IT News Roundup: Fragnesia Linux Flaw, OpenAI Supply Chain Breach, and Cerebras IPO - May 23, 2026

The past few days have been dominated by a wave of Linux kernel vulnerabilities, a widening supply chain compromise reaching OpenAI, and significant moves across the AI and cloud infrastructure landscape. A new root-level kernel exploit called Fragnesia emerged as an unintended side effect of Dirty Frag patches, while attackers behind the TanStack npm poisoning campaign managed to compromise OpenAI employee devices. Meanwhile, Cerebras completed a massive 66 billion dollar IPO, AI agents proved they can create working exploits in benchmark tests, and the UK regulator opened an antitrust inquiry into Microsoft.

Fragnesia: Dirty Frag Sequel Gives Linux Attackers Root Access

Linux administrators hoping the Dirty Frag kernel vulnerability was an isolated incident are facing a considerably worse situation. Researchers at Google-owned Wiz have identified Fragnesia, a new local privilege escalation flaw in the Linux kernel XFRM subsystem that allows attackers to modify protected file data in memory without altering the files on disk.

Fragnesia emerged as an unintended side effect of the patches deployed to fix the original Dirty Frag vulnerabilities, continuing a frustrating pattern where security fixes accidentally create new vulnerabilities. The flaw avoids race conditions entirely, making it far more reliable than older Linux root exploits. A proof-of-concept repository from V12 is already public, and distributors including AlmaLinux, Amazon Linux, Debian, Gentoo, Red Hat, SUSE, and Ubuntu have all issued advisories.

Source: The Register

OpenAI Confirms Employee Devices Compromised in TanStack npm Supply Chain Attack

OpenAI has confirmed that attackers behind the ongoing TanStack npm supply chain compromise managed to reach two employee devices and exfiltrate a limited amount of internal credential material. The incident occurred during a phased rollout of new supply chain security controls introduced after a previous breach.

In response, OpenAI is rotating the signing certificates for macOS versions of ChatGPT Desktop, Codex App, Codex CLI, and Atlas, and is requiring users to update the affected software by June 12. The company stated that no production systems were breached, but the incident highlights how supply chain attacks are reaching deeper into the software assembly line. The campaign has been linked to a threat group known as TeamPCP, which has shown a particular interest in poisoning npm ecosystems and stealing developer credentials.

Source: The Register

Microsoft Patches Two Defender Zero-Days Actively Exploited in Attacks

Microsoft began rolling out security patches for two Windows Defender vulnerabilities that have been exploited in zero-day attacks. The first flaw involves improper link resolution before file access, while the second vulnerability enables threat actors to trigger denial-of-service states on unpatched Windows devices.

Microsoft released Malware Protection Engine versions 1.1.26040.8 and 4.18.26040.7 to address both flaws. The company noted that customers should not need to take manual action because the default configuration in Microsoft antimalware software ensures definitions and platform updates are installed automatically. However, administrators are advised to verify that automatic updates are properly configured on their systems.

Source: BleepingComputer

AI Agents Create Working Exploits in ExploitGym Benchmark

New research from UC Berkeley, Max Planck Institute, and several AI companies demonstrates that frontier AI models can develop functional exploits against real vulnerabilities. The ExploitGym benchmark tested AI agents against 898 real vulnerabilities found in applications, Google V8 JavaScript engine, and the Linux kernel.

Claude Mythos Preview successfully exploited 157 test instances while GPT-5.5 managed 120 within a two-hour window. Notably, even with standard security defenses like ASLR and the V8 sandbox enabled, a meaningful number of exploits still worked. The agents also went beyond the intended attack vectors in capture-the-flag environments, finding alternative paths to success. The findings suggest that applying diverse AI models could be advantageous in both offensive and defensive security scenarios.

Source: The Register

Cerebras Raises 5.55 Billion Dollars in Blockbuster 66 Billion Dollar IPO

Cerebras Systems completed an initial public offering that raised 5.55 billion dollars, valuing the company at over 66 billion dollars on its first day of trading. The company, founded in 2015 by former SeaMicro head Andrew Feldman, has pursued an unconventional approach to AI chip design: instead of cutting wafers into smaller GPU dies, Cerebras builds wafer-scale engines that etch all compute directly onto a single massive chip.

The wafer-scale architecture uses on-chip SRAM for unprecedented memory bandwidth and a novel compute engine optimized for sparse matrix operations common in deep learning. While the approach sacrifices memory capacity compared to GPU-based designs, Cerebras has demonstrated that the performance gains are significant enough to attract major customers. The IPO marks one of the biggest tech debuts of 2026 and validates the wafer-scale approach as a viable alternative to GPU-centric AI infrastructure.

Source: The Register

UK Opens Antitrust Inquiry Into Microsoft Business Software Ecosystem

The UK Competition and Markets Authority has launched a strategic market status investigation into Microsoft business software empire, marking the fourth such probe since the UK digital markets competition regime came into force. The inquiry examines whether Microsoft is using its market position to limit customer choice and restrict how AI competitors integrate with Microsoft business software.

A key concern is whether Microsoft software licensing practices are reducing competition in cloud services. The investigation must be completed within nine months, with a decision on designating Microsoft with strategic market status scheduled for February 2027. Microsoft has previously faced regulatory friction in the UK, including disputes with AWS and Google over cloud software licensing practices.

Source: The Register

Cloudflare to Lay Off 1,100 Staff in AI-Driven Restructuring

Cloudflare announced plans to eliminate approximately 1,100 positions, representing roughly 20 percent of its workforce. CEO Matthew Prince sent a direct email to affected employees explaining that the company increased use of AI has made certain roles redundant, and that the layoffs are necessary to define how the company operates as an AI-first organization.

The restructuring comes as Cloudflare faces pressure to compete with rivals like Akamai, which recently surged on a major LLM deal. The layoffs affect roles that the company determined are not sufficiently aligned with its AI-driven future, with affected employees offered free training through Cisco platform.

Source: The Register

GitHub Confirms Breach of 3,800 Repositories via Malicious VSCode Extension

GitHub has confirmed that approximately 3,800 repositories were breached through a malicious Visual Studio Code extension. The compromised extension served as an attack vector that allowed threat actors to access repository contents, raising concerns about the security of the VSCode extension ecosystem.

Repository owners are advised to audit their extension installations and review any suspicious activity in their codebases. The incident adds to growing concerns about supply chain security in developer tooling, following similar compromises in the npm ecosystem and GitHub Actions workflows.

Source: BleepingComputer