<p><strong>TLDR:</strong> CVE-2026-46242, a use-after-free in the Linux epoll subsystem, has a public exploit achieving root access 99% of the time on kernels 6.4 and later, including Android devices running 6.6-series kernels. CISA added a SharePoint deserialization RCE to its KEV catalog with a federal patch deadline of Saturday, and over 10,000 servers remain exposed. The FortiBleed credential theft campaign is now confirmed to be far larger than initially reported, with ties to Lynx ransomware and over 430,000 FortiGate firewalls targeted. A joint FBI and Google operation took down the NetNut residential proxy botnet, cutting off 2 million compromised Android devices used to launder malicious traffic.</p>
<hr>
<h2>CVE-2026-46242 Bad Epoll: reliable local privilege escalation on Linux 6.4+ and Android</h2>
<p>The exploit chains a use-after-free write in the epoll subsystem into full kernel memory control via cross-cache attack, arbitrary read through /proc/self/fdinfo, and a ROP chain for a root shell. The race window is only about 6 instructions wide, but a retry loop widens it enough to hit 99% reliability. Kernels 6.4 through the fix date are affected; 6.1-based kernels are not. An Android exploit targeting Pixel 10 (kernel 6.6+) is in progress. The only fix is upstream commit a6dc643c6931 — there is no workaround since epoll is a core kernel feature. Distributions, cloud providers running shared hosts, and Android device vendors should treat this as urgent. <a href="https://daily.dev/feed-by-ids?id=8ik6UsR3n&amp;id=NFJaE30JD" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>CISA adds SharePoint RCE CVE-2026-45659 to KEV, federal patch deadline Saturday</h2>
<p>The flaw is a deserialization of untrusted data bug that lets any authenticated attacker with Site Member permissions execute arbitrary code remotely, no user interaction required. Microsoft patched SharePoint Enterprise Server 2016, 2019, and Subscription Edition on May 21. Over 10,000 servers remain exposed online, and this is the 11th SharePoint vulnerability CISA has flagged since 2021, with seven linked to ransomware. Federal agencies are under Binding Operational Directive 26-04 with a Saturday deadline. <a href="https://daily.dev/posts/5qwo6lfyk" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>FortiBleed campaign tied to Lynx ransomware, scope expands to 430,000 FortiGate firewalls</h2>
<p>SOCRadar linked the FortiBleed credential theft operation to INC and Lynx ransomware-as-a-service by identifying a Windows server in the FortiBleed infrastructure that had accessed negotiation panels for both groups. The operation is now understood to have targeted over 430,000 FortiGate firewalls, deployed traffic sniffers on roughly 19,000 devices, and involved around 20 members with defined roles. Attackers also allegedly exploited a Nextcloud zero-day and planted persistent backdoor accounts using the username ‘adminin’. A full technical white paper with indicators of compromise is forthcoming from SOCRadar. <a href="https://daily.dev/posts/d4l4Igj1S" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>NetNut residential proxy botnet dismantled, 2 million Android devices cut off</h2>
<p>A joint operation by Google, the FBI, Lumen Technologies, and Shadowserver disrupted NetNut, one of the largest residential proxy botnets, which ran on at least 2 million compromised Android devices including smart TVs and streaming boxes infected via trojanized apps and pre-installed malware. In a single week, 316 distinct threat clusters were observed routing traffic through its exit nodes. Google disabled the C2 infrastructure and pushed warnings via Play Protect; the FBI seized the <a href="http://netnut.com" target="_blank" rel="noopener nofollow">netnut.com</a> domain. Because NetNut ran a reseller program powering many downstream proxy services, the disruption is expected to ripple broadly across the residential proxy ecosystem. <a href="https://daily.dev/posts/yWIBtnJA8" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Cisco confirms active exploitation of Unified CM SSRF CVE-2026-20230:</strong> The flaw allows unauthenticated remote attackers to send file:// payloads to write files on targeted devices; Cisco urges upgrade to Unified CM 14SU6 or 15SU5, and Shadowserver is tracking over 200 exposed instances online, primarily in Asia and North America. <a href="https://daily.dev/posts/RiSP0fMwT" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ARToken PhaaS exposes EvilTokens Microsoft 365 toolkit with 37-fold surge in device code phishing:</strong> Cisco Talos reverse-engineered the React-based panel to expose over 80 API endpoints covering token theft, PRT persistence, and automated BEC workflows sold for a $1,500 setup fee plus $500/month — device code phishing attacks have surged 37-fold over the past year. <a href="https://daily.dev/posts/ZGvr5nZAC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Scattered Spider member Peter Stokes, 19, extradited to US after Finland arrest:</strong> Stokes faces charges of fraud, conspiracy, and computer intrusion tied to at least four breaches including a May 2025 attack on a luxury retailer where the group demanded an $8 million ransom; Scattered Spider has been linked to over 100 intrusions and more than $100 million in ransom payments since 2022. <a href="https://daily.dev/posts/IZA9zRLpm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Attested TLS formally verified as broken, affecting WhatsApp Private Processing and CVE-2026-33697:</strong> TU Dresden researchers used ProVerif to show all seven examined intra-handshake attestation binding mechanisms fail to prevent relay attacks, with CVE-2026-33697 (CVSS 7.5) affecting production systems including Meta’s WhatsApp Private Processing and Edgeless Systems’ Contrast — level-three binding that would protect actual application traffic may be architecturally impossible. <a href="https://daily.dev/posts/kI6PoNzPx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>npm and Go packages hijacked to deploy infostealer via VS Code tasks:</strong> This week’s package management roundup flags an active campaign hijacking npm and Go packages to deliver an infostealer through VS Code tasks, alongside Composer path traversal and credential leakage CVEs and a <a href="http://python.org" target="_blank" rel="noopener nofollow">python.org</a> API authentication bypass. <a href="https://daily.dev/posts/m4ec89Xlo" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


CVE disclosures, supply-chain attacks, security incidents, and developer-facing security tooling.

Security Digest

CVE-2026-46242, a use-after-free in the Linux epoll subsystem, has a public exploit achieving root access 99% of the time on kernels 6.4 and later, including Android devices running 6.6-series kernels. CISA added a SharePoint deserialization RCE to its KEV catalog with a federal patch deadline of Saturday, and over 10,000 servers remain exposed. The FortiBleed credential theft campaign is now confirmed to be far larger than initially reported, with ties to Lynx ransomware and over 430,000 FortiGate firewalls targeted. A joint FBI and Google operation took down the NetNut residential proxy botnet, cutting off 2 million compromised Android devices used to launder malicious traffic.

Bad Epoll hits 99% reliability, SharePoint RCE under active exploitation