Signal criticality: High
What happened: Help Net Security reported that it found that 88% contained material not intended for public release. UNC6692 is a newly identified threat group, documented by Google’s Threat Intelligence Group (GTIG) following a campaign that began in late December 2025. CISA, Microsoft warn of active exploitation of Windows Shell vulnerability (CVE-2026-32202) Attackers are exploiting CVE-2026-32202, a zero-click Windows Shell spoofing vulnerability that causes victims’ systems to authenticate the attacker’s server, CISA and Microsoft have warned. After Vect announced that it will be partnering with BreachForums and providing an “affiliate key” to every registered user of the forum, Check Point researchers opened a BreachForums account and got access to Vect’s panel and ransomware builder.
Key takeaways:
Original source: https://www.helpnetsecurity.com/2026/05/03/week-in-review-high-severity-lpe-vulnerability-in-the-linux-kernel-cpanel-0-day-exploited-for-months/
Signal criticality: High
What happened: Trail of Bits Blog published that if you found the inet_ntoa global buffer gotcha or the missing RTL_QUERY_REGISTRY_TYPECHECK flag, nice work. Since we first released the new C/C++ security checklist, we also developed a new Claude skill, c-review . This protective behavior was introduced as a response to MS11-011 , in which this registry type confusion bug was first reported. We d especially love to hear from anyone who found a cleaner exploitation path for the driver challenge than the ones we showed here.
Key takeaways:
Original source: https://blog.trailofbits.com/2026/05/05/c/c-checklist-challenges-solved/
The strongest signal today is that AI security is being decided in the surrounding control layer — permissions, connectors, deterministic workflow design, response speed, and the infrastructure that still underpins trust. That is a more durable framing than generic agent hype, and it is the one worth carrying forward.