SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Checkmarx Jenkins AST Plugin Compromised
On May 9, 2026, software security company Checkmarx posted a security update warning that a "modified" version of its Jenkins Application Security Testing (AST) Scanner plugin had been published in the Jenkins Marketplace; Jenkins is an automation platform used for continuous integration and continuous delivery (CI/CD). This is the latest in a series of Checkmarx supply chain compromises ongoing since March, affecting the company's GitHub Actions and OpenVSX extensions, believed to be follow-on attacks from Trivy's supply chain breaches beginning in late February. The threat actors defaced the GitHub repository for the Checkmarx Jenkins AST Scanner plugin, and according to SOCRadar, "backdoored the plugin itself [...] Any Jenkins instance that pulled this version during the exposure window would have installed a compromised plugin." The unauthorized plugin is version 2026.5.09, and Checkmarx urges users to roll back to version 2.0.13-829.vc72453fa_1c16 (published December 17, 2025) or earlier. SOCRadar also recommends rotating all secrets accessible from affected Jenkins runners, searching for indicators of compromise (IoCs) including artifacts mentioned in the Checkmarx advisory as well as "Dune-themed" repository names, reviewing Jenkins build logs, and pinning plugins to known safe versions. Checkmarx has not described the exact nature of the modified plugin nor verified threat actor attribution.
Editor's Notes
- Slide 1 of 2
If you're using the Checkmarx Jenkins AST plugin, check the versioning carefully. This appears to be another TeamPCP attack, so you need to check your GitHub repos for any Dune and tpcp themed repository names, rotate tokens and secrets, and check for IoCs. When you're past that, review permissions for your Jenkins environment, applying the principle of least privilege, examine using short lived credentials in your CI pipeline (instead of long-lived static keys), and monitor for anomalous outbound traffic from your build environment, particularly Cloudflare Tunnels ([.]trycloudflare[.]com)
- Slide 2 of 2
We need to hold software suppliers liable for consequential damages when they ship malicious, as opposed to simply shoddy, code. While I think that our tolerance for malicious code should be much lower than that for shoddy, I still fail to understand our high tolerance for code that is not fit for market.
Slide 1 of 0- Slide 1 of 2
Mitigate Another Linux Kernel Privilege Escalation
A researcher has publicly disclosed the second privilege escalation exploit for the Linux kernel in two weeks. Dubbed "Dirty Frag" and compared to the recent "Copy Fail," the exploit is deterministic and involves chaining two page cache write vulnerabilities, one "write-what-where condition" involving the esp/xfrm component (CVE-2026-43284, CVSS 8.8), and one "out-of-bounds write" involving the rxrpc component (CVE-2026-43500, CVSS 7.8). Together these allow an attacker to elevate privileges to root by making unauthorized changes to protected system files. Microsoft notes that "Dirty Frag may be leveraged after initial compromise through SSH access, web-shell execution, container escape, or compromise of a low-privileged account. [...] Affected environments may include Ubuntu, RHEL, CentOS Stream, AlmaLinux, Fedora, openSUSE, and OpenShift." While kernel maintainers have released fixes for both flaws, only a handful of distributions have published patches at the time of this writing. Both Dirty Frag and Copy Fail were disclosed with proof-of-concept exploits before distributions had issued patches. Wiz security urges users to temporarily disable the vulnerable kernel modules, assess operational impact and patch immediately once available, harden local access paths, monitor for suspicious activity, and conduct cleanup if compromise is suspected. Microsoft has observed signs of possible ongoing exploitation in the wild.
Editor's Notes
- Slide 1 of 2
The good news is kernel updates are in the pipeline; the bad news is the update for your distribution isn't out yet. Dirty Frag exploit code has been published. Take a hard look at disabling the esp6, esp4, and rxpc modules until you have the kernel update. Also review your container hardening and monitoring of privilege escalation, and restrict unnecessary or unintended shell access. Make sure you're watching for updates to all the Linux distributions in your environment for both Copy Fail and Dirty Frag.
- Slide 2 of 2
It hasn’t been a good month for Linux users. What further complicates this is that the responsible disclosure process was apparently not followed. Unfortunately, until patches are available for the major Linux distributions, your choices are stark: disable systems or active monitoring for signs of compromise.
