Fragnesia Makes Three: Linux Kernel LPE Hat-Trick, Cisco SD-WAN CVSS 10 Zero-Day, and node-ipc Supply Chain Stealer Hits 822K Weekly Downloads

Vulnerability

Fragnesia (CVE-2026-46300): Third Linux Kernel LPE in Two Weeks Has a Public PoC and No Race Condition Required

This is now a pattern, not a one-off: Copy Fail, Dirty Frag, and now Fragnesia have each dropped public root-escalation exploits within the same two-week window, all targeting the XFRM/ESP page-cache subsystem. The nasty part is that Fragnesia needs no race condition, meaning it runs reliably with a single command from any unprivileged local user including those inside unprivileged containers. If you already applied the Dirty Frag module blacklist, you're covered; if you only installed the Dirty Frag kernel patch, you are not, and you need the May 13 kernel update.

News

Cisco Catalyst SD-WAN CVE-2026-20182 (CVSS 10): Authentication Bypass Actively Exploited, CISA Emergency Directive Issued

A second CVSS 10 authentication bypass in Cisco's SD-WAN Controller stack landed with confirmed zero-day exploitation already in progress, and CISA issued Emergency Directive 26-03 mandating federal remediation by May 17. Worse, this is the fifth CVE in the same ongoing UAT-8616 campaign against SD-WAN infrastructure since 2023, meaning threat actors have been living inside these appliances for years and know the codebase well. If your SD-WAN Controllers are internet-facing, treat them as compromised and audit peering logs before patching.

Supply Chain

node-ipc npm Supply Chain Attack: 822K Weekly Downloads Backdoored via Domain-Takeover Maintainer Account, Cloud Creds Exfiltrated via DNS Tunneling

Three malicious versions of node-ipc (9.1.6, 9.2.3, 12.0.1) were published within 56 seconds of each other on May 14 by a compromised co-maintainer account whose backing domain had expired and been re-registered by an attacker just days earlier. The 80KB payload silently harvests over 90 credential categories including AWS, Azure, GCP, SSH keys, Kubernetes tokens, and GitHub CLI configs, then exfiltrates everything as HMAC-signed gzip over DNS TXT queries to a server masquerading as Azure infrastructure. If any CI pipeline ran npm install against an unpinned node-ipc 9.x or 12.x after May 14, rotate every secret in that environment now without waiting for confirmation of exfiltration.

Analysis

Socket's node-ipc Compromise Analysis: Domain Takeover Attack Vector, DNS TXT Exfil IOCs, and the 3-Minute Detection Window

Socket's AI scanner flagged the malicious node-ipc versions roughly three minutes after publication, providing the clearest technical breakdown of the attack including the DNS TXT query patterns (prefixes xh, xd, xf) and the attacker C2 masquerading as Azure infrastructure. The forensic detail that all malicious tarballs carry a timestamp of October 26, 1985 is a useful hunt artifact for catching cached or mirrored copies in artifact registries. Block the bootstrap resolver domain and check your Artifactory or Nexus caches, not just your node_modules.

Threat Intelligence

Tenable FAQ: UAT-8616 Cisco SD-WAN Campaign Now Spans 5 CVEs, 10+ Threat Clusters, and Three Years of Undetected Access

Tenable's RSO team documents how the SD-WAN exploitation campaign escalated from a single sophisticated threat actor to ten opportunistic clusters after public PoC code dropped in March 2026, a textbook case of how one nation-state exploit turns into a free-for-all inside days of public disclosure. All five CVEs are now in the KEV catalog with remediation deadlines, but organizations running internet-exposed SD-WAN Controllers without auditing for unauthorized peering events since early 2023 should assume they have already been touched.