Full Daily Digest

The attack follows a familiar but dangerous pattern: compromising a trusted maintainer account to push malicious updates to widely used packages. The attacker's focus on the @antv ecosystem—a suite of data visualization tools—amplifies the impact, as these dependencies are deeply embedded in enterprise workflows. The payload's broad credential harvesting (AWS, Azure, Kubernetes, etc.) suggests a targeted effort to gain persistent access to cloud and development environments. Mitigation requires immediate credential rotation, 2FA enforcement, and manual verification of dependency versions. The campaign's rapid replication (639 malicious versions) underscores the need for stricter npm registry controls and proactive monitoring of maintainer account activity.

The Hacker News · 2026-05-19 · Incidents: Mini Shai-Hulud campaign hijacks npm maintainer account to distribute malicious @antv packages, stealing credentials from AWS, GitHub, and other services.

The virtual event highlights the critical need for SecOps teams to be well-prepared for data breaches, which often stem from common vulnerabilities such as misconfigured systems, unpatched software, and phishing attacks. Attackers typically exploit these weaknesses to gain unauthorized access, exfiltrate sensitive data, and disrupt operations. The session underscores the importance of implementing robust incident response plans, including real-time monitoring, threat intelligence integration, and regular penetration testing. Additionally, it emphasizes the adoption of advanced tools like SIEM solutions and endpoint detection and response (EDR) systems to enhance detection and mitigation capabilities. By understanding the attack paths and leveraging these tools, organizations can significantly reduce their exposure to breaches.

Dark Reading · 2026-06-18 · Events: SecOps teams must prepare for data breaches by understanding vulnerabilities and leveraging the latest incident response tools and best practices.

The leak of CISA credentials on GitHub represents a critical failure in contractor oversight and credential management. Attackers gaining access to these credentials could exploit AWS GovCloud and internal systems, potentially establishing persistent access—a scenario far more damaging than temporary disruption. The incident underscores the importance of robust access controls, continuous monitoring of public repositories, and stringent contractor compliance. Mitigation efforts should include immediate credential rotation, enhanced auditing of third-party access, and the implementation of automated tools to detect exposed credentials. Additionally, federal agencies must prioritize resilience, addressing workforce shortages and funding gaps to prevent similar lapses in the future.

CyberScoop · 2026-05-19 · Incidents: CISA faces scrutiny after sensitive credentials were leaked on GitHub, highlighting risks of contractor oversight and persistent state actor threats.

The Verizon DBIR reveals a troubling trend: attackers increasingly leverage vulnerabilities for initial access, with exploitation rates rising to 31%. This shift underscores the growing gap between threat actor agility and organizational patch management, as only 26% of critical vulnerabilities were fully remediated in 2025. The report emphasizes prioritizing patches based on active exploitation, as vulnerabilities lose exploitability over time—resurgence probabilities drop significantly after 30, 90, and 270 days. Defenders must adopt a risk-based approach, focusing on flaws listed in CISA's KEV catalog and leveraging tools like the Exploitability Prediction Scoring System. Automation and 'shift-left' detection strategies can streamline remediation, but foundational practices—asset visibility, patch discipline, and incident response readiness—remain paramount.

Dark Reading · 2026-05-19 · Vulnerability: Vulnerability exploitation now drives 31% of breaches, yet patching rates for critical flaws plummet to 26%, demanding urgent prioritization of active exploits.

The Verizon DBIR reveals a concerning trend: attackers are increasingly leveraging unpatched vulnerabilities, particularly those listed in CISA's KEV catalog, to gain initial access. The median patching time of 43 days—up from 32—creates a widening window of exposure. Common weaknesses like heap-based buffer overflows and use-after-free flaws are frequently exploited, suggesting attackers are targeting memory corruption vulnerabilities. Financially motivated actors drive 88% of breaches, with ransomware remaining highly disruptive. Defenders must prioritize patch management for KEV-listed vulnerabilities, implement memory-safe coding practices, and enhance ransomware resilience through offline backups and segmentation.

CyberScoop · 2026-05-19 · Vulnerability: Exploited vulnerabilities jumped to 31% of breach entry points as patching lagged, while ransomware dominated incidents despite declining payments.

The vulnerabilities disclosed by Nightmare Eclipse—YellowKey, GreenPlasma, and MiniPlasma—pose significant risks to Windows environments. YellowKey exploits BitLocker encryption by leveraging physical access via a weaponized USB, rendering encryption useless without credentials. GreenPlasma targets text input services to escalate privileges, though its proof-of-concept remains incomplete. MiniPlasma, however, is already exploitable and represents an immediate threat. These vulnerabilities emphasize the necessity of a multi-layered security approach. Organizations should prioritize deny-by-default strategies, such as application allowlisting and privilege restriction, to mitigate exploitation. Endpoint detection and response (EDR) should serve as a last line of defense, complementing preventative measures to contain lateral movement and limit damage.

