-stealing malware designed to exfiltrate secrets from developer systems and CI environments. The campaigns impacted Laravel-related packages as well as additional PHP and Node.js repositories, with malicious code delivered through package installation workflows, Composer autoload behavior, and GitHub Actions pipelines.
Learn more here https://www.stepsecurity.io/blog/laravel-lang-supply-chain-attack#indicators-of-compromise
Hold on to your headphones!
Tune in to "Crying Out Cloud", our monthly roundup of cloud security news podcast! Hosted by the talented duo Eden Naftali and Amitai Cohen 👏
Listen on Spotify and Apple Podcasts.