<p><strong>TLDR:</strong> North Korea’s Famous Chollima group has been caught injecting blockchain-based C2 malware into a legitimate Packagist package, targeting PHP developers through fake job interview lures. Three Linux kernel privilege escalation bugs — Copy Fail, Dirty Frag, and Fragnesia — all exploiting page cache corruption via zero-copy paths, are now public with working exploits and at least one confirmed in-the-wild exploitation. PostgreSQL shipped an unusually large batch of 11 security fixes across all supported versions, with AI-assisted bug discovery suspected as the driver. On the AI security tooling front, multiple vendors are racing to instrument and sandbox AI coding agents at the syscall level.</p>
<hr>
<h2>Famous Chollima poisons Packagist package with blockchain C2 malware</h2>
<p>Socket Research identified a North Korean APT supply chain attack against PHP developers via a compromised dev branch of the legitimate roberts/leads Packagist package. Malicious JavaScript was injected into tailwind.js, using TRON, Aptos, and BNB Smart Chain as dead-drop C2 resolvers — the same infrastructure pattern seen in prior Contagious Interview campaigns that delivered DEV#POPPER RAT and BeaverTail. The attack relies on social engineering victims into installing a specific dev branch, typically through fake job interviews. Separately, Sysdig’s team dissected EtherRAT — a React2Shell implant attributed to DPRK’s Contagious Interview tooling — which uses Ethereum smart contracts across nine RPC endpoints for C2 resolution, deploys five independent Linux persistence mechanisms, and re-obfuscates itself on first contact with the C2 server. The blockchain C2 approach makes takedowns nearly impossible. Developers should inspect build config files before running unfamiliar projects and restrict CI secret scopes. <a href="https://app.daily.dev/feed-by-ids?id=zlOABwapJ&amp;id=OuthCsdva&amp;id=7AajFhLjh" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Three Linux kernel page cache LPE bugs go public, one confirmed exploited in the wild</h2>
<p>Copy Fail (CVE-2026-31431, CVSS 7.8), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and Fragnesia (CVE-2026-46300) all landed within two weeks and share a root cause: kernel subsystems performing in-place writes via zero-copy paths corrupt the page cache of read-only files like /usr/bin/su or /etc/passwd without touching on-disk data. Copy Fail has been confirmed exploited in the wild and added to CISA’s KEV catalog; working exploits exist for Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16. The public PoC for Copy Fail is roughly 700 bytes of Python chaining three syscalls with no race conditions. Fixes are in Linux 7.0, 6.19.12, and 6.18.22. If you can’t patch immediately, blacklist the algif_aead, esp4, esp6, and rxrpc kernel modules — though this will impact IPsec and AFS workloads. <a href="https://app.daily.dev/feed-by-ids?id=1fWOzvLKf&amp;id=Rk43GvLji&amp;id=z19sTrFsa&amp;id=UkGDKKnu0" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>PostgreSQL patches 11 CVEs in a single release, AI-assisted discovery suspected</h2>
<p>PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 dropped with an unusually high 11 security fixes — four to five times the typical count — with the highest CVSS base score at 8.8. Issues span integer wrap-around, SQL injection, buffer overflows, memory disclosure, and denial-of-service via uncontrolled recursion, many affecting all versions back to 14. PgBouncer 1.25.2 also patches 4 CVEs. A separate post flags CVE-2026-6637 (CVSS 8.8) in the 1990s-era refint contrib extension, which shipped a critical stack buffer overflow and SQL injection allowing unprivileged users to execute arbitrary code — and most teams can’t enumerate what extensions are actually installed in their production databases. The immediate fix is to apply the May 14 minor releases and drop the refint extension; the longer-term fix is treating PostgreSQL extensions as production supply-chain dependencies with clear ownership. <a href="https://app.daily.dev/feed-by-ids?id=bP6iJc6hY&amp;id=E8IhEuotC&amp;id=OI5c9eckR" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>AI coding agent runtime security becomes a product category</h2>