Dark Reading · 2026-05-19 · Vulnerability: Six Windows zero-day vulnerabilities disclosed in six weeks underscore the need for layered defenses beyond patching.

The exposure of CISA's GitHub repository underscores critical lapses in secrets management and security hygiene. Attackers could exploit the exposed credentials to gain unauthorized access to cloud infrastructure, potentially compromising AWS accounts, Kubernetes clusters, and CI/CD pipelines. The repository contained hardcoded secrets, private keys, and SAML certificates, some of which were still valid. This incident highlights the dangers of disabling security controls like GitHub's secret scanning, a practice that should be non-negotiable. Organizations must enforce strict policies for handling secrets, implement automated scanning tools, and conduct regular audits to prevent such exposures. Additionally, training developers on secure coding practices and maintaining robust incident response protocols are essential to mitigate risks.

Dark Reading · 2026-05-19 · Incidents: CISA exposed sensitive credentials in a publicly accessible GitHub repository, revealing systemic flaws in secrets management and security practices.

SHub Reaper represents a significant evolution in macOS malware, blending credential theft with backdoor persistence. The attack chain begins with fake WeChat and Miro installers hosted on typosquatted domains, then shifts to impersonating Apple security updates and Google Software Update directories. By leveraging AppleScript, the malware avoids dropping foreign binaries, bypassing file-scanning tools like XProtect. This living-off-the-land approach complicates detection, as it relies on legitimate system processes. Enterprises must now monitor for unexpected Script Editor invocations, osascript spawning curl or shell interpreters, and browser-to-AppleScript execution chains. SentinelOne emphasizes layered defense, combining user education with behavioral monitoring to counter this multibrand spoofing tactic.

Dark Reading · 2026-05-19 · Incidents: SHub Reaper malware spoofs major tech brands to deliver a stealer-backdoor hybrid via fake installers and AppleScript execution.

The attack exploited a non-public vulnerability in Huawei enterprise routers, triggering a denial-of-service condition via malicious network traffic. The impact was severe, affecting emergency services and highlighting systemic risks in telecom infrastructure. Huawei's failure to issue a CVE or public advisory leaves other operators unaware of the threat. Mitigation requires immediate network segmentation, monitoring for anomalous traffic patterns, and pressure on vendors for transparent disclosure. The incident underscores the need for proactive threat intelligence sharing among critical infrastructure providers.

The Record by Recorded Future · 2026-05-19 · Incidents: A Huawei router zero-day caused Luxembourg's nationwide telecom outage, with no CVE issued or public patch released.

The UK’s regulatory approach underscores a growing global concern over the misuse of AI technologies to create and distribute harmful content. By leveraging hash matching, tech firms can proactively identify and block re-uploads of flagged material, reducing the burden on victims. However, the effectiveness of this method hinges on the robustness of the hash databases and the ability to adapt to evolving AI-generated content. The two-day removal mandate introduces significant compliance pressure, potentially leading to over-blocking or errors in content moderation. To mitigate these risks, firms should invest in advanced AI detection tools, ensure transparent moderation policies, and collaborate with regulators to refine enforcement mechanisms. This regulatory shift also highlights the need for international cooperation, as content often crosses borders, complicating jurisdictional enforcement.

The Record by Recorded Future · 2026-05-19 · Policy: UK regulator mandates tech firms to combat deepfakes and non-consensual intimate images using hash matching and strict removal timelines.

The Trapdoor operation exemplifies the convergence of malvertising and ad fraud, utilizing a multi-stage attack path. Initially, users download seemingly benign utility apps, which then coerce them into installing secondary apps. These secondary apps execute hidden WebViews, load threat actor-controlled HTML5 domains, and request ads, effectively automating touch fraud. The campaign’s selective activation technique ensures malicious behavior is only triggered for users acquired through threat actor-run ad campaigns, while organic downloads remain unaffected. This approach, combined with anti-analysis and obfuscation techniques, allows the operation to evade detection. Mitigation strategies include enhanced app vetting processes, continuous monitoring of ad traffic, and user education on the risks of sideloading apps. Defenders should also scrutinize HTML5-based cashout sites and install attribution tools for signs of abuse.

The Hacker News · 2026-05-19 · Incidents: Trapdoor ad fraud scheme exploited 455 Android apps to generate 659 million daily bid requests through hidden WebViews and malvertising campaigns.