Slide 1 of 0- Slide 1 of 2
Apple Releases macOS, iOS and iPadOS 26.5, Backports Retrievable Notification Fix
Apple has released updates to address more than 50 security flaws across its products. On May 11 the company released version 26.5 of MacOS, iOS, iPadOS, visionOS, tvOS, watchOS, and HomePod, as well as updates to iOS and iPad OS 18, 15.8.8, 16.7.16, and 17.7.11, which include backporting of a fix for the notification retrieval flaw reported in April (CVE-2026-28950). Version 26.5 also adds support for encrypted RCS messaging. This is likely to be the last major update to these OS versions before Apple's Worldwide Developer Conference later this summer.
Editor's Notes
- Slide 1 of 2
One interesting update delivered as part of iOS 26.5 is the support for encrypted RCS messaging. The RCS standard is eventually supposed to replace SMS, and is currently supported by iOS and Android. To take advantage of end-to-end encryption, both users must use software that supports it. The most recent release of Google’s Android messaging does support it. In addition, the carrier must enable support for encrypted RCS messages.
- Slide 2 of 2
Apple finished backporting the fix for CVE-2026-28950 to iOS 15, 16 and 17 (this is the flaw where deleted notifications could be resurrected), and has updated all its operating systems. Fixes were also backported to macOS 14.8.7 and 15.7.7. With all the versions floating around, it's going to get confusing, so for simplicity, deploy version 26.5 and focus on updating hardware which cannot run version 26. Leverage the older OS updates as a preventative measure where updating is not an option. Note that the encrypted RCS messaging is marked as beta and only works with certain carriers; eventually this will give similar message protection that iMessages currently have.
Slide 1 of 0- Slide 1 of 2
The Rest of the Week's News
College Student Arrested for Disrupting Taiwan High Speed Rail Trains
Last month, law enforcement authorities in Taiwan arrested a 23-year-old student for allegedly sending signals to Taiwan High Speed Rail's (THSR's) communication network. The student was released on NT$100,000 (about US$3,168) bail on Wednesday, April 29. The suspect allegedly sent a General Alarm signal via a terrestrial trunked radio (TETRA) handset. Protocol required employees to follow emergency response plans and manually stop the trains. Because of the method by which the signal was sent, authorities initially thought the unauthorized signal was from an insider. However, using information gleaned from CCTV footage and TETRA network logs, authorities were able to trace the device used to send the unauthorized signal to the suspect's home. Authorities have determined that the student, who is identified only by his surname, Lin, had an accomplice who provided him with information that allowed the false alarm to be sent. Taiwan High Speed Rail (THSR) confirmed that the incident disrupted services of three trains for just under an hour on April 5, 2026.
Editor's Notes
- Slide 1 of 3
The biggest lesson here for system administrators is that operational disruption does not always require sophisticated hacking. In this case, an unauthorized but trusted signal triggered established safety procedures and stopped the trains. That is a classic example of how source and message authentication combined with trusted relationships can become the real target.
- Slide 2 of 3
Speculation is that the TETRA network was not encrypted or otherwise encoded, so he was able to spoof a legitimate signal using an SDR, a laptop, and a hand-held radio. When conducting radio-based research, be mindful of local and government restrictions. In this case Lin violated several of Taiwan's NCC radio communication laws, including using equipment not certified by the NCC, operating without a personal or radio station license, using an amateur radio license for commercial activity, and transmitting on railway, police, fire or public transport frequencies. If you have radio-based control systems, check the security posture, ensuring available security options are enabled.
- Slide 3 of 3
Well this is one way NOT to test one’s hacking ability. I mean it doesn’t sound as if the person had evil intent, just testing out a possible vulnerability, but it could have gone horribly wrong. Perhaps the university can add a module on responsible hacking and use this as an example on what not to do.
Slide 1 of 0- Slide 1 of 3
Instructure Took Canvas Offline Following Ransom Demand
The Canvas educational technology platform is back online after being taken down in response to a ransom demand. On Thursday, May 7, threat actors defaced the Canvas login page, demanding a ransom be paid or they would leak personal data. Canvas serves 275 million students and faculty members at close to 9,000 educational institutions. Canvas parent company Instructure took the platform down in response to the demand, which urged individual educational institutions to negotiate their own ransom payments to prevent personal data from being published. The decision disrupted students' and faculty's access to the platform in the midst of final exams. Some schools made the decision to postpone exams. The ransom demand is the latest in a string of related incidents: on May 1, Instructure CISO Steve Proud posted on the Confirmed Security Incident page that the company "recently experienced a cybersecurity incident perpetrated by a criminal threat actor." A post the following day reads that the company "believe[s] the incident has been contained," and a May 6 post says, "Canvas is fully operational." On May 11, Instructure CEO Steve Daly issued an apology on the company's Security Incident Update & FAQs page for the way in which information was communicated the preceding week, and announced changes intended to remedy earlier missteps. The incident has since been resolved, and Canvas is once again available to students and faculty.
