COGNOSCERE Daily Tech Review — Issue T110 · Saturday, May 9, 2026

Or visit Intelligence Overview for deeper analysis.

ACTPalo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution

A critical buffer overflow vulnerability (CVE-2026-0300, CVSS 9.3) in Palo Alto Networks PAN-OS User-ID Authentication Portal is being actively exploited in the wild, allowing unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls. CISA added it to its Known Exploited Vulnerabilities catalog on May 6 with a federal remediation deadline of May 9; patches are not expected until May 13–28.

The Hacker News · Cybersecurity — Vulnerability Management · Relevance: 1.0 · Source →

zero-day, RCE, firewall, CISA KEV, state-sponsored, patch-gap, enterprise-security

ACTIvanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access

Ivanti disclosed and patched CVE-2026-6973, a high-severity remote code execution zero-day in its Endpoint Manager Mobile on-premises product that requires admin authentication and has been confirmed exploited in limited attacks. CISA added it to the KEV catalog and mandated federal remediation by May 10, continuing a pattern of repeated EPMM targeting by threat actors including suspected Chinese state-sponsored groups.

The Hacker News · Cybersecurity — Mobile Endpoint Security · Relevance: 0.9 · Source →

zero-day, MDM, RCE, CISA KEV, on-premises, enterprise-mobility, patch-now

ACTClaude Code OAuth Tokens Can Be Stolen Through Stealthy MCP Hijacking

Mitiga Labs researchers disclosed a supply-chain attack technique against Anthropic's Claude Code in which a malicious npm package redirects MCP traffic through attacker-controlled infrastructure, silently stealing OAuth tokens and achieving persistent SaaS access that survives token rotation. Anthropic declined to remediate the issue, classifying it as out-of-scope, placing responsibility on enterprise security teams to implement monitoring controls.

SecurityWeek · Cybersecurity — AI Tooling Security · Relevance: 0.9 · Source →

MCP, OAuth, supply-chain, agentic-AI, developer-security, SaaS, token-theft

PREPAREIBM Think 2026: Identity in the Age of Agentic AI — Vault 2.0 and NHI Security

IBM's Think 2026 conference surfaced a critical security gap: traditional identity and access management systems were not designed for non-human identities (NHIs) such as AI agents, which now outnumber human identities by 45 to 90 to one in enterprise environments and operate without continuous verification. IBM responded by announcing Vault Enterprise 2.0 and a unified Verify-plus-Vault solution for securing both human and agentic identities at runtime.

IBM Think Blog · Cybersecurity — Identity & Access Management · Relevance: 0.9 · Source →

IAM, NHI, agentic-AI, identity-security, zero-trust, enterprise-security, governance

PREPARERAM Shortage Dubbed 'RAMageddon' Threatens to Kill Budget Laptops as AI Demand Strains Memory Supply

AI data center expansion is consuming DRAM, HBM, and storage supply at a rate that is pushing memory manufacturers toward high-margin hyperscaler customers, straining supply for consumer devices. Gartner forecasts PC prices will rise 17% and smartphone prices 13% in 2026, with the sub-$500 PC segment potentially disappearing by 2028 as the shortage reshapes procurement economics across the enterprise hardware stack.

CNET · Hardware Infrastructure & Supply Chain · Relevance: 0.8 · Source →

DRAM, HBM, memory, supply-chain, hardware, AI-infrastructure, procurement, PC-market

WATCHCybersecurity 2026: AI-Compressed Attacks, the SEC Disclosure Era, and the $32B Cloud-Security Reset

An industry analysis synthesizes three defining forces in enterprise security for 2026: AI has compressed attack lifecycles such that the fastest intrusions now exfiltrate data four times faster than in 2025, Google's $32 billion acquisition of Wiz has restructured the cloud security vendor landscape, and SEC mandatory disclosure rules mean most public-company incidents are now reported on a regulatory clock rather than the company's own timeline. Identity weaknesses featured in nearly 90% of Unit 42 investigations.

PR News / EPR Cybersecurity Intelligence · Cybersecurity — Enterprise Risk · Relevance: 0.9 · Source →

cloud-security, M&A, SEC-disclosure, identity, threat-intelligence, CNAPP, enterprise-security

WATCHSpaceX May Spend Up to $119 Billion on 'Terafab' Chip Factory in Texas

SpaceX filed plans for a vertically integrated semiconductor fabrication complex in Grimes County, Texas, with an initial investment of $55 billion and a total potential outlay of $119 billion — one of the largest private industrial commitments in U.S. history. The Terafab project, which includes Intel as a manufacturing partner, aims to produce AI, robotics, and satellite chips for SpaceX, Tesla, and xAI at terawatt scale, with a public hearing scheduled for June 3.

TechCrunch · Semiconductor & Hardware Infrastructure · Relevance: 0.9 · Source →

semiconductors, chip-fab, AI-infrastructure, vertical-integration, domestic-manufacturing, compute

PREPAREWhy AI Regulation Is Now an Operating Model

CIO Dive reports that AI regulation has shifted in 2026 from principles to enforceable timelines, with the EU AI Act now imposing staged compliance obligations, U.S. state laws taking effect in California and New York, and enterprise regulators in healthcare and insurance issuing concrete lifecycle management expectations. CIOs are now required to demonstrate continuous AI governance controls — not just policies — across their entire vendor and deployment stack.

CIO Dive · AI Regulation & Governance · Relevance: 0.9 · Source →

AI-regulation, compliance, EU-AI-Act, state-law, governance, CIO, risk-management

WATCHIn OpenAI Trial, Former Technology Chief Says Altman Sowed 'Chaos,' Distrust Among Top Executives

Former OpenAI CTO Mira Murati testified via recorded video deposition in Elon Musk's lawsuit against OpenAI that CEO Sam Altman was deceptive about safety review procedures, undermined her authority, and created internal chaos that put the company at catastrophic risk of collapse during the 2023 board crisis. The trial, in which Musk seeks up to $150 billion in damages, has implications for OpenAI's governance credibility and its ongoing for-profit conversion.

U.S. News & World Report · AI Governance & Corporate Leadership · Relevance: 0.9 · Source →

OpenAI, governance, litigation, AI-safety, leadership, nonprofit-conversion, corporate-risk