Fox Tempest represents a significant evolution in cybercriminal tactics, offering a scalable, subscription-based service for malware signing. By leveraging Microsoft’s Artifact Signing, attackers could generate short-life certificates, enabling malware to evade detection by mimicking trusted software like AnyDesk and Teams. This approach allowed ransomware affiliates to distribute malware families such as Oyster, Lumma Stealer, and Vidar through fake websites and paid advertisements. The service’s high cost—thousands of dollars per use—indicates its appeal to sophisticated actors seeking advanced capabilities. Microsoft’s disruption, including the revocation of certificates and seizure of infrastructure, highlights the importance of monitoring and mitigating abuse of legitimate signing services. Defenders should enhance endpoint detection, scrutinize certificate validity, and implement application allowlisting to counter such tactics.

The Record by Recorded Future · 2026-05-19 · Incidents: Microsoft disrupted Fox Tempest, a malware-signing-as-a-service platform used by ransomware gangs to bypass defenses by making malware appear legitimate.

The vulnerability in Drupal's CMS poses a significant threat due to its potential for rapid exploitation post-disclosure, similar to historical exploits like Drupalgeddon. Attackers could leverage this flaw to compromise websites, potentially leading to remote code execution or data breaches. The affected versions span recent releases, indicating widespread impact. Mitigation requires immediate patching during the specified window, as delays could result in exploitation. Given Drupal's extensive use, this vulnerability could attract both opportunistic and targeted attacks. Administrators should monitor for the advisory and apply patches promptly, while also reviewing server logs for suspicious activity post-update.

SecurityWeek · 2026-05-19 · Vulnerability: Drupal warns of a 'highly critical' vulnerability with imminent exploitation risk, urging immediate patching on May 20.

Fox Tempest’s MSaaS operation exploited Microsoft Artifact Signing to generate short-lived code-signing certificates, enabling malware to bypass detection by masquerading as legitimate software. This service was leveraged by ransomware groups such as Vanilla Tempest, Rhysida, Inc, Qilin, and Akira, as well as malware families like Lumma Stealer and Vidar. The attack path involved creating fraudulent Azure tenants and subscriptions, distributing signed malware, and targeting global sectors including healthcare, education, and government. Microsoft’s disruption efforts included revoking certificates, seizing infrastructure, and filing lawsuits to compel third-party providers to take down malicious operations. Defenders should enhance endpoint detection capabilities, monitor for suspicious certificate usage, and implement stricter Azure tenant verification processes to mitigate similar threats.

SecurityWeek · 2026-05-19 · Incidents: Microsoft disrupted Fox Tempest’s malware-signing-as-a-service operation, revoking over a thousand certificates and dismantling infrastructure used to sign ransomware and malware.

The TP-Link Archer AX53 router vulnerabilities (CVE-2026-30814 to CVE-2026-30817) stem from improper handling of network packets and configuration files, allowing attackers to execute arbitrary commands or read sensitive files. Adobe Photoshop and Norton VPN installation flaws (CVE-2026-34632, CVE-2025-58074) enable privilege escalation via file replacement during setup. OpenVPN's TLS Crypt v2 flaw (CVE-2026-35058) can be exploited to trigger a denial of service. Mitigation includes applying vendor patches, monitoring for malicious network traffic, and restricting low-privilege user access during software installation.

Cisco Talos · 2026-05-19 · Vulnerability: Multiple critical vulnerabilities in TP-Link, Adobe Photoshop, OpenVPN, and Norton VPN expose systems to RCE, privilege escalation, and DoS attacks.

The Mini Shai-Hulud campaign demonstrates a highly evolved attack vector targeting npm packages. The malware leverages pre-install hooks to gain immediate access, harvesting credentials and embedding backdoors in developer tool configurations. Its ability to propagate through CI/CD pipelines amplifies its reach, allowing it to compromise entire development environments. Persistent mechanisms, such as systemd services and LaunchAgents, ensure continued access even after package removal. Mitigation requires a multi-layered approach: rotating all credentials, auditing developer environments, and reviewing recent publish activity. Organizations must also monitor for suspicious GitHub repository activity and implement stricter access controls for CI/CD pipelines.

CyberScoop · 2026-05-19 · Incidents: Mini Shai-Hulud malware resurfaces, compromising npm packages with persistent backdoors and credential theft.

Fox Tempest exemplifies the growing trend of specialized cybercrime services that lower barriers to entry for ransomware operators. By leveraging Azure tenants and short-lived certificates, the group provided a critical evasion mechanism for malware delivery. The attack path typically involves compromised Azure subscriptions to generate certificates, which are then used to sign malware, bypassing traditional security checks. The scale—over a thousand certificates and hundreds of Azure tenants—demonstrates the operational sophistication of this service. Defenders should prioritize certificate transparency monitoring, enforce strict Azure subscription controls, and deploy behavioral detection for signed but suspicious binaries. Microsoft's revocation of certificates is a step forward, but continuous monitoring for new certificate abuse is essential.

Microsoft Security Blog · 2026-05-19 · Incidents: Fox Tempest's malware-signing service enables ransomware distribution by abusing Microsoft's certificate system.

Fox Tempest’s operation exemplifies the commoditization of cybercrime tools, where attackers leverage specialized services to bypass traditional defenses. By abusing Microsoft’s Artifact Signing system, the group provided signed malware to ransomware operators, enabling attacks to appear legitimate. This attack path underscores the need for enhanced verification processes and monitoring of code-signing activities. The global scope of impacted sectors—healthcare, education, government, and finance—demonstrates the broad reach of such services. Defenders should prioritize certificate transparency logs, implement strict identity verification for code-signing requests, and monitor for anomalous signing patterns. Additionally, organizations should adopt zero-trust principles to mitigate the risk of trusted-but-malicious software.

CyberScoop · 2026-05-19 · Incidents: Microsoft disrupted Fox Tempest, a cybercrime service selling code-signing certificates to ransomware groups, exposing the evolving sophistication of attack supply chains.

The DirtyDecrypt vulnerability stems from a missing COW guard in the rxgk_decrypt_skb function, allowing writes to shared memory pages of privileged processes or critical files like /etc/shadow. This flaw is particularly dangerous in containerized environments, where it could facilitate pod escapes. Affected distributions include Fedora, Arch Linux, and openSUSE Tumbleweed, specifically those with CONFIG_RXGK enabled. Mitigation strategies include applying kernel patches, monitoring for exploit attempts, and considering killswitch mechanisms for temporary protection. The vulnerability's resemblance to earlier Copy Fail flaws underscores the need for robust memory management safeguards in kernel development.

The Hacker News · 2026-05-19 · Vulnerability: DirtyDecrypt PoC exploits a Linux kernel LPE flaw (CVE-2026-31635) due to missing COW guards in rxgk_decrypt_skb.

The article underscores a persistent gap in cybersecurity: the failure to implement basic defenses despite rapid technological advancements. Attack paths often exploit unpatched vulnerabilities, weak authentication, and poor network segmentation. The scope affects enterprises rushing into AI and cloud adoption without securing fundamentals. Mitigations include enforcing MFA, regular patching, and segmenting networks to limit lateral movement. AI should augment, not replace, these practices. The discussion also highlights how even sophisticated malware can be thwarted by basic defenses, reinforcing the need for a balanced approach to security.

Dark Reading · 2026-05-19 · Incidents: Fundamental security hygiene remains critical despite advancements in AI and cloud technologies.

The 2025 OWASP Top 10 update underscores the increasing complexity of securing modern applications. The introduction of A10:2025–Mishandling of Exceptional Conditions highlights the need for robust error handling to prevent exploitation. Expanding A01:2025–Broken Access Control to include SSRF reflects the growing prevalence of this attack vector in API-driven environments. A03:2025–Software Supply Chain Failures addresses the risks inherent in modern CI/CD pipelines, emphasizing the need for rigorous third-party component vetting. While tools like Detectify provide comprehensive runtime scanning for exploitable risks, architectural flaws and logging deficiencies necessitate complementary practices such as threat modeling and internal audits. Organizations must adopt a multi-layered approach to mitigate these evolving threats effectively.

Detectify Blog · 2026-05-19 · Vulnerability: The OWASP Top 10 2025 update introduces new categories and expanded risks to address modern application security challenges.

The attack chain demonstrates advanced evasion techniques, starting with a phishing email leveraging an invoice-themed lure to prompt quick action. The TXZ archive contains obfuscated JavaScript that initiates a hidden PowerShell session, deploying PawsRunner to fetch and decrypt a PNG image with steganographically hidden payloads. PureLogs, the final payload, employs async/await patterns for efficiency and analysis obfuscation, targeting a wide range of applications and exfiltrating data via HTTPS. This campaign underscores the increasing use of steganography to mask malicious traffic. Defenders should prioritize blocking uncommon archive formats, monitoring PowerShell activity, and restricting JavaScript execution from email attachments. Endpoint detection should also focus on in-memory execution to counter such threats.

Help Net Security · 2026-05-19 · Incidents: PureLogs infostealer uses steganography in cat photos to steal credentials via a phishing campaign.

The expansion of Selector's platform highlights a critical gap in hybrid cloud monitoring: the lack of cross-domain correlation. Traditional tools silo network, infrastructure, and cloud data, complicating root cause analysis and prolonging outages. Selector's solution ingests and harmonizes data across domains, preserving context and enabling AI-driven correlation. This approach mitigates the operational burden by reducing noise and accelerating incident resolution. For defenders, the platform's topology-aware context and end-to-end path visualization are particularly valuable, as they map dependencies and validate connectivity preemptively. Organizations should evaluate such tools to bridge visibility gaps in their hybrid deployments.

Help Net Security · 2026-05-19 · Tools: Selector's AI-powered multi-cloud observability platform unifies telemetry data to provide comprehensive incident visibility and root cause analysis in hybrid environments.

The integration of Claude Managed Agents with Cloudflare Sandboxes introduces a robust framework for secure and scalable agent deployment. Attack paths are mitigated through customizable proxies that prevent data exfiltration and securely inject credentials. Detailed sandbox metrics and logs enhance observability, enabling developers to monitor agent interactions effectively. Lightweight sandboxes, including microVMs and isolates, allow for rapid boot times and cost-efficient scaling. Private service connectivity ensures agents can interact with internal services without exposing them to the internet, reducing attack surfaces. Developers can further extend functionality by integrating custom tools, such as hosting files on Cloudflare’s R2 object storage. This integration not only simplifies deployment but also provides a secure environment for running agents at scale, making it a valuable addition to the Cloudflare Developer Platform.

Cloudflare Blog · 2026-05-19 · Tools: Cloudflare and Anthropic integrate Claude Managed Agents with Cloudflare Sandboxes, enhancing security, observability, and scalability for developers.

MSHTA, a Microsoft-signed binary, executes HTML application (HTA) files, enabling attackers to run malicious scripts in memory undetected. Threat actors exploit this via social engineering, often delivering malware like Lumma and PurpleFox. The attack chain typically involves launching MSHTA to retrieve remote scripts, transitioning to PowerShell for persistence and payload delivery. PurpleFox, for instance, uses MSHTA to download disguised MSI packages. This abuse underscores the risks of backward compatibility in legacy tools. Mitigation requires a multi-layered approach: blocking MSHTA access, enhancing user awareness, and implementing runtime behavioral detection. Organizations should prioritize attack surface reduction and pre-execution defenses to disrupt the attack chain effectively.

SecurityWeek · 2026-05-19 · Incidents: MSHTA, a legacy Windows tool, is being exploited to silently deliver malware, with Bitdefender reporting a sharp increase in related attacks.

The ChromaToast vulnerability (CVE-2026-45829) represents a severe pre-authentication RCE flaw in ChromaDB, a widely-used vector database for AI applications. The attack path involves exploiting the server’s trust in client-supplied model identifiers, bypassing authentication checks, and executing malicious HuggingFace models. This grants attackers shell access and full control over the server process, exposing sensitive data such as API keys, environment variables, and disk files. The vulnerability affects all ChromaDB versions since 1.0.0, with 73% of deployments exposed. Mitigation requires restricting network access to trusted clients and implementing code-level fixes, such as moving authentication checks before configuration loading and sanitizing client requests. The lack of response from Chroma underscores the urgency for organizations to assess and secure their deployments.

SecurityWeek · 2026-05-19 · Vulnerability: Unpatched ChromaDB vulnerability (CVE-2026-45829) enables unauthenticated RCE, risking server takeover and data exposure.

AgentControl addresses critical operational challenges in AI agent deployment, such as model drift and unpredictable outputs, by providing real-time intervention capabilities. Attack paths could involve exploiting delayed or inconsistent updates, leading to incorrect agent responses or security vulnerabilities. The tool mitigates these risks by enabling rapid configuration changes and controlled rollouts, ensuring consistent behavior across models and frameworks. Teams can benchmark quality pre-deployment and monitor performance with trace-level visibility, reducing the risk of adverse outcomes. This solution is particularly relevant for enterprises scaling AI-driven workflows, where governance and rapid intervention are paramount. Implementing AgentControl enhances operational reliability and reduces the attack surface associated with AI agent mismanagement.

Help Net Security · 2026-05-19 · Tools: LaunchDarkly’s AgentControl offers real-time control over AI agents in production, enabling dynamic behavior changes without redeployment.

Ubuntu Core 26's immutable design and snap confinement significantly reduce attack surfaces by ensuring only verified software runs. The Chisel build system enhances vulnerability triage by tracing files to their source, a critical feature for compliance with the Cyber Resilience Act. ARM64 Livepatch support mitigates downtime risks during kernel updates, while OP-TEE integration secures disk encryption keys in hardware. Operators should prioritize transitioning to Core 26 for long-term deployments, leveraging its transactional updates and observability tools to maintain compliance and reduce patch latency. The reduced update sizes (50-90% smaller) lower operational costs for large fleets.

