May Patch Tuesday Bloodbath: MDASH Finds 16 Windows Bugs, GTIG Catches First AI-Built Zero-Day, and Exim Dead.Letter Drops on Millions of Mail Servers

Tools

Microsoft MDASH: 100+ AI Agents Found 16 Windows Flaws in This Month's Patch Tuesday

Microsoft's new multi-model agentic scanning harness (MDASH) just surfaced 16 CVEs in the Windows networking and auth stack, including four critical RCEs, by running 100+ specialized agents that debate and cross-examine findings across files. The system scored 100% recall on historical tcpip.sys MSRC cases and 88.45% on the public CyberGym benchmark, which is not a research demo -- it's production-grade and heading to enterprise preview next month.

Threat Intelligence

Google GTIG: First Confirmed AI-Built Zero-Day Used to Plan a Mass 2FA Bypass Campaign

GTIG intercepted the first zero-day exploit it has high confidence was built with AI assistance, a logic flaw in an open-source web admin tool that lets attackers sidestep 2FA without cracking credentials. The AI fingerprints were unmistakable -- educational docstrings, a hallucinated CVSS score, and textbook Python structure -- and Google patched with the vendor before the mass campaign launched. North Korean APT45 and Chinese UNC5673 are named separately for using AI at industrial scale to scan CVEs and generate payloads.

Vulnerability

Exim Dead.Letter (CVE-2026-45185): Unauthenticated RCE on GnuTLS Builds, Patch to 4.99.3 Now

XBOW's autonomous testing platform found a use-after-free in Exim's BDAT body parsing triggered by a single malformed TLS close_notify, giving an unauthenticated attacker a path to heap corruption and code execution with no special server config needed. The flaw hits Exim 4.97 to 4.99.2 on Debian and Ubuntu-derived distros using GnuTLS (OpenSSL builds are safe), which covers most shared hosting stacks and legacy mail relays that face the internet 24/7.

News

May 2026 Patch Tuesday: 120 Microsoft CVEs, 17 Critical, Plus SAP, Fortinet, Ivanti, and Apple

No zero-days this month, but 17 critical bugs including a CVSS 9.8 Windows DNS heap overflow and a CVSS 10.0 Azure DevOps info disclosure make this a heavy patching cycle. Ivanti EPMM also shipped a fix for an actively exploited RCE, so if your MDM stack is Ivanti, that one moves to the front of the queue.

Breach

Instructure Pays ShinyHunters Ransom to Stop 3.65TB Canvas LMS Leak Affecting 9,000 Schools

ShinyHunters hit Instructure twice in two weeks, defaced 330 Canvas login portals mid-finals with extortion messages, and walked away with a payout after threatening to dump data on 275 million users. The deal sets a bad precedent -- Instructure becomes the latest high-profile org to validate the extortion-as-a-service model -- and a second claimed breach immediately after the settlement shows how little a ransom actually buys you.

Supply Chain

GemStuffer: 150+ Malicious RubyGems Used as a Data Exfiltration Dead Drop for UK Council Portals

Socket found a campaign pushing junk gems that scrape UK local government portals and publish the stolen data back to RubyGems itself as the exfiltration channel, not a conventional malware drop. The attack coincided with RubyGems locking new account signups after a separate spam-publishing blitz of 500+ packages, and the mechanics -- hardcoded API keys, automated gem staging -- look like a capability test more than a finished operation.

Malware

TrickMo C: Android Banking Trojan Moves C2 Entirely onto TON Blockchain, Adds SOCKS5 Pivoting

ThreatFabric's latest TrickMo analysis shows the malware routing all C2 traffic through The Open Network's decentralized overlay (.adnl addresses), which makes domain takedowns essentially useless since there are no DNS records to pull. On top of the usual device-takeover tricks, it now runs a SOCKS5 proxy on infected devices so fraudulent transactions route through the victim's own IP, defeating bank fraud-detection systems that rely on IP reputation.