TENEXSignal 05/14/2026

Top Takeaways

Supply chain provenance is no longer a control. The Mini Shai-Hulud worm compromised 400+ npm and PyPI package versions in five hours by hijacking OIDC tokens and forging valid SLSA provenance attestations. TanStack, Mistral AI and UiPath were among the targets. Any developer environment that ran npm install or pip install on May 11 or 12 is compromised.
Defensive AI just hit production. Microsoft's MDASH agentic system found 16 previously unknown Windows vulnerabilities including four critical RCEs, with no human researcher finding them first. The system hit 96 percent recall on five years of historical MSRC cases. AI-powered vulnerability discovery is no longer research. It is in the patch pipeline.
Zero-click Outlook RCE needs 24-hour patching. CVE-2026-40361 is a use-after-free in a DLL shared by Word and Outlook. The flaw triggers on email read or preview with no user interaction. Its discoverer compared it to the BadWinmail enterprise killer. Microsoft rates exploitation as more likely.
Manufacturing is now an attacker pivot point. Nitrogen ransomware hit Foxconn's North American facilities and exfiltrated 8TB of data including client schematics. Nitrogen deliberately targets mid-sized supply chain companies as softer entry points to larger enterprises. Tier-1 supplier security attestations are now a procurement requirement, not a nice-to-have.
Patch velocity must match AI discovery rate. Microsoft is on pace to patch 1,000+ CVEs in 2026 with AI directly driving the surge. LatAm threat actors are using AI agents to generate custom hacking tools on the fly. The AI-versus-AI vulnerability race is active. Teams without AI-assisted discovery are already behind.

Situation Report

Executive Summary
Top Security News
AI and Innovation Watch
Threat Intelligence
Critical Vulnerabilities
The TENEX 10X
Sources

Executive Summary

This week's intelligence paints a single unambiguous picture. The trust infrastructure of modern enterprise software is under coordinated systemic attack. The Mini Shai-Hulud supply chain worm compromised over 400 npm and PyPI packages including TanStack, Mistral AI and UiPath. The worm subverted CI/CD pipelines and generated valid SLSA provenance attestations for malicious code [8] [22]. Nitrogen ransomware struck Foxconn's North American facilities the same week, exfiltrating 8TB of data and exposing the fragility of supply chain security in manufacturing [2].

On the defensive side, Microsoft's AI-driven MDASH system discovered 16 previously unknown Windows vulnerabilities including four critical RCEs [11] [28]. AI-powered vulnerability discovery has crossed from research into production-grade defense. The same AI acceleration is being weaponized offensively. LatAm threat actors are generating custom hacking tools on the fly using AI agents [13]. Microsoft is on pace to break its annual vulnerability record with 500+ CVEs patched in five months [27].

The strategic imperative is clear. Signed packages, trusted pipelines and legacy patching cadences are no longer sufficient defenses. Organizations must treat their entire software supply chain as a potential attack surface. Accelerate patch velocity to match AI-driven discovery rates. Assume that any developer environment exposed to compromised packages is fully exfiltrated.

Top Security News

Supply chain collapse, ransomware against critical manufacturers and mass healthcare data exposure. Each carries direct compliance, continuity and reputational consequences.

Mini Shai-Hulud Supply Chain Worm - 400+ Packages Compromised

TeamPCP poisoned over 400 npm and PyPI package versions across 172 packages in five hours [22]. Targets included TanStack, Mistral AI, UiPath and Guardrails AI. The worm hijacked OIDC tokens to publish malicious updates with valid provenance attestations, rendering standard supply chain verification useless [8]. Any developer environment that updated dependencies during the May 11-12 window must be treated as fully compromised.

Foxconn Ransomware Attack - 8TB Stolen by Nitrogen Group

Nitrogen ransomware hit Foxconn's North American facilities claiming 11 million files stolen including schematics from major tech clients [2]. The group deliberately targets mid-sized supply chain companies with weaker security postures as entry points to larger enterprises [3].