Help Net Security · 2026-05-19 · Policy: Ubuntu Core 26 offers 15-year security maintenance with immutable snaps, reduced updates, and ARM64 Livepatch for industrial and edge AI devices.

The Reaper macOS infostealer represents a sophisticated evolution in macOS malware, leveraging multi-stage execution chains and impersonating trusted brands to deceive users. Unlike previous SHub variants, Reaper employs the applescript:// URL scheme to bypass Apple’s mitigations, loading malicious payloads directly into macOS Script Editor. The attack begins with fake installer websites hosted on typo-squatted domains, such as mlcrosoft[.]co[.]com, which collect detailed system and browser information. Reaper then targets password managers and cryptocurrency wallets, uploading stolen data in chunks to attacker-controlled servers. To maintain persistence, the malware mimics Google Software Update components, registering a LaunchAgent that executes a beacon script every 60 seconds, enabling remote code execution. Defenders should monitor for unusual AppleScript activity, unexpected network connections, and the creation of LaunchAgents or files associated with legitimate software vendors.

Help Net Security · 2026-05-19 · Incidents: Reaper macOS infostealer impersonates Apple, Microsoft, and Google to steal browser data, passwords, and cryptocurrency wallets.

The mandatory adoption of DAVE for Discord calls marks a significant step in securing real-time communications, mitigating risks of eavesdropping and man-in-the-middle attacks. Attackers previously exploiting unencrypted voice channels now face a hardened target, though text-based channels remain vulnerable to interception. Organizations relying on Discord for sensitive communications should verify client compliance with DAVE and consider alternative secure messaging solutions for text. The exclusion of stage channels from E2EE highlights a trade-off between security and scalability, necessitating additional safeguards for large-scale broadcasts.

Help Net Security · 2026-05-19 · Vulnerability: Discord now enforces end-to-end encryption for all voice and video calls using the DAVE protocol, excluding text messages and stage channels.

The release of 4.6 million credit card records by B1ack’s Stash underscores the operational maturity of dark web carding marketplaces. Attackers likely obtained this data through e-skimming or phishing, targeting high-value markets. The inclusion of full PANs, CVV2s, and personal details enables multi-layered fraud, including CNP transactions and identity theft. Defenders should prioritize monitoring for anomalous transactions, enhancing endpoint detection for skimming malware, and educating users on phishing risks. Financial institutions must implement real-time fraud scoring and collaborate with threat intelligence providers to track compromised cards. The global distribution of victims necessitates cross-border coordination to mitigate impact.

SecurityWeek · 2026-05-19 · Incidents: B1ack’s Stash releases 4.6 million stolen credit cards, escalating global fraud risks.

EvilTokens leverages OAuth consent phishing to bypass MFA by tricking users into granting access tokens on legitimate Microsoft domains. These tokens, scoped to sensitive resources like mailboxes and calendars, are refreshable and valid for extended periods, bypassing traditional credential replay detection. The attack path involves users authenticating normally, completing MFA challenges, and clicking 'Accept' on a malicious consent screen. This method avoids triggering suspicious sign-in events, making it difficult for SIEMs to detect. Mitigation requires conditional access policies that trigger on consent events, token-level revocation, and continuous monitoring of OAuth grants. Platforms like Reco provide automated solutions to map and manage these trust relationships, offering visibility into runtime layer activities.

The Hacker News · 2026-05-19 · Incidents: EvilTokens exploits OAuth consent screens to bypass MFA, granting attackers refreshable access tokens without triggering traditional security alerts.

The evolving threat landscape necessitates a shift from traditional business continuity planning to a cyber resilience-focused approach. Organizations must map their critical processes and dependencies, including suppliers and cloud services, to ensure operational continuity during disruptions. Governance plays a pivotal role, with clear decision rights, escalation paths, and recovery priorities forming the foundation. Continuous monitoring of third-party resilience and thorough cloud integration reviews are critical. Testing must simulate realistic scenarios, such as ransomware, prolonged outages, and identity compromises, to validate crisis management capabilities and technical infrastructure resilience. This approach ensures that organizations can maintain critical operations and recover within acceptable timelines.

SecurityWeek · 2026-05-19 · Vulnerability: Cyber resilience is essential for business continuity, requiring integrated governance, risk management, and rigorous testing against realistic disruption scenarios.

The upcoming Drupal core security update addresses a severe vulnerability, likely exploitable shortly after patch release. Attack paths could involve remote code execution or privilege escalation, given the urgency and broad scope. Affected versions include Drupal 11.3.x, 11.2.x, 10.6.x, and 10.5.x, with patches also provided for end-of-life versions like Drupal 8 and 9, albeit with no guarantees of efficacy. Mitigation involves updating to the latest patch releases before May 20 and planning upgrades to supported versions. Organizations must also monitor for post-patch exploits and ensure comprehensive vulnerability management.

