GitHub Actions Supply Chain Attack Hijacks actions-cool Tags
May 19, 2026
Attackers hijacked two actions-cool GitHub Actions workflows via imposter commits, stealing CI/CD credentials from all pipelines that ran them by
Application Security
GitHub Actions Supply Chain Attack Hijacks actions-cool Tags
Attackers hijacked two actions-cool GitHub Actions workflows via imposter commits, stealing CI/CD credentials from all pipelines that ran them by version tag.
18-Year NGINX Flaw CVE-2026-42945 Enables Unauthenticated RCE
Security researcher depthfirst disclosed CVE-2026-42945, an 18-year heap overflow in NGINX's rewrite module enabling unauthenticated RCE. CVSS 9.2 critical.
FamousSparrow APT Hit Azerbaijani Energy Firm in Three Waves
Bitdefender researchers documented three consecutive FamousSparrow intrusions against an Azerbaijani oil and gas firm between December 2025 and February 2026.
YellowKey and GreenPlasma: Unpatched Windows Zero-Days Released
Two unpatched Windows zero-days, YellowