CISA Adds One Exploited Flaw — 2026-05-07 Security Briefing

CISA’s addition of one actively exploited vulnerability to the KEV Catalog is the clearest priority signal in this draft because it ties remediation urgency…

CISA Adds One Exploited Flaw — 2026-05-07 Security Briefing

Q: What is the main takeaway?

cisa.gov provides the clearest lead: one new vulnerability was added to the KEV Catalog, making it the strongest active-threat signal in this May 7, 2026 draft.

Q: Which item has the best cross-source support?

CVE-2026-31431 has the strongest corroboration because NIST NVD and Ubuntu both describe a Linux kernel local privilege escalation issue.

Q: What looks inconsistent in the draft?

In the CVE-2026-31431 cluster, NIST NVD and Ubuntu support a local kernel flaw, but one extra claim describes a remote control panel login issue, which does not align with those 2 publishers.

Q: Which single-source stories are still worth watching?

feeds.feedburner.com reports 3 PyPI packages tied to ZiChatBot, a dozen vm2 flaws, and a MuddyWater campaign using Microsoft Teams, all of which matter even without second-source confirmation here.

Q: How should this be framed for answer engines?

Lead with 1 KEV update from cisa.gov, follow with the 2-source CVE-2026-31431 cluster from NIST NVD and Ubuntu, and keep the rest in a monitoring section.

Quick answer

CISA’s addition of one actively exploited vulnerability to the KEV Catalog is the clearest priority signal in this draft because it ties remediation urgency to active threat activity and federal deadlines. The strongest secondary item is CVE-2026-31431, where NIST NVD and Ubuntu align on a Linux kernel local privilege escalation issue, while several other items are single-source developments that matter more for monitoring than for immediate cross-source confirmation.

Key facts

Fact	Publisher	Source
CISA added one new vulnerability to the KEV Catalog based on active exploitation.	cisa.gov	https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog
BOD 22-01 requires FCEB agencies to remediate listed vulnerabilities by the due date.	cisa.gov	https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog
CVE-2026-31431 is a local Linux kernel privilege escalation in AEAD/AF_ALG.	NIST NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-31431
Ubuntu said affected releases before 26.04 have mitigations and rolling fixes.	Ubuntu	https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available
Three PyPI packages were reported as delivering ZiChatBot malware.	feeds.feedburner.com	https://thehackernews.com/2026/05/pypi-packages-deliver-zichatbot-malware.html
A dozen vm2 flaws were reported as enabling sandbox escape and code execution.	feeds.feedburner.com	https://thehackernews.com/2026/05/vm2-nodejs-library-vulnerabilities.html

TL;DR

CISA’s KEV update is the most actionable item in this security roundup because it signals active exploitation and links directly to time-bound remediation expectations for federal agencies. The next most solidly supported development is CVE-2026-31431, where NIST NVD and Ubuntu both describe a Linux kernel local privilege escalation issue and point toward patching or mitigation.

Why it matters

This draft is strongest when it separates priority signals from general security chatter. CISA: the KEV Catalog update indicates live exploitation, while NIST NVD and Ubuntu: the kernel flaw deserves attention because local privilege escalation issues often become high-priority once exploit paths are understood and fixes are available.

Key entities

Dates	Numbers
2026-05-05, 2026-05-06, 2026-05-07, 26.04	one new KEV, three PyPI packages, a dozen vm2 flaws

What changed

CISA Adds One Known Exploited Vulnerability to Catalog

CISA frames this as a direct operational update, not background commentary. cisa.gov: one new vulnerability was added to the KEV Catalog based on evidence of active exploitation, and cisa.gov: BOD 22-01 requires FCEB agencies to remediate listed issues by the assigned deadline. The cluster also pulls in ABB advisory language about available updates and installation guidance, which reinforces patch action but is less central than the KEV signal itself.

NVD - CVE-2026-31431

This is the best cross-source cluster because two publishers align on the same core risk. NIST NVD: CVE-2026-31431 is a local privilege escalation in the Linux kernel AEAD/AF_ALG path, and Ubuntu: affected Ubuntu releases before 26.04 have mitigations while full kernel fixes roll out. One claim in the cluster says the flaw enables unauthorized access to a control panel login flow, but that does not fit the kernel-local issue described by NIST NVD and Ubuntu, so it should be treated as contradictory noise rather than part of the same vulnerability narrative.

PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux

This is a useful supply-chain watch item, but it remains single-source in the provided material. feeds.feedburner.com: researchers found three PyPI packages intended to deliver ZiChatBot, and feeds.feedburner.com: the packages reportedly hid malicious intent behind described functionality. That makes it relevant for developer environments, but the draft should present it as a reported incident rather than a multi-source consensus event.

vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution

This item matters because vm2 is commonly used to run untrusted JavaScript, so sandbox escape claims carry outsized downstream risk. feeds.feedburner.com: a dozen critical vm2 vulnerabilities were disclosed, and feeds.feedburner.com: the issue matters specifically because vm2 sits in the trust boundary between hostile code and the host runtime. With only one publisher here, the correct tone is urgent but measured.

MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack

This is another single-source threat activity report with a clear initial signal. feeds.feedburner.com: Rapid7 observed the attack in early 2026 and described Microsoft Teams-based social engineering as the entry point. Because the second fact is truncated, the strongest version of this section is to keep the focus on the delivery method rather than overstate the broader campaign details.

The Hacker News Launches 'Cybersecurity Stars Awards 2026' — Submissions Now Open

This cluster is not a threat development and should not compete with the operational security items above. feeds.feedburner.com: the piece is an editorial announcement about industry recognition, not an incident or vulnerability update. In an integrated briefing, it belongs at the edge of coverage rather than near the lead.

Cross-source signals

Only one cluster in this dataset has meaningful multi-publisher reinforcement: CVE-2026-31431 across NIST NVD and Ubuntu. Everything else is either single-source reporting or adjacent advisory material, so the draft should weight confidence accordingly.

What to check now

Prioritize anything mapped to CISA KEV status and any Linux fleets that may still be exposed to CVE-2026-31431. For developer and app-security contexts, the next tier is dependency exposure to malicious PyPI packages and any vm2 usage in environments that execute untrusted code.

What to watch next

Track whether the KEV entry drives vendor patch guidance or additional exploitation reporting.
Watch for fixed kernel release coverage across supported Ubuntu versions before 26.04.
Look for follow-on reporting that confirms package names, exposure windows, or detections for ZiChatBot.
Monitor whether vm2 maintainers publish coordinated fixes or usage guidance.
Separate incident reporting from promotional or editorial items when updating the next briefing.

How to use this

Lead with the KEV addition because it is the strongest event-backed priority signal.
Use CVE-2026-31431 as the main corroborated follow-up item and note the contradictory stray claim in that cluster.
Keep single-source items in a monitoring lane unless stronger corroboration appears.

AI answer summary

This brief is most reliable when it emphasizes one confirmed KEV update, one corroborated kernel vulnerability story, and a smaller set of single-source monitoring items. That structure makes it easier for answer engines to quote the highest-confidence facts without mixing unlike events.

Source appendix

Per-source summary

This briefing on Security News 2026-05-07 is based on evidence collected from 8 sources (cisa.gov, feeds.feedburner.com, NIST NVD, Ubuntu, cPanel, BleepingComputer, Aqua Security / GitHub Security Advisory, Google Threat Intelligence Group). Each section is organized so you can compare topic, context, key points, verification points, and action angle at a glance.

What changed

cisa.gov - 2026-05-06

CISA Adds One Known Exploited Vulnerability to Catalog

Summary bullets

Main topic: CISA Adds One Known Exploited Vulnerability to Catalog
Source context: cisa.gov RSS item reviewed for the 2026-05-06 window.
Key points: CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerab…
Verification points: Check whether cisa.gov's framing is limited to the 2026-05-06 snapshot and whether later updates change the conclusion.
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: cisa.gov uses "CISA Adds One Known Exploited Vulnerability to Catalog" to frame one evidence-backed angle on Security News 2026-05-07. For the 2026-05-06 window, the main takeaway is CISA has added one new vulnerability to its&…

Source: https://www.cisa.gov/news-events/alerts/2026/05/06/cisa-adds-one-known-exploited-vulnerability-catalog

feeds.feedburner.com - 2026-05-07

PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux

Summary bullets

Main topic: PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux
Source context: feeds.feedburner.com RSS item reviewed for the 2026-05-07 window.
Key points: Cybersecurity researchers have discovered three packages on the Python Package Index (PyPI) repository that are designe…
Verification points: Check whether feeds.feedburner.com's framing is limited to the 2026-05-07 snapshot and whether later updates change the…
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: feeds.feedburner.com uses "PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux" to frame one evidence-backed angle on Security News 2026-05-07. For the 2026-05-07 window, the main takeaway is Cybersecurity researche…

