Skip to dossier
Archived issue · 05-15-2026
View latest issue
← fruition.net
verified 1w ago
The Perimeter · Issue 05-15-2026

Canvas extortion, PAN-OS zero-day exploited, and a Linux LPE shake the week

This week ran on three fires. Palo Alto's PAN-OS Captive Portal pre-auth RCE (CVE-2026-0300) hit CISA KEV with active exploitation, the Linux kernel 'Copy Fail' LPE (CVE-2026-31431) landed on KEV the same week, and ShinyHunters defaced Instructure's Canvas login with a 275M-record extortion claim that disrupted exams at universities and K-12 districts nationwide. The WordPress surface lit up too. Breeze Cache (400k installs) is under active exploitation for unauthenticated RCE, and Slider Revolution 7 patched an authenticated arbitrary file upload across an estimated 45k vulnerable sites. PHP shipped coordinated security releases across 8.2, 8.3, 8.4, and 8.5. On the supply-chain side, a malicious 'lightning' PyPI release shipped a Bun-based credential stealer echoing the Mini Shai-Hulud npm pattern from the day before. If you operate WordPress, Linux hosts, or any PAN-OS edge, recalculate this week around three things: emergency patching of those three CVEs, auditing whether your edtech or LMS dependencies pull from Instructure, and rotating any PyPI/npm credentials touched by CI in the last 10 days.
Published
Friday, May 15, 2026
Entries
12
Cadence
Weekly · Fridays
Curator
Brad Anderson
Wire
cisa.gov New addition to the Known Exploited Vulnerabilities catalog ·
github.com GHSA: critical npm package compromise affecting CI pipelines ·
wordfence.com WordPress plugin vulnerability with active exploitation ·
drupal.org Highly critical core security advisory published ·
aws.amazon.com AWS security bulletin: IAM policy evaluation update ·
unit42.paloaltonetworks.com Threat actor expands toolkit targeting public-facing PHP apps ·
krebsonsecurity.com Breach disclosure with named victim and confirmed initial vector ·
snyk.io Composer dependency advisory affecting production framework versions ·
cisa.gov New addition to the Known Exploited Vulnerabilities catalog ·
github.com GHSA: critical npm package compromise affecting CI pipelines ·
wordfence.com WordPress plugin vulnerability with active exploitation ·
drupal.org Highly critical core security advisory published ·
aws.amazon.com AWS security bulletin: IAM policy evaluation update ·
unit42.paloaltonetworks.com Threat actor expands toolkit targeting public-facing PHP apps ·
krebsonsecurity.com Breach disclosure with named victim and confirmed initial vector ·
snyk.io Composer dependency advisory affecting production framework versions ·
01

Web Application

frameworks · browsers · authentication flows

darkreading.com 1w

TrustFall: malicious repos trigger code execution in Claude Code, Cursor, Gemini, and Copilot CLIs

Researchers disclosed 'TrustFall', a class of conventions in agentic coding CLIs (Claude Code, Cursor CLI, Gemini CLI, GitHub Copilot CLI) where opening a malicious repository triggers code execution with minimal or no user interaction. The vendors' warning dialogs underdescribe what's being authorized. Reproducible technique published.

Claude Code Cursor CLI Gemini CLI GitHub Copilot CLI
Fruition take

Treat agentic CLIs the same as you'd treat 'npm install from a stranger': run them in a disposable container or VM, never against live cloud credentials. Update internal dev guidance before someone clones a customer repo on a laptop with prod AWS keys cached.

02

Supply Chain

packages · build systems · dependency attacks

github.com 1w CVSS 7.0

GitPython patch for CVE-2026-42215 bypassed via section-name newline injection

GitPython 3.1.49's fix for CVE-2026-42215 only validated newlines in the value parameter of set_value(). The section parameter remains unvalidated, so an attacker controlling section names can inject a forged [core] block with hooksPath pointing at attacker-controlled scripts, achieving RCE when any git hook fires. Affects current latest GitPython.

CVE-2026-42215 GitPython
Fruition take

Audit any internal tool that calls GitPython's config_writer with user- or repo-influenced section names. If you parse git config from untrusted repos in CI (security scanners, dependency tools), this is a near-direct RCE path.

unit42.paloaltonetworks.com 2w

Unit 42 maps post-Shai-Hulud npm threat landscape

Unit 42 updated its npm threat-landscape analysis covering wormable malware, CI/CD persistence techniques, and multi-stage attacks observed since the Shai-Hulud campaign. The piece catalogs how attackers chain compromised maintainer accounts with postinstall scripts and self-propagating payloads that target CI tokens.

npm registry
Fruition take

Disable npm install scripts in CI by default (npm config set ignore-scripts true) for any workload that doesn't strictly need them. Pin lockfiles, and treat any postinstall script in a transitive dependency as a finding worth review.

snyk.io 2w

Malicious 'lightning' release on PyPI ships Bun-based credential stealer

Snyk and Sonatype flagged a compromised release of the lightning PyPI package (related to PyTorch Lightning) that drops a Bun runtime to execute a credential-stealing payload on import. The pattern echoes the Mini Shai-Hulud npm campaign disclosed one day earlier. Affected developers should rotate any credentials accessible from build environments where the package was installed.

lightning (PyPI) PyTorch Lightning
Fruition take

If your ML or data pipelines pulled lightning between late April and May 1, rotate PyPI tokens, npm tokens, GitHub PATs, and any cloud credentials reachable from those runners. Audit CI for unexpected outbound traffic from Python install steps.

