May reshaped the cybersecurity landscape with active exploitation of ten celebrity vulnerabilities and ten zero‑days.
The standout threat, CVE‑2026‑31431 “Copy Fail”, is a critical Linux kernel privilege‑escalation flaw in the algif_aead crypto module. It allows an unprivileged user to gain root via a 732‑byte Python exploit, affecting virtually every major Linux distribution shipped since 2017.
Meanwhile, CVE‑2026‑0300 PAN‑OS Zero‑Day, a likely state‑sponsored cluster tracked as CL‑STA‑1132, exploited an unauthenticated buffer overflow in the User‑ID Authentication Portal since April 9. Attackers gained root on internet‑exposed firewalls, injected shellcode into nginx, deployed EarthWorm and ReverseSocks5 tunnels, enumerated Active Directory, and systematically destroyed forensic evidence.
Financially motivated threat groups also grew more aggressive. TeamPCP intensified its supply chain attacks throughout May 2026, allegedly exfiltrating nearly 3,800 internal GitHub repositories via a poisoned VS Code extension. The group later open‑sourced the worm with a $1,000 underground bounty, fueling rapid copycat campaigns.
On the nation‑state front, China‑linked APT FamousSparrow ran a three‑wave intrusion against an Azerbaijani oil and gas firm (Dec 2025 – Feb 2026). They repeatedly re‑exploited an unpatched Exchange Server via ProxyNotShell to deploy Deed RAT and Terndoor backdoors. The threat curve continues upward, making prioritized defensive adaptation a mandatory baseline in today’s operational environment.
.svg)