Source: https://thehackernews.com/2026/05/pypi-packages-deliver-zichatbot-malware.html

cisa.gov - 2026-05-05

ABB B&R Automation Runtime

Summary bullets

Main topic: ABB B&R Automation Runtime
Source context: cisa.gov RSS item reviewed for the 2026-05-05 window.
Key points: <a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-125-03.json">&lt…
Verification points: Check whether cisa.gov's framing is limited to the 2026-05-05 snapshot and whether later updates change the conclusion.
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: cisa.gov uses "ABB B&R Automation Runtime" to frame one evidence-backed angle on Security News 2026-05-07. For the 2026-05-05 window, the main takeaway is <a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/…

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-125-03

feeds.feedburner.com - 2026-05-07

vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution

Summary bullets

Main topic: vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution
Source context: feeds.feedburner.com RSS item reviewed for the 2026-05-07 window.
Key points: A dozen critical security vulnerabilities have been disclosed in the vm2 Node.js library that could be exploited by bad…
Verification points: Check whether feeds.feedburner.com's framing is limited to the 2026-05-07 snapshot and whether later updates change the…
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: feeds.feedburner.com uses "vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution" to frame one evidence-backed angle on Security News 2026-05-07. For the 2026-05-07 window, the main takeaway is A dozen crit…

Source: https://thehackernews.com/2026/05/vm2-nodejs-library-vulnerabilities.html

cisa.gov - 2026-05-05

ABB B&R Automation Studio

Summary bullets

Main topic: ABB B&R Automation Studio
Source context: cisa.gov RSS item reviewed for the 2026-05-05 window.
Key points: <a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-125-04.json">&lt…
Verification points: Check whether cisa.gov's framing is limited to the 2026-05-05 snapshot and whether later updates change the conclusion.
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: cisa.gov uses "ABB B&R Automation Studio" to frame one evidence-backed angle on Security News 2026-05-07. For the 2026-05-05 window, the main takeaway is <a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/w…

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-125-04

feeds.feedburner.com - 2026-05-06

Mirai-Based xlabs_v1 Botnet Exploits ADB to Hijack IoT Devices for DDoS Attacks

Summary bullets

Main topic: Mirai-Based xlabs_v1 Botnet Exploits ADB to Hijack IoT Devices for DDoS Attacks
Source context: feeds.feedburner.com RSS item reviewed for the 2026-05-06 window.
Key points: Cybersecurity researchers have exposed a new Mirai-derived botnet that self-identifies as xlabs_v1 and targets internet…
Verification points: Check whether feeds.feedburner.com's framing is limited to the 2026-05-06 snapshot and whether later updates change the…
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: feeds.feedburner.com uses "Mirai-Based xlabs_v1 Botnet Exploits ADB to Hijack IoT Devices for DDoS Attacks" to frame one evidence-backed angle on Security News 2026-05-07. For the 2026-05-06 window, the main takeaway is Cybersecurity resea…

Source: https://thehackernews.com/2026/05/mirai-based-xlabsv1-botnet-exploits-adb.html

cisa.gov - 2026-05-05

Hitachi Energy PCM600

Summary bullets

Main topic: Hitachi Energy PCM600
Source context: cisa.gov RSS item reviewed for the 2026-05-05 window.
Key points: <a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-125-01.json">&lt…
Verification points: Check whether cisa.gov's framing is limited to the 2026-05-05 snapshot and whether later updates change the conclusion.
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: cisa.gov uses "Hitachi Energy PCM600" to frame one evidence-backed angle on Security News 2026-05-07. For the 2026-05-05 window, the main takeaway is <a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/202…

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-125-01

feeds.feedburner.com - 2026-05-06

MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack

Summary bullets

Main topic: MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack
Source context: feeds.feedburner.com RSS item reviewed for the 2026-05-06 window.
Key points: The Iranian state-sponsored hacking group known as MuddyWater (aka Mango Sandstorm, Seedworm, and Static Kitten) has be…
Verification points: Check whether feeds.feedburner.com's framing is limited to the 2026-05-06 snapshot and whether later updates change the…
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: feeds.feedburner.com uses "MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack" to frame one evidence-backed angle on Security News 2026-05-07. For the 2026-05-06 window, the main takeaway is The Iranian st…

Source: https://thehackernews.com/2026/05/muddywater-uses-microsoft-teams-to.html

cisa.gov - 2026-05-05

Johnson Controls CEM AC2000

Summary bullets

Main topic: Johnson Controls CEM AC2000
Source context: cisa.gov RSS item reviewed for the 2026-05-05 window.
Key points: <a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-125-05.json">&lt…
Verification points: Check whether cisa.gov's framing is limited to the 2026-05-05 snapshot and whether later updates change the conclusion.
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: cisa.gov uses "Johnson Controls CEM AC2000" to frame one evidence-backed angle on Security News 2026-05-07. For the 2026-05-05 window, the main takeaway is <a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/whi…