The Hacker News · 2026-05-19 · Vulnerability: Drupal will release critical security updates on May 20, 2026, urging immediate preparation to prevent potential exploits.

Operation Ramz underscores the escalating sophistication and scale of cybercrime in the MENA region, with phishing-as-a-service (PhaaS) and malware distribution being primary attack vectors. The operation revealed a multi-layered threat landscape, including human trafficking victims coerced into financial fraud. Attack paths often involved compromised devices and servers with critical vulnerabilities, enabling malware propagation and data exfiltration. Mitigation strategies should focus on patching critical vulnerabilities, enhancing endpoint detection and response (EDR) capabilities, and fostering public-private partnerships to share threat intelligence. Organizations must also educate employees on phishing risks and implement robust access controls to prevent unauthorized system exploitation.

SecurityWeek · 2026-05-19 · Incidents: Operation Ramz led to 201 arrests and dismantled cybercrime infrastructure across 13 MENA countries.

The BadIIS malware ecosystem, developed by 'lwxat,' represents a sophisticated threat leveraging a MaaS model for widespread distribution. The malware's builder tool allows threat actors to customize payloads, enabling capabilities such as traffic redirection, reverse proxying, and SEO fraud. The developer's use of rapid iterative updates and evasion tactics, particularly targeting Norton, highlights a proactive approach to bypassing detection. The malware's global deployment, with a focus on the Asia-Pacific region, underscores its broad impact. Mitigation efforts should focus on deploying ClamAV and SNORT signatures, monitoring for the 'demo.pdb' string, and analyzing HTTP communications for the 'lwxatisme' user-agent string. Additionally, organizations should enhance IIS server security and implement robust traffic monitoring to detect and block malicious redirections.

Cisco Talos · 2026-05-19 · Incidents: A BadIIS malware variant, developed by 'lwxat,' is being distributed via MaaS, enabling traffic redirection, SEO fraud, and evasion tactics.

The DirtyDecrypt vulnerability stems from a missing copy-on-write guard in the rxgk_decrypt_skb component of the RxGK subsystem, which is part of the RxRPC network protocol used by AFS and OpenAFS. This flaw allows oversized response authenticators to be accepted, enabling attackers to write data to privileged processes or files, such as SUID binaries. The vulnerability is particularly concerning in containerized environments, where it could facilitate pod escape. Affected distributions include Arch Linux, Fedora, and openSUSE, provided CONFIG_RXGK is enabled. Mitigation involves applying the patches released in April and disabling CONFIG_RXGK if not required. Organizations should also monitor for exploitation attempts, especially given the availability of PoC code.

SecurityWeek · 2026-05-19 · Vulnerability: DirtyDecrypt Linux kernel vulnerability allows privilege escalation to root via a missing copy-on-write guard in the RxGK subsystem.

The SEPPMail vulnerabilities present a multi-faceted attack surface, with CVE-2026-2743 (CVSS 10.0) enabling arbitrary file writes via path traversal, leading to RCE. Attackers can leverage the 'nobody' user's write access to syslog configurations, forcing log rotations via cron jobs to reload malicious configurations. CVE-2026-44128 (CVSS 9.3) allows unauthenticated RCE through unsanitized Perl eval() statements, while CVE-2026-44126 (CVSS 9.2) exploits deserialization flaws. The GINA UI endpoints (CVE-2026-44125, CVSS 9.3) lack authorization checks, exposing sensitive functionality. Mitigation requires immediate patching to version 15.0.4, network segmentation to limit appliance exposure, and monitoring for unusual log file growth or syslog configuration changes.

The Hacker News · 2026-05-19 · Vulnerability: SEPPMail Secure E-Mail Gateway vulnerabilities allow RCE and unauthorized mail access, with patches available in versions 15.0.2.1 to 15.0.4.

The Private-CISA GitHub leak underscores the risks of misconfigured public repositories. Attackers could exploit exposed CI/CD logs, Kubernetes manifests, and AWS credentials to map infrastructure, escalate privileges, and execute lateral movement. The repository’s detailed operational documentation provided a blueprint for attackers to bypass defenses. Mitigation requires proactive measures: organizations should enforce GitHub secret scanning, conduct regular security audits, and implement least-privilege access controls. Tools like GitGuardian can identify and remediate exposure, while training developers on secure coding practices reduces the likelihood of such leaks. This incident highlights the critical need for continuous monitoring and robust incident response protocols.

