The Big Picture

America's digital infrastructure is under siege from multiple vectors simultaneously — and the companies paid to defend it are getting hit first. While a critical Linux vulnerability with a confirmed federal patch deadline of May 15 sits actively exploited in the wild, the Trump White House is quietly reversing course on AI oversight after a frontier model so dangerous its own creators won't release it publicly landed on the desks of senior national security officials. The pattern is clear: capability is outrunning protection, adversaries are exploiting the gap in real time, and Washington is finally — slowly — waking up.

Today's Stories

THE COMPANIES GUARDING YOUR NETWORK JUST GOT THEIR POCKETS PICKED — TWICE

Trellix — the cybersecurity firm born from the 2022 merger of McAfee Enterprise and FireEye, protecting government agencies and global banks — confirmed attackers breached its source code repository. Law enforcement has been notified. This follows Checkmarx disclosing a nearly identical GitHub repository compromise on April 27. Two major security vendors compromised within eight days. Let that land. Source code for an endpoint detection and response product isn't just intellectual property — it's a blueprint of every detection method, every blind spot, every place the software looks and doesn't look. If adversaries are moving up the supply chain to hit vendors instead of individual targets, the downstream exposure multiplies across hundreds of organizations simultaneously. The attack vector hasn't been disclosed. If it was a poisoned open-source dependency or a stolen developer credential, more vendors will surface. Watch every Trellix product update in the next 90 days for unexpected behavior. This is how a nation-state operation looks before anyone calls it one.

CRITICAL LINUX FLAW CONFIRMED EXPLOITED — FEDERAL DEADLINE IS MAY 15, AND THE CLOCK IS RUNNING

Every Linux server in America just became a priority target. CVE-2026-31431, dubbed "Copy Fail," is a local privilege escalation flaw in the Linux kernel affecting every mainstream distribution built since 2017. CISA added it to the Known Exploited Vulnerabilities catalog on May 1. Federal civilian agencies have until May 15 to patch. Microsoft's Defender Security Research Team is already observing preliminary testing activity and warns mass exploitation is likely within days. A public proof-of-concept reliably reproduces against Ubuntu 24.04 LTS, Amazon Linux 2023, and RHEL 10.1. "Local" means any attacker who already has a foothold — a compromised web app, a phished employee account — can use this to go full root. Ubuntu, Debian, Rocky, and SUSE have shipped fixes. Red Hat had not patched as of Monday's reporting. CERT-EU is specifically warning about Kubernetes nodes and CI/CD build environments. If your Linux systems aren't patched by Friday, you should assume you're already in scope for exploitation.

WHITE HOUSE REVERSES ON AI OVERSIGHT AFTER WEAPON-GRADE MODEL LANDS ON NATIONAL SECURITY DESKS

Six months ago, Vice President Vance stood in Paris and lectured Europe about overregulating AI. This Tuesday, the New York Times reported — citing U.S. officials briefed on the deliberations — that President Trump is now considering an executive order to create an AI working group examining pre-release oversight procedures for new models. Senior officials have already briefed Anthropic, Google, and OpenAI executives on the plans. What changed: Anthropic's Mythos model — so capable at finding security vulnerabilities that Anthropic itself warned of a cybersecurity "reckoning" and refused to release it publicly. The discussions are being led by the Office of the National Cyber Director, meaning this is being treated as a national security problem, not a tech policy debate. The key word to watch in any executive order is "first access" versus "approval required." One is intelligence gathering. The other is a regulatory gate. The White House calls current reports "speculation" — but the lab briefings already happened. That's not speculation. That's a policy process.

CHINA'S AI USAGE JUST SURPASSED AMERICA FOR THE SECOND STRAIGHT WEEK

While Washington debates frameworks and Brussels writes regulations, China is winning the usage war. AASTOCKS reported Monday that China's AI weekly active usage surpassed the United States for the second consecutive week, with Tencent's Hunyuan 3 preview ranking first among free models globally. This is not a research metric. This is deployment at scale — real users, real workflows, real competitive advantage compounding week over week. Meanwhile, Anthropic's co-founder Jack Clark published analysis this week putting 60% odds on AI systems autonomously designing their own successors by end of 2028, citing internal benchmarks showing Claude's self-optimization capability jumping from a 2.9× speedup in May 2025 to 52× in April 2026. A skilled human researcher achieves 4× on the same task in four to eight hours. The gap between American AI capability and Chinese AI deployment is a national security problem. Winning the model race means nothing if Beijing wins the adoption race.

ENEMY HACKERS ARE TARGETING PHILIPPINE AND LAOTIAN MILITARY NETWORKS — AND A CHINESE NEXUS IS SUSPECTED

The CISA patch deadline for a critical cPanel authentication bypass expired Sunday. For some Southeast Asian military networks, that was already too late. Activity observed May 2 targeted government and military entities in the Philippines and Laos — exploiting CVE-2026-41940, a cPanel vulnerability that grants full administrative control without credentials. The shift from mass opportunistic scanning to deliberate targeting of .mil.ph and .gov.la domains points toward intelligence collection, not ransomware. Separately, Check Point Research detailed Operation TrueChaos this week — a campaign using a zero-day in the TrueConf Windows client to push malware into multiple Southeast Asian government environments. Check Point assesses moderate confidence in a Chinese nexus. The Philippines is a treaty ally. Laos sits at a critical geopolitical crossroads. If confirmed data exfiltration follows, this moves from a patching failure story to a Chinese espionage operation against American partners in the Indo-Pacific.

What to Watch

• [CONFIRMED] If Red Hat fails to ship a Copy Fail patch before May 15, then ransomware affiliates will have a stable, public privilege-escalation exploit against the most conservative enterprise Linux footprint in the world — affecting government contractors, critical infrastructure, and financial institutions running RHEL. (Confirmed: patch gap reported as of Monday; CISA deadline is documented)
• [ASSESSED] If Trellix's forensic investigation names a poisoned open-source dependency or stolen developer credential as the breach vector, then additional security vendors will disclose similar repository compromises within weeks — indicating a coordinated upstream supply chain targeting campaign rather than isolated incidents. (Assessed: pattern of two vendors in eight days supports hypothesis)
• [ASSESSED] If the Trump administration's AI executive order uses "approval required" language rather than "first access," then the United States will have effectively adopted a regulatory framework more restrictive than what the administration publicly criticized the EU for implementing — with enormous consequences for American AI competitiveness. (Assessed: policy language is the single determinative variable)
• [SPECULATIVE] If China's consecutive weeks of surpassing U.S. AI active usage continue through Q3 2026, then Beijing's deployment advantage will compound into workflow integration across Chinese industry and government at a scale that raw model benchmarks cannot offset — and the window to reverse it will be closing. (Speculative: usage trend is two weeks old; sustainability unconfirmed)

The Closer

The adversaries probing Philippine military networks, the hackers who walked out of two cybersecurity firms' source code repositories in eight days, and the Chinese users outpacing Americans on AI adoption week over week — none of them are waiting for Washington to finish its deliberations. America built the most powerful technology in human history. The question on the table right now is whether we're serious enough to defend it.

Patriot Wire — America's intelligence briefing. Unfiltered.