ISC Stormcast For Friday, May 1st, 2026 https://isc.sans.edu/podcastdetail/9914, (Fri, May 1st)
2026-05-01T07:23:55Z•dc785d279d6782ffd1582f02db8de868db0388c2e3ddadbf9ee413c417da5a04
BitwardenCVE-2026-28950CVE-2026-33634CanisterSprawlCheckmarxSANDCLOCKTeamPCPUNC6780apple-patchcredential-theftexploitationhoneypotlibredtailnpm-wormreconsupply-chainvercel-headerweb-requestsxinference
What happened
SANS ISC diary entries (late Apr–May 1, 2026) report multiple active security topics: Apple released iOS/iPadOS updates addressing an actively exploited Notification Services flaw (CVE-2026-28950). A TeamPCP supply-chain campaign update describes a 26-day pause ending with three concurrent compromises (Checkmarx KICS, Bitwarden CLI cascade, xinference PyPI), identification of a CanisterSprawl npm worm, continued credential-theft activity (operators designated UNC6780, credential stealer SANDCLOCK), and mention of stolen Cisco source tied to Trivy-linked credentials and the lapsed CISA KEV for
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- dc785d279d6782ffd1582f02db8de868db0388c2e3ddadbf9ee413c417da5a04
- Enrichment time
- 2026-05-01T07:23:55Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.