The Back Door Attackers Know About — and Most Security Teams Still Haven’t Closed
2026-05-05T13:24:13Z•946b82b22044ecc5e65936ddee414489c73a4f55d12c150588c5ea9c3129985a
ABCDoorBirdCallCVE-2026-22679CVE-2026-29014CVE-2026-31431Go modulesMOVEitOAuth abusePyPI compromiseRCERMM abuseRuby gemsSSO abuseScarCruftSilver FoxTrellix breachVENOMOUS#HELPERcPanelcredential theftlocal privilege escalationpersistent tokensphishingremote code executionsupply chaintoken theft
What happened
A high-severity cluster of active threats and supply-chain incidents affecting enterprise tooling, SaaS auth, and popular open-source projects. Highlights include persistent OAuth token abuse as an invisible access vector; active exploitation of multiple critical unauthenticated RCEs (MetInfo CVE-2026-29014, Weaver E-cology CVE-2026-22679; both CVSS 9.8); a Linux local privilege escalation added to CISA KEV (CVE-2026-31431); critical MOVEit Automation authentication-bypass patches and weaponized cPanel flaws; widespread phishing and token-theft campaigns (Microsoft-disclosed campaign targeting
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 946b82b22044ecc5e65936ddee414489c73a4f55d12c150588c5ea9c3129985a
- Enrichment time
- 2026-05-05T13:24:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.