Editor's Notes
- Slide 1 of 2
The update from Instructure provides lessons learned on incident communication we can all leverage. Add that to your IR playbook. As of May 11, Instructure paid the extortionists, likely ShinyHunters, for the return and destruction of the attackers’ copy of their data, and now have assurances that none of their customers will be extorted as a result of the incident. This is another topic to debate thoroughly before you find yourself in the situation of having an extortionist with your data.
- Slide 2 of 2
Communication is a huge part of any incident response plan. Unfortunately, Instructure bungled that part of the plan. While competitors to Canvas exist, it is the dominant platform with close to 50 percent of the available market share, so the CEO apology letter may be enough.
Slide 1 of 0- Slide 1 of 2
UK's ICO Fines South Staffordshire Water Over Insufficient Security Protections Following Ransomware Attack
The UK Information Commissioner's Office (ICO) has fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 ($1.3 million) for failing to implement adequate security protections, as evidenced by a ransomware attack that was discovered in 2022. The attack resulted in the intruders publishing personal information of more than 660,000 people. A subsequent investigation revealed that the intruders initially gained access to South Staffordshire Water's systems in 2020. The issues the ICO found with the systems included "limited controls, which allowed the attacker to escalate their privileges to admin after gaining an initial foothold on the network; inadequate monitoring and logging; [... just] 5 percent of South Staffordshire's IT environment was being monitored; running unsupported software, including Windows Server 2003; and poor vulnerability management." South Staffordshire Water supplies drinking water to 1.6 million people.
Editor's Notes
- Slide 1 of 2
Looks like South Staffordshire was well outside the mean-time-to-detect/mean-time-to-respond (MTTD/MTTR) range for most intrusions. That, coupled with poor patch management and outdated software, indicates a willful disregard for basic cybersecurity best practices. A quick back-of-the-envelope calculation equates to about two dollars per victim who doesn’t have a lot of options to go with another provider. So, the cost of a negligent executive team gets passed along to its customers to pay.
- Slide 2 of 2
South Staffordshire has taken steps to improve their cyber resilience, contain the incident, support those impacted, and reduce the risk of recurrence, and as a result of these actions and admission of wrongdoing the fine was reduced 40 percent. Translation: when you're crosswise with the regulator, acknowledge the problem and focus on remediation, improvement, and support for those impacted. If you're a critical infrastructure provider, or on the board for such a service, make sure you understand where you are with services, including cyber resiliency and incident response.
Slide 1 of 0- Slide 1 of 2
FCC's Ban on Foreign Router Updates Pushed Back to January 2029
The FCC has delayed the deadline for its ban on software and firmware updates for foreign-made routers from March 1, 2027 to at least January 1, 2029. The FCC has not ruled out making the waiver for updates permanent. The policy change, which the FCC says was made in "the public interest," comes just weeks after an April 27 letter to the FCC from the Consumer Technology Association (CTA) urging the FCC to extend the deadline. The extended deadline also applies to foreign made drones.
Editor's Notes
- Slide 1 of 3
The wording is tricky. If your device is on the covered list, you need a waiver to continue to get "all software and firmware updates to ensure the continued functionality of the devices, such as those that patch vulnerabilities and facilitate compatibility with different operating systems." This extension allows for the FCC committee to consider the rulemaking process which could make the waiver permanent. While this gets sorted, make sure that you're purchasing reputable, genuine devices with regular updates and that you're replacing them before they are EOL.
- Slide 2 of 3
The policy change makes sense given that these are consumer grade routers and not likely to be swapped out by owners within the original software update ban date. No one wants old unsupported routers on the Internet. But then the updates would be coming from those same, ahem, untrustworthy foreign vendors.
- Slide 3 of 3
This may be like RealID and take more than a decade.