<p>Sysdig published syscall-level analysis of Claude Code, Gemini CLI, and Codex CLI using Falco and eBPF, identifying four detection patterns mapped to MITRE ATT&amp;CK/ATLAS: agent installation, unauthorized access to agent config directories containing API tokens, sensitive file reads triggered by manipulated agents, and safety control bypass via known unsafe CLI flags. Real incidents cited include SesameOp (LLM API used as C2) and a Cursor IDE MCP server attack. Separately, Sysdig launched Prempti, an open-source project that intercepts agent tool calls before execution and evaluates them against Falco YAML rules, returning Allow/Deny/Ask verdicts with no root or kernel modules required. The Elastic Security MCP App and Sysdig’s headless cloud security approach are pushing the same direction: embedding security context directly into the environments where agents already operate rather than forcing analysts into separate dashboards. <a href="https://app.daily.dev/feed-by-ids?id=RYlBfJMMy&amp;id=F4CwedfjY&amp;id=EW4aN5h98" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>CVE-2026-44587: CarrierWave SVG denylist silently broken by unescaped regex metacharacters:</strong> The content_type_denylist check in CarrierWave interpolates string entries directly into a regex without Regexp.quote, meaning a denylist entry like image/svg+xml becomes /image/svg+xml/ where + acts as a quantifier rather than a literal — applications relying on this to block SVG uploads and prevent stored XSS are silently unprotected; fix is available in versions ~&gt; 2.2.7 and &gt;= 3.1.3. <a href="https://app.daily.dev/posts/d2XrNCz2H" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CVE-2026-8053: MongoDB time-series RCE reachable by any readWrite user, CVSS 8.8:</strong> Any authenticated user with the standard readWrite role can trigger an out-of-bounds memory write in MongoDB’s time-series collection code — no time-series collections need to exist — potentially achieving arbitrary code execution as the mongod process; patches are available for Percona Server for MongoDB 7.0 now and 8.0 shortly, and operators on Kubernetes should update the image tag immediately rather than waiting for the next operator release. <a href="https://app.daily.dev/feed-by-ids?id=TwmjGJAJK&amp;id=TwmjGJAJK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CVE-2026-27771: Gitea container registry exposed private images to unauthenticated attackers for ~4 years:</strong> All Gitea versions prior to 1.26.2 and the Forgejo fork allowed any unauthenticated attacker to pull private container images via standard Docker/OCI API requests, with an estimated 31,750 internet-facing instances affected across 30+ countries; upgrade to v1.26.2 immediately or set REQUIRE_SIGNIN_VIEW=true as a temporary workaround. <a href="https://app.daily.dev/posts/lVtFGvwZs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Kubernetes 1.36 deprecates service.spec.externalIPs, a long-standing MitM attack vector:</strong> Kubernetes 1.36 ships 60 enhancements including the deprecation of service.spec.externalIPs (a known man-in-the-middle vector), stable user namespace support in pods, mutating admission policies via CEL, and external signing of service account tokens — operators upgrading should audit externalIPs usage and review DRA RBAC permissions before the upgrade. <a href="https://app.daily.dev/posts/n0Ye7Fj8Z" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>LiteLLM SQL injection (CVE-2026-42208) exploited 36 hours after advisory, targeting API key tables:</strong> A pre-authentication SQL injection in LiteLLM versions 1.81.16–1.83.6 was actively exploited just 36 hours after its GitHub advisory was published, with attackers using precise Prisma-generated table names to enumerate virtual API keys, stored provider credentials, and environment variables — fixed in v1.83.7, and any internet-exposed instance during the vulnerability window should be treated as compromised with all credentials rotated. <a href="https://app.daily.dev/posts/rKXqs4p44" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


CVE disclosures, supply-chain attacks, security incidents, and developer-facing security tooling.

Security Digest

A security-focused roundup covering four major threat areas. North Korea's Famous Chollima APT poisoned a Packagist package targeting PHP developers via fake job interviews, using blockchain networks (TRON, Aptos, BNB) as C2 infrastructure to evade takedowns. Three Linux kernel privilege escalation vulnerabilities (Copy Fail, Dirty Frag, Fragnesia) exploiting page cache corruption via zero-copy paths are now public with working exploits; Copy Fail is confirmed exploited in the wild and in CISA's KEV catalog. PostgreSQL shipped an unusually large batch of 11 CVEs across all supported versions, with AI-assisted bug discovery suspected. On the tooling front, Sysdig published syscall-level analysis of AI coding agents and launched Prempti, an open-source project for intercepting and evaluating agent tool calls against security rules. Notable items also include a MongoDB time-series RCE, a Gitea container registry auth bypass affecting ~31,750 instances, a Kubernetes 1.36 MitM deprecation, and an actively exploited LiteLLM SQL injection.

Famous Chollima targets PHP devs via Packagist, Linux page cache bugs hit production