BlueHammer Vulnerability Exploited in Ransomware Attacks  

A recently disclosed Microsoft Defender vulnerability, dubbed BlueHammer (CVE‑2026‑33825), is now being actively exploited in ransomware attacks, according to CISA. The flaw is a local privilege escalation vulnerability that allows an authenticated attacker to gain elevated privileges on a compromised Windows system. The vulnerability was publicly disclosed on April 2, 2026, by a researcher known as Nightmare Eclipse, before Microsoft had released a fix. Microsoft subsequently patched the issue on April 14, although reports indicate the flaw had already been exploited as a zero‑day prior to the patch becoming available.

CISA added BlueHammer to its Known Exploited Vulnerabilities (KEV) catalog on April 22 and later updated its advisory to confirm that the vulnerability is being used in ransomware campaigns. While the specific ransomware group exploiting the flaw has not been identified publicly, CISA’s update indicates that threat actors are incorporating BlueHammer into attack chains to deepen access within victim environments and facilitate ransomware deployment.

The significance of BlueHammer lies in its ability to help attackers move from an initial foothold to complete system compromise. By gaining SYSTEM privileges, threat actors can access sensitive components such as the Security Account Manager (SAM) database, disable security controls, steal credentials, move laterally across networks, and prepare systems for ransomware encryption.

The story highlights a growing cybersecurity challenge: public vulnerability disclosures are increasingly followed by exploitation in extremely short timeframes, sometimes before organisations have had a realistic opportunity to patch.

DirtyClone: New Linux Privilege Escalation Vulnerability  

DirtyClone (CVE‑2026‑43503) is a newly disclosed Linux kernel local privilege escalation (LPE) vulnerability that allows an attacker with low-level access to escalate privileges to root. The flaw is part of the same family of vulnerabilities as DirtyFrag and stems from weaknesses in how the Linux kernel handles cloned network packets and shared memory. Researchers at JFrog discovered that certain kernel functions fail to preserve a security flag indicating that memory is shared with a file on disk, creating a pathway for attackers to manipulate protected memory regions.

The vulnerability carries a CVSS score of 8.8 (High) and affects systems where attackers can execute code as an unprivileged user. By exploiting the flaw, an attacker can alter the kernel's page cache and modify the in-memory version of privileged binaries without changing the actual file on disk. This allows malicious changes to evade traditional file-integrity monitoring tools and leaves minimal forensic evidence. Once the modified binary is executed, the attacker can gain full root privileges over the system.

To address the issue, Linux kernel maintainers released patches in May 2026, and major distributions have been backporting fixes into supported kernels. Organisations are advised to update affected systems promptly, review namespace and container configurations, and restrict unprivileged user namespace creation where possible. Systems running shared infrastructure or hosting untrusted workloads should prioritise remediation due to the elevated risk of privilege escalation and container breakout.

Japan ISP Breach Exposes 14+ Million Credentials 

Japanese telecommunications provider KDDI disclosed a breach affecting systems used by six internet service providers, potentially exposing approximately 14.2 million email addresses and password combinations belonging to ISP customers. The incident was attributed to exploitation of a vulnerability in third-party software used by the providers.

While no financial systems or operational networks were reportedly impacted, the scale of credential exposure makes this particularly significant. Breaches of this type often serve as fuel for future credential-stuffing, phishing, business email compromise, and account takeover campaigns.

The incident also highlights the growing concentration of cyber risk within third-party technology providers. Organisations can maintain strong internal security controls, yet still be exposed through vulnerabilities in software, platforms, or service providers that sit outside their direct control. This reinforces the importance of supplier risk management and continuous monitoring of critical third-party dependencies.

Beyond the immediate impact on affected customers, large credential breaches often have consequences that extend well beyond the initial victim organisation. Attackers routinely aggregate exposed credentials into broader criminal ecosystems where they can be reused in campaigns targeting financial institutions, enterprise services, and corporate email environments. As a result, organisations should anticipate increased phishing and account takeover activity following incidents of this scale.

Apple Patches More Than Two Dozen Security Vulnerabilities

Apple released security updates addressing more than 30 vulnerabilities across iOS, macOS, and Safari. Notably, several of the WebKit vulnerabilities were discovered with the assistance of AI tools, including OpenAI Codex and Anthropic Claude. Importantly, no active exploitation has been publicly reported.

The broader significance is Apple's acknowledgement that AI is accelerating vulnerability discovery and potentially shortening the time required to develop exploits. Apple stated it is accelerating the release of security updates in response to concerns that AI tools could significantly reduce the gap between vulnerability discovery and exploitation.

Several of the vulnerabilities addressed affect WebKit, the browser engine underpinning Safari and numerous applications across the Apple ecosystem. Browser-related vulnerabilities remain particularly important because they are often reachable through routine user activity such as opening websites, clicking links, or viewing online content. Prompt remediation therefore remains a key component of endpoint security and enterprise device management.

More broadly, this announcement demonstrates how artificial intelligence is beginning to influence both offensive and defensive cybersecurity practices. While AI is helping researchers identify vulnerabilities more efficiently, vendors are simultaneously being forced to accelerate testing, patching, and release processes to keep pace. The result may be a cybersecurity landscape where organisations have increasingly less time to assess and deploy security updates following disclosure.

PTC Windchill actively exploited RCE  

A critical vulnerability in PTC Windchill and FlexPLM (CVE-2026-12569) is being actively exploited by threat actors. Windchill is widely used in manufacturing, engineering, aerospace, automotive, and product development organisations to manage intellectual property, product designs, and engineering workflows. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) list after evidence emerged that attackers were deploying web shells on exposed systems.

The significance of this story is less about the vendor and more about the trend: attackers are increasingly demonstrating the ability to weaponise newly disclosed vulnerabilities within days of disclosure and patch release. Organisations that are slow to patch increasingly have little margin for error.

For affected organisations, the potential impact extends beyond traditional data theft. Product lifecycle management platforms often contain highly sensitive intellectual property, engineering specifications, manufacturing documentation, and information related to future products. A successful compromise could therefore result in both operational disruption and long-term competitive consequences.

The incident also reflects a broader shift in attacker priorities toward enterprise applications that sit deep within critical business processes. Rather than focusing solely on end-user systems, threat actors are increasingly targeting platforms that provide access to valuable data repositories and privileged workflows. As a result, security teams should review not only patch status but also evidence of compromise, particularly where vulnerable systems were internet-facing prior to remediation.

If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively Get in touch to find out how you can protect your organisation. 

The Threat Intel Roundup was prepared by Integrity360 summarising threat news as we observe it, current at the date of publishing. It should not be considered to be legal, consulting or any other professional advice. Any recommendations should be considered in the context of your own organisation. Integrity360 does not take any political stance in the information that we share. Moreover, the opinions expressed may not necessarily be the views of Integrity360.