Slide 1 of 0- Slide 1 of 3
BWH Hotels Notifies Customers That Six Months of Booking Data Were Compromised
BWH Hotels is notifying customers that their personal data were compromised following a security breach of an online application. According to the notification email, BWH became aware of the incident on April 22, 2026, and the intruders accessed six months worth of information, dating back to October 14, 2025. The breach involved a "web application that houses certain guest reservation data." The Register has asked BWH whether the intruders had access to the application data for six months, or of the April breach allowed the intruders to access six months worth of data. They also asked BWH if the incident is related to reports earlier this year that BWH customer data were being used in phishing campaigns. BWH has not yet responded to the Register's request for comment. BWH Hotels owns the WorldHotels, Best Western Hotels & Resorts, and Sure Hotels brands.
Editor's Notes
Beware of communication relating to BWH reservations or hotel stays. Another reminder to use known web, phone, and email addresses rather than trusting calls, emails or text messages requesting payments, codes, login credentials, or verifications. Keep in mind these communications make it appealing to click or provide the information immediately, playing on users' busy or distracted desire to "make the problem go away."
German Authorities Take Down Crimenetwork Marketplace and Arrest its Operator
Law enforcement authorities in Germany have "shut down the relaunch of the criminal online trading platform 'Crimenetwork' on Wednesday in an internationally coordinated operation." One individual was arrested in Mallorca; the suspect is a German citizen and is being charged with building and administering a new technical infrastructure for Crimenetwork within days of the shutdown of the previous version of the marketplace and the arrest of its administrator in December 2024. The Crimenetwork marketplace trafficked in illicit goods and services, including stolen data, drugs, and forged documents, with transactions conducted in cryptocurrency. Police seized Crimenetwork's technological infrastructure and roughly €194,000 (US$228,000) in illicitly obtained assets, along with user and transaction data that can be used to conduct further investigations into criminal activity. The operation was led by Germany's Central Office for Combating Internet Crime, Zentralstelle zur Bekämpfung der Internetkriminalität (ZIT) and the Federal Criminal Police Office Bundeskriminalamt (BKA) with assistance from law enforcement authorities in Spain.
Editor's Notes
- Slide 1 of 2
While we have talked about takedowns resulting the operation re-forming with a new operator, in this case the "new" Crimenetwork emerged on new infrastructure, with a new operator a few days after the shutdown in 2024. ZIT and BKA are sending a message that reformed criminal operations will be taken down as well, leveraging their relationship with the Spanish National Police to arrest the new operator at home in Spain. Ironically, while the original Crimenetwork operator was sentenced in March to seven years and ten months in prison and ordered to forfeit more than 10 million euros in proceeds, that ruling is not yet final.
- Slide 2 of 2
With all due credit for this successful shut down and arrest, the lesson for the rest of us is that law enforcement acts late and rarely recovers all loses.
Slide 1 of 0- Slide 1 of 2
Former Federal Contractor Found Guilty of Deleting Government Databases
A US federal jury in Virginia has convicted former federal contractor Sohaib Akhter on multiple charges, including conspiracy to commit computer fraud and password trafficking. Akhter and his twin brother and co-defendant, Muneeb Akhter, were both employed by a company in Washington, DC, "that provided software products and services to more than 45 federal government agencies and hosted data for some federal government clients on servers." The brothers were fired from their positions at the unnamed company after the company learned that Sohaib had a prior felony conviction from 2015. Within hours of losing their jobs, the two men "sought to harm their employer and its U.S. government customers by accessing computers without authorization, write-protecting databases, deleting databases, and destroying evidence of their unlawful activities." In all, they deleted 96 databases holding US government information. Both were arrested on December 3, 2025. Sohaib Akhter is scheduled to be sentenced on September 9, 2026; he may face up to 21 years in prison. Muneeb Akhter has not yet been convicted
Editor's Notes
- Slide 1 of 2
Sounds like conditional employment was granted before the background investigation completed. While there is pressure to staff up rapidly, make sure that you fully consider the risks of allowing that scenario. When terminating workers, whether for cause, by mutual agreement, or even by choice, it's important to completely revoke access, physical and logical, as rapidly as possible. Secondly, make sure that you have backups of outsourced data and services which you control. Know where they are and who can access/delete them.
- Slide 2 of 2
After decades, we still have instances where we fail to delete privileges of separated employees. We get them off the payroll but fail to delete system and application privileges.
Slide 1 of 0- Slide 1 of 2