OSINT / CyberSec report 07.05.2026 00:09

1. Palo Alto Networks warns that a critical buffer overflow vulnerability in PAN-OS tracked as CVE-2026-0300 is being actively exploited for unauthenticated remote code execution (thehackernews.com).

2. A critical Linux kernel local privilege escalation vulnerability known as Copy Fail or CVE-2026-31431 allows for stealthy root access on millions of systems (unit42.paloaltonetworks.com).

3. The Apache Software Foundation released updates for a critical HTTP/2 flaw tracked as CVE-2026-23918 that enables denial of service and potential remote code execution (thehackernews.com).

4. Threat actors are actively exploiting a critical code injection vulnerability in MetInfo CMS tracked as CVE-2026-29014 to achieve remote code execution (thehackernews.com).

5. A supply chain attack has compromised official DAEMON Tools installers to distribute a backdoor to thousands of users (bleepingcomputer.com).

6. A hacker claims to have stolen 280 million records containing student and staff data from over 8,800 educational institutions via a breach at Instructure (bleepingcomputer.com).

7. North Korean APT37 hackers targeted ethnic Koreans in China using Android malware named BirdCall hidden within card games (therecord.media).

8. A China-linked APT group identified as UAT-8302 is targeting government entities in South America and Europe using custom malware (thehackernews.com).

9. Google Threat Intelligence identified a sophisticated iOS zero-day exploit chain named DarkSword used by commercial surveillance vendors (schneier.com).

10. The CloudZ remote access tool is being used to exploit Microsoft Phone Link to steal credentials and one-time passwords (thehackernews.com).

11. A new Linux implant called Quasar Linux is targeting software developers with rootkit and credential-stealing capabilities (bleepingcomputer.com).

12. A critical vulnerability in Ollama deployments could expose 300,000 instances to information theft (reddit.com/r/cybersecurity).

13. A proof of concept for an Android ADB authentication bypass vulnerability tracked as CVE-2026-0073 has been disclosed (reddit.com/r/cybersecurity).

14. Google is expanding its Binary Transparency initiative for Android apps to mitigate supply chain attacks (thehackernews.com).