Canvas LMS Breach - 275 Million Records, Deal Reached

Instructure reached a settlement with hackers who claimed to have stolen data tied to nearly 9,000 schools and 275 million individuals [4]. The scale of this education sector breach underscores systemic data governance failures in platforms handling sensitive student records.

West Pharmaceutical Ransomware - SEC 8-K Filed

West Pharmaceutical Services, a $3B+ injectable solutions provider, filed an SEC 8-K after a May 4 ransomware attack that disrupted global shipping, receiving and manufacturing operations [9]. Unit 42 was engaged for incident response. No ransomware group has claimed credit yet.

Healthcare Sector Under Sustained Attack

Four healthcare incidents disclosed this week. OpenLoop Health (716,000 patients) [7], Mt. Spokane Pediatrics (32,000 patients, LockBit5) [6], Canada Life (200,000+ customers, ShinyHunters) [5] and Michigan Medicine (Epic Systems breach) all disclosed incidents. The healthcare sector faces a sustained high-level threat from both ransomware and data-theft operations that directly endangers patient safety.

UK Computer Misuse Act Reform Advances

The UK's National Security Bill will include long-awaited reform of the 1990 Computer Misuse Act creating a statutory defense for good-faith security research [19]. This unlocks AI-enabled defensive tooling at scale for UK defenders and could drive up to 20 percent growth in the UK cyber sector.

AI and Innovation Watch

AI is now the most powerful defensive tool and the most dangerous offensive accelerant. The organizations that operationalize it first will define the new security baseline.

Microsoft's MDASH (Multi-model Agentic Scanning Harness) discovered 16 previously unknown Windows vulnerabilities including four critical RCEs without any human researcher identifying them first [11] [30]. The system orchestrates 100+ specialized AI agents across frontier and distilled models. It achieved 96 percent recall on five years of historical MSRC cases and 88.45 percent on the public CyberGym benchmark [28]. Microsoft is on pace to patch 1,000+ CVEs in 2026 with AI directly driving the surge [27].

On the offensive side, LatAm threat actors are using AI agents to generate custom hacking tools on the fly against targets in Mexico and Brazil [13]. Google's Threat Intelligence Group separately reported the first known case of a threat actor deploying an AI-developed zero-day exploit in a planned mass exploitation campaign [27]. The AI-versus-AI vulnerability race is no longer theoretical. It is active. Organizations without AI-assisted discovery are already behind.

Threat Intelligence

Ransomware groups, China-nexus APTs and financially motivated supply chain attackers. Each uses distinct TTPs that demand specific defensive responses.

TeamPCP (Supply Chain / Financially Motivated)

Executed the Mini Shai-Hulud campaign, poisoning 400+ npm and PyPI packages via GitHub Actions cache poisoning and OIDC token hijacking [8] [22]. TTPs include CI/CD pipeline subversion, SLSA provenance forgery, AES-256-GCM payload obfuscation, Bun runtime evasion and exfiltration via the Session protocol CDN to bypass corporate egress filters. The group previously compromised Bitwarden CLI and Aqua Security's Trivy scanner. The Trivy compromise led to a 90GB breach at the European Commission.

Nitrogen Ransomware (Double-Extortion / RaaS)

Targeted Foxconn's North American supply chain operations claiming 8TB of data [2]. Nitrogen spun out of AlphV in 2023 and deliberately targets mid-sized industrial and supply chain companies as softer entry points. A recent Nitrogen attack exploited CVE-2023-52271 in Topaz Antifraud via a Bring Your Own Vulnerable Driver (BYOVD) technique to disable antivirus tools.

FamousSparrow / UAT-9244 (China-Nexus Espionage)

Conducted a multi-wave intrusion against an Azerbaijani oil and gas company between December 2025 and February 2026 [12]. Operators repeatedly exploited the same ProxyNotShell Microsoft Exchange Server vulnerability across three separate waves deploying Deed RAT and TernDoor backdoors [14]. The intrusion illustrates that actors will re-exploit the same access path until the original vulnerability is patched, credentials are rotated and the attacker's ability to return is fully disrupted.