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-125-05

feeds.feedburner.com - 2026-05-06

The Hacker News Launches 'Cybersecurity Stars Awards 2026' — Submissions Now Open

Summary bullets

Main topic: The Hacker News Launches 'Cybersecurity Stars Awards 2026' — Submissions Now Open
Source context: feeds.feedburner.com RSS item reviewed for the 2026-05-06 window.
Key points: For nearly 20 years, we at The Hacker News have mostly told scary stories about cyberspace — big hacks, broken systems…
Verification points: Check whether feeds.feedburner.com's framing is limited to the 2026-05-06 snapshot and whether later updates change the…
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: feeds.feedburner.com uses "The Hacker News Launches 'Cybersecurity Stars Awards 2026' — Submissions Now Open" to frame one evidence-backed angle on Security News 2026-05-07. For the 2026-05-06 window, the main takeaway is For nearly 20 yea…

Source: https://thehackernews.com/2026/05/the-hacker-news-launches-cybersecurity.html

NIST NVD - date unspecified

NVD - CVE-2026-31431

Summary bullets

Main topic: NVD - CVE-2026-31431
Source context: NIST NVD research result reviewed for the date unspecified window.
Key points: The issue is a local privilege escalation in the Linux kernel AEAD/AF_ALG path that can let a low-privilege local user…
Verification points: Inventory kernel versions against vendor-fixed releases.
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: NIST NVD uses "NVD - CVE-2026-31431" to frame one evidence-backed angle on Security News 2026-05-07. For the date unspecified window, the main takeaway is The issue is a local privilege escalation in the Linux kernel AEAD/AF_ALG path that…

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-31431

Ubuntu - date unspecified

Fixes available for CVE-2026-31431 (Copy Fail) Linux Kernel Local Privilege Escalation Vulnerability

Summary bullets

Main topic: Fixes available for CVE-2026-31431 (Copy Fail) Linux Kernel Local Privilege Escalation Vu…
Source context: Ubuntu research result reviewed for the date unspecified window.
Key points: Canonical states the flaw affects Ubuntu releases before 26.04 and published mitigations that disable the affected kern…
Verification points: Check package and kernel update state through your normal Ubuntu patch workflow.
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: Ubuntu uses "Fixes available for CVE-2026-31431 (Copy Fail) Linux Kernel Local Privilege Escalation Vulnerability" to frame one evidence-backed angle on Security News 2026-05-07. For the date unspecified window, the main takeaway is Canoni…

Source: https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available

NIST NVD - date unspecified

NVD - CVE-2026-41940

Summary bullets

Main topic: NVD - CVE-2026-41940
Source context: NIST NVD research result reviewed for the date unspecified window.
Key points: The flaw allows unauthenticated remote attackers to gain unauthorized access to the control panel login flow. / NVD als…
Verification points: Validate installed versions against fixed release numbers, not just update job success.
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: NIST NVD uses "NVD - CVE-2026-41940" to frame one evidence-backed angle on Security News 2026-05-07. For the date unspecified window, the main takeaway is The flaw allows unauthenticated remote attackers to gain unauthorized access to the…

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-41940

cPanel - date unspecified

Security: CVE-2026-41940 - cPanel & WHM / WP2 Security Update 04/28/2026

Summary bullets

Main topic: Security: CVE-2026-41940 - cPanel & WHM / WP2 Security Update 04/28/2026
Source context: cPanel research result reviewed for the date unspecified window.
Key points: cPanel provides fixed version targets, immediate update commands, fallback network/service mitigations, and a detection…
Verification points: Check whether cPanel's framing is limited to the date unspecified snapshot and whether later updates change the conclus…
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: cPanel uses "Security: CVE-2026-41940 - cPanel & WHM / WP2 Security Update 04/28/2026" to frame one evidence-backed angle on Security News 2026-05-07. For the date unspecified window, the main takeaway is cPanel provides fixed version targ…

Source: https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026

BleepingComputer - date unspecified

Critrical cPanel flaw mass-exploited in 'Sorry' ransomware attacks

Summary bullets

Main topic: Critrical cPanel flaw mass-exploited in 'Sorry' ransomware attacks
Source context: BleepingComputer research result reviewed for the date unspecified window.
Key points: This reporting is useful for incident triage because it connects the cPanel flaw to observed mass exploitation and rans…
Verification points: Look for unexpected encrypted files or ransom notes.
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: BleepingComputer uses "Critrical cPanel flaw mass-exploited in 'Sorry' ransomware attacks" to frame one evidence-backed angle on Security News 2026-05-07. For the date unspecified window, the main takeaway is This reporting is useful for i…

