2026-05-02: Linux kernel privilege escalation vulnerability CVE-2026-31431 hits CISA's KEV catalog with a May

Show Notes - 2026-05-02 Stories Covered: - May 2, 2026 - Today: - CVE-2026-31431: Linux Kernel Copy Fail Privilege Escalation (CISA KEV) (https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/) - CVE-2026-41940: Critical cPanel Remote Code Execution Under Active Exploitation (https://go.theregister.com/feed/www.theregister.com/2026/05/01/critical_cpanel_vuln_hits_cisa/) - Two Cybersecurity Professionals Sentenced for BlackCat Ransomware Deployment (https://thehackernews.com/2026/05/two-cybersecurity-professionals-get-4.html) - Cordial Spider and Snarky Spider: Rapid SaaS Extortion Through Vishing and SSO Abuse (https://thehackernews.com/2026/05/cybercrime-groups-using-vishing-and-sso.html) - New York DFS Secures $2.25 Million Settlement from Delta Dental Over MOVEit Breach (https://databreaches.net/2026/05/01/nysdfs-secures-2-25-million-cybersecurity-settlement-with-delta-dental/?pk_campaign=feed&pk_kwd=nysdfs-secures-2-25-million-cybersecurity-settlement-with-delta-dental) - ClickFix Campaign Delivers CastleLoader and NetSupportRAT via Fake Background Removal Sites (https://www.huntress.com/blog/clickfix-castleloader-backgroundfix) - MacSync Stealer Distributed Through Malicious Homebrew Ads (https://isc.sans.edu/diary/rss/32942) - 30,000 Facebook Accounts Compromised in Vietnamese Google AppSheet Phishing Operation (https://thehackernews.com/2026/05/30000-facebook-accounts-hacked-via.html) - China-Aligned Espionage Campaign Targets Asian Governments, NATO Member, Journalists (https://thehackernews.com/2026/05/china-linked-hackers-target-asian.html) - Instructure (Canvas LMS) Discloses Cybersecurity Incident (https://www.bleepingcomputer.com/news/security/edu-tech-firm-instructure-discloses-cyber-incident-probes-impact/) - Trellix Confirms Source Code Breach With Unauthorized Repository Access (https://thehackernews.com/2026/05/trellix-confirms-source-code-breach.html) - AI Coding Agents Deleting Production Databases (https://www.darkreading.com/cloud-security/ais-so-smart-keep-deleting-production-databases) - Microsoft Agent 365 Now Generally Available for Agent Security and Governance (https://www.microsoft.com/en-us/security/blog/2026/05/01/microsoft-agent-365-now-generally-available-expands-capabilities-and-integrations/) - Microsoft Allows Dynamic Removal of Pre-Installed Store Apps via GPO (https://www.bleepingcomputer.com/news/microsoft/microsoft-now-lets-admins-choose-pre-installed-store-apps-to-uninstall/) - Microsoft Fixes Remote Desktop Security Warning Display Bug (https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-remote-desktop-warnings-displaying-incorrectly/) - CISA and International Partners Release Agentic AI Security Guidance (https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services) - UK NCSC Warns of AI-Driven Patch Tsunami (https://go.theregister.com/feed/www.theregister.com/2026/05/02/ncsc_brace_for_patch_tsunami/) - OpenAI Restricts GPT-5.5-Cyber Access After Criticizing Anthropic for Same Approach (https://go.theregister.com/feed/www.theregister.com/2026/05/01/openai_locks_gpt55cyber_behind_velvet/) - Social Engineering Evolves Beyond Traditional Phishing (https://www.huntress.com/blog/device-code-phishing-cyber-resilience-strategy) - 15-Year-Old Detained Over French Government Agency Data Breach (https://www.bleepingcomputer.com/news/security/15-year-old-detained-over-french-govt-agency-data-breach/) - Cisco Releases Open Source Model Provenance Kit (https://www.securityweek.com/cisco-releases-open-source-tool-for-ai-model-provenance/) - CVE-2026-4948: Firewalld D-Bus Authorization Bypass (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-4948) - CVE-2026-28532: FRRouting Integer Overflow in OSPF TLV Parser (https://msrc.microsoft.com/update-guide/vulnerability/CVE-202 ...