KongTuke / ModeloRAT (Financially Motivated, Social Engineering)

Delivered ModeloRAT via Microsoft Teams impersonation of IT Support escalating to full domain compromise in two days [21]. TTPs include Teams external access abuse, portable Python payload delivery via Dropbox, CVE-2023-36036 LPE exploitation, fake Windows lock screen credential harvesting, Kerberoasting and LSASS memory dumping via DumpIt.

Critical Vulnerabilities

May 2026 Patch Tuesday delivered 138 Microsoft CVEs plus critical fixes from Fortinet and Ivanti. Several are unauthenticated RCEs in core enterprise infrastructure.

CVE-2026-40361 (CVSS 8.4) - Zero-Click Outlook/Word RCE

A use-after-free in a DLL shared by Word and Outlook exploitable with no user interaction and triggered on email read or preview [31]. Compared by its discoverer to the BadWinmail enterprise killer flaw. Anyone could compromise a CEO just by sending an email. Microsoft rates exploitation as more likely.

CVE-2026-41089 / CVE-2026-41096 (CVSS 9.8) - Windows Netlogon and DNS Client RCE

Unauthenticated stack-based buffer overflow in Netlogon (domain controllers) and heap-based overflow in the DNS Client [29] [27]. Both allow remote code execution without authentication via specially crafted network requests.

YellowKey (No CVE yet) - Windows BitLocker Bypass, PoC Public

A researcher published a working PoC bypassing BitLocker on Windows 11 and Server 2022/2025 via NTFS transaction abuse in WinRE [16]. The exploit grants unrestricted access to TPM-only protected drives without credentials. Microsoft has not yet patched. Immediate mitigation requires enabling BitLocker PIN plus BIOS password.

CVE-2026-44277 / CVE-2026-26083 (CVSS 9.1) - Fortinet FortiAuthenticator and FortiSandbox RCE

Unauthenticated remote code execution via crafted HTTP requests against FortiAuthenticator and FortiSandbox [32]. Neither has been exploited in the wild yet but both are internet-facing security appliances [35]. Patch immediately.

CVE-2026-46300 (CVSS 7.8) - Linux Kernel Fragnesia LPE

A write-what-where condition in the ESP/XFRM subsystem affecting Red Hat Enterprise Linux 10 and under investigation across RHEL 6, 7, 9 and OpenShift [20]. Patch RHEL 10 immediately. Monitor advisories for other affected versions.

The TENEX 10X

This week's intelligence demands five concrete actions. Delay on any one of them materially increases breach probability.

Audit your dependency lockfiles now. Any environment that ran npm install or pip install between May 11-12 UTC must be treated as compromised. Rotate all secrets: npm tokens, GitHub PATs, AWS/GCP keys and SSH keys. Check for persistence artifacts including .claude/router_runtime.js and .vscode/tasks.json [8] [22].

Patch CVE-2026-40361 (Outlook zero-click RCE) and CVE-2026-41089/41096 (Netlogon/DNS RCE) within 24 hours [29] [31]. These are unauthenticated, network-reachable and rated exploitation-likely. As an interim measure for Outlook, enforce plain-text email rendering.

Restrict Microsoft Teams external access. The ModeloRAT campaign shows that Teams external chat, enabled by default, is now an active initial access vector [21]. Disable or strictly whitelist external tenant communications. Enforce MFA on all collaboration platforms.

Enforce BitLocker PIN on all enterprise endpoints immediately. The YellowKey PoC is public and bypasses TPM-only BitLocker [16]. Until Microsoft patches, a PIN requirement is the only effective mitigation for physical and local access scenarios.

Mandate supplier security attestations for all Tier-1 manufacturing and software vendors. Foxconn and the Mini Shai-Hulud campaign both confirm that your security posture is only as strong as your weakest supply chain partner [3] [22]. Require evidence of CI/CD pipeline integrity controls, OIDC token scoping and incident response plans from all critical vendors.