03

Infrastructure

kubernetes · cloud · network · ingress

unit42.paloaltonetworks.com 1w KEV
▲ headline

'Copy Fail' Linux kernel LPE (CVE-2026-31431) added to CISA KEV

Unit 42 published analysis of CVE-2026-31431, a Linux kernel privilege escalation in resource transfer between spheres that yields stealthy root. CISA added it to KEV on May 1. Cloudflare disclosed how it detected and mitigated the flaw across its fleet with no observed exploitation. The class of bug is broadly applicable across kernel versions in production today.

CVE-2026-31431 Linux kernel
Fruition take

Patch Kubernetes node images and bare hosts this week. If you run multi-tenant K8s, assume any container escape primitive a tenant can stage now ends in root on the node, and prioritize node patching over workload uptime SLAs.

04

PHP & CMS

wordpress · drupal · plugins · php frameworks

php.net 1w

PHP ships coordinated security releases across 8.2, 8.3, 8.4, and 8.5

The PHP project released 8.2.31, 8.3.31, 8.4.21, and 8.5.6 on May 7 as security releases. All users on supported branches are encouraged to upgrade. Specific CVE details are recorded in each branch ChangeLog rather than the announcement.

PHP 8.2 PHP 8.3 PHP 8.4 PHP 8.5
Fruition take

Rebuild your WordPress and Drupal container images this week. Most managed-WordPress fleets need a rolling restart on the PHP-FPM image; budget for it now rather than waiting for a CVE writeup to make it urgent.

wordfence.com 1w

Slider Revolution 7 patches authenticated arbitrary file upload to RCE

Wordfence reported an authenticated arbitrary file upload in Slider Revolution 7 reachable from subscriber-level accounts and above, leading to remote code execution. The bug was introduced in the 7.0 major release. Wordfence estimates 45,000 of the plugin's 5M+ active installs are running a vulnerable version.

Slider Revolution 7 (WordPress plugin)
Fruition take

Slider Revolution is bundled with countless commercial themes, so check theme-bundled copies in addition to plugin installs. On any site that accepts subscriber registration, patching this is a Friday-deadline item.

wordfence.com 1w

Breeze Cache unauth RCE under active exploitation across 400k WordPress sites

Wordfence disclosed a critical unauthenticated arbitrary file upload in Breeze Cache (about 400,000 active installs) on April 22, with the patch released April 21. Exploitation began the same day as disclosure. Wordfence has blocked over 30,000 exploit attempts. Attackers can upload PHP backdoors and achieve RCE without authentication.

Breeze Cache (WordPress plugin)
Fruition take

Audit composer.json and wp-content/plugins across your fleet for Breeze. If you can't confirm the patched version is deployed, assume RCE attempts have already touched the host and hunt for unfamiliar PHP files in uploads and cache directories.

05

Identity & Auth

oauth · saml · iam · session attacks

no entries this week

06

Threat Intel

active exploitation · breaches · ransomware

unit42.paloaltonetworks.com 1w KEV
▲ headline

PAN-OS Captive Portal pre-auth RCE exploited in the wild (CVE-2026-0300)

Unit 42 confirms in-the-wild exploitation of CVE-2026-0300, an out-of-bounds write in the PAN-OS User-ID Authentication Portal (Captive Portal) on PA-Series and VM-Series firewalls. Specially crafted packets give unauthenticated remote code execution as root. CISA added it to KEV on May 6. Workarounds: restrict Captive Portal access to trusted zones or disable it.

CVE-2026-0300 Palo Alto PAN-OS PA-Series firewalls VM-Series firewalls
Fruition take

If you front client environments with PAN-OS and Captive Portal is reachable, treat this as an evict-and-patch event, not a maintenance-window event. Disable Captive Portal where it isn't required and assume edge boxes are compromised until forensics says otherwise.

krebsonsecurity.com 1w

ShinyHunters defaces Canvas with 275M-record extortion demand

An ongoing extortion campaign against Instructure's Canvas LMS defaced the login page with a ransom demand naming 275 million students and faculty across roughly 9,000 institutions. Universities and K-12 districts rescheduled exams. Dark Reading reports this is ShinyHunters' second hit on Instructure. Initial access vector has not been publicly confirmed.

Instructure Canvas LMS
Fruition take

If you build or host portals that integrate with Canvas (LTI, SAML federation, Canvas API tokens), rotate any service credentials and review LTI tool secrets. Treat any Instructure-issued OAuth client as potentially compromised pending Instructure's confirmation.

nvd.nist.gov 1w KEV

BerriAI LiteLLM SQL injection added to CISA KEV (CVE-2026-42208)

CISA added CVE-2026-42208 to the KEV catalog. The flaw is a SQL injection in BerriAI LiteLLM proxy that lets an attacker read and potentially modify the proxy's database, exposing managed LLM credentials. LiteLLM is widely deployed as an OpenAI-compatible gateway in front of multiple model providers.

CVE-2026-42208 BerriAI LiteLLM
Fruition take

If you run LiteLLM as an internal gateway, patch and rotate every provider key the proxy holds (OpenAI, Anthropic, Bedrock, Azure). Database compromise here equals a full vendor key spill.

nvd.nist.gov 2w KEV

cPanel/WHM authentication bypass added to CISA KEV (CVE-2026-41940)

CISA added CVE-2026-41940 to KEV: a missing authentication for critical function in WebPros cPanel & WHM and WP2 (WordPress Squared) login flow that allows unauthenticated remote attackers to gain access to the control panel. cPanel is the dominant shared-hosting control panel and a high-value target for credential theft and mass-defacement campaigns.

CVE-2026-41940 cPanel & WHM WP2 (WordPress Squared)
Fruition take

If any client site lives on shared cPanel hosting, confirm with the host that the patch is applied. For sites you manage on cPanel, rotate WHM and reseller credentials and review login history for unfamiliar IPs.