GitGuardian Blog · 2026-05-19 · Incidents: A public GitHub repository exposed 844 MB of CISA secrets, including CI/CD logs and AWS credentials, prompting swift takedown within a day.

The attack leverages a compromised developer’s GitHub credentials to push an orphaned, unsigned commit containing a credential-stealing payload. Upon opening any VS Code workspace, the extension fetches and executes the payload, which includes a multi-stage stealer targeting developer secrets. The malware avoids Russian/CIS time zones and operates as a detached background process, ensuring stealth. It exfiltrates data via HTTPS, GitHub API, and DNS tunneling, while also installing a Python backdoor on macOS. This incident underscores the vulnerabilities in developer tools and the supply chain, emphasizing the need for rigorous access controls, code signing, and continuous monitoring of third-party dependencies.

The Hacker News · 2026-05-19 · Incidents: Compromised Nx Console extension (v18.95.0) steals developer credentials via a hidden payload in VS Code.

The rise of AI-driven threats, including disinformation campaigns and synthetic identity fraud, necessitates advanced defensive tools. Babel Street's Insights Investigator addresses this by enabling analysts to direct AI agents through natural language commands, ensuring transparency and traceability. The tool leverages proprietary data pipelines and supports multi-step investigations, reducing manual workload while maintaining audit trails. This approach is critical in high-stakes environments where adversaries exploit AI to outpace traditional defenses. Organizations should integrate such tools to enhance their investigative capabilities, ensuring they can respond to threats at machine speed while maintaining governance and trust.

Help Net Security · 2026-05-19 · Tools: Babel Street's Insights Investigator uses AI agents to automate investigations, countering AI-driven threats while maintaining human control and auditability.

The rise of generative AI has made deepfake attacks increasingly sophisticated, enabling attackers to impersonate individuals convincingly during video calls. These attacks often exploit virtual camera environments, bypassing traditional detection methods. iProov Verified Meetings addresses this by embedding deepfake detection directly into video conferencing platforms, analyzing imagery and hardware integrity in real-time. This approach mitigates risks in high-stakes scenarios like financial transactions and remote hiring. Organizations should prioritize integrating such solutions to authenticate participants continuously, reducing the attack surface. Additionally, training employees to recognize potential deepfake indicators can further bolster defenses against this evolving threat.

Help Net Security · 2026-05-19 · Tools: iProov Verified Meetings combats deepfake fraud in video calls with real-time identity verification and hardware integrity checks.

Egnyte's solution tackles data fragmentation by centralizing emails and attachments, a common pain point for organizations. The Email Capture feature mitigates the risk of critical communications being lost in personal inboxes, ensuring they are preserved and searchable. AI-driven tools like the Proposal Coordinator automate repetitive tasks, reducing human error and speeding up response times. The integration with Autodesk Forma and Deltek Vantagepoint ensures real-time collaboration, minimizing version control issues. However, organizations must assess the security implications of centralized data storage, ensuring proper access controls and encryption are in place to prevent unauthorized access or data leaks.

Help Net Security · 2026-05-19 · Tools: Egnyte's new Email Capture and AI features consolidate fragmented data, improving decision-making and operational efficiency in the AEC industry.

The research underscores a significant shift in phishing tactics, where attackers no longer rely on stolen databases but instead exploit publicly accessible social media data. By leveraging generative AI models, attackers can craft emails that mimic trusted communications, incorporating details like birthdays, hobbies, and local events. This approach reduces the need for extensive reconnaissance, as just a few posts provide enough context. Existing AI moderation systems often fail to detect these phishing prompts, as attackers use softer language to bypass safeguards. To mitigate this, organizations should educate users on the risks of oversharing online, implement advanced email filtering solutions, and develop AI-based detection systems to identify malicious prompts before email generation.

Help Net Security · 2026-05-19 · Incidents: Public Instagram posts enable AI-generated phishing emails that are more personalized and harder to detect than traditional phishing attempts.

This attack highlights a sophisticated software supply chain compromise, leveraging imposter commits to inject malicious code into trusted workflows. By redirecting tags to adversary-controlled forks, attackers bypass PR reviews and achieve arbitrary code execution. The malicious payload downloads the Bun runtime, extracts credentials from memory, and exfiltrates data to a controlled domain. The overlap with the Mini Shai-Hulud campaign suggests a broader threat cluster targeting npm packages. Mitigation requires pinning workflows to known-good commit SHAs, monitoring for unauthorized changes, and implementing robust CI/CD pipeline security controls. Organizations should also scrutinize third-party dependencies and enforce strict access controls to prevent similar exploits.

The Hacker News · 2026-05-19 · Incidents: GitHub Actions tags redirected to imposter commits steal CI/CD credentials via malicious code execution.