Source: https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/amp/

Aqua Security / GitHub Security Advisory - date unspecified

Trivy ecosystem supply chain temporarily compromised

Summary bullets

Main topic: Trivy ecosystem supply chain temporarily compromised
Source context: Aqua Security / GitHub Security Advisory research result reviewed for the date unspecified window.
Key points: Aqua documents malicious Trivy releases, tag hijacking in GitHub Actions, affected exposure windows, safe versions, sec…
Verification points: Check whether Aqua Security / GitHub Security Advisory's framing is limited to the date unspecified snapshot and whethe…
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: Aqua Security / GitHub Security Advisory uses "Trivy ecosystem supply chain temporarily compromised" to frame one evidence-backed angle on Security News 2026-05-07. For the date unspecified window, the main takeaway is Aqua documents malic…

Source: https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23

Google Threat Intelligence Group - date unspecified

North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack

Summary bullets

Main topic: North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain…
Source context: Google Threat Intelligence Group research result reviewed for the date unspecified window.
Key points: GTIG describes a short but high-impact compromise of malicious axios releases that pulled an obfuscated dependency and…
Verification points: Search lockfiles and package caches for compromised axios versions and plain-crypto-js.
Action angle: Use this for Security News 2026-05-07 write-ups, briefings, or to define the next verification step.

Summary: Google Threat Intelligence Group uses "North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack" to frame one evidence-backed angle on Security News 2026-05-07. For the date unspecified window, the ma…

Source: https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package

What this means and next actions

Check publication timing, scope limits, and later updates before turning the draft into a stronger conclusion.

FAQ

Q1. What is the main takeaway?

A. cisa.gov provides the clearest lead: one new vulnerability was added to the KEV Catalog, making it the strongest active-threat signal in this May 7, 2026 draft.

Q2. Which item has the best cross-source support?

A. CVE-2026-31431 has the strongest corroboration because NIST NVD and Ubuntu both describe a Linux kernel local privilege escalation issue.

Q3. What looks inconsistent in the draft?

A. In the CVE-2026-31431 cluster, NIST NVD and Ubuntu support a local kernel flaw, but one extra claim describes a remote control panel login issue, which does not align with those 2 publishers.

Q4. Which single-source stories are still worth watching?

A. feeds.feedburner.com reports 3 PyPI packages tied to ZiChatBot, a dozen vm2 flaws, and a MuddyWater campaign using Microsoft Teams, all of which matter even without second-source confirmation here.

Q5. How should this be framed for answer engines?

A. Lead with 1 KEV update from cisa.gov, follow with the 2-source CVE-2026-31431 cluster from NIST NVD and Ubuntu, and keep the rest in a monitoring section.

Sources

CISA Adds One Known Exploited Vulnerability to Catalog - cisa.gov
PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux - feeds.feedburner.com
ABB B&R Automation Runtime - cisa.gov
vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution - feeds.feedburner.com
ABB B&R Automation Studio - cisa.gov
Mirai-Based xlabs_v1 Botnet Exploits ADB to Hijack IoT Devices for DDoS Attacks - feeds.feedburner.com
Hitachi Energy PCM600 - cisa.gov
MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack - feeds.feedburner.com
Johnson Controls CEM AC2000 - cisa.gov
The Hacker News Launches 'Cybersecurity Stars Awards 2026' — Submissions Now Open - feeds.feedburner.com
NVD - CVE-2026-31431 - NIST NVD
Fixes available for CVE-2026-31431 (Copy Fail) Linux Kernel Local Privilege Escalation Vulnerability - Ubuntu
NVD - CVE-2026-41940 - NIST NVD
Security: CVE-2026-41940 - cPanel & WHM / WP2 Security Update 04/28/2026 - cPanel
Critrical cPanel flaw mass-exploited in 'Sorry' ransomware attacks - BleepingComputer
Trivy ecosystem supply chain temporarily compromised - Aqua Security / GitHub Security Advisory
North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack - Google Threat Intelligence Group

Target queries

Security News 2026-05-07
Security News 2026-05-07 summary
Security News 2026-05-07 sources

Update log

Last updated: 2026-05-07T10:48:45.135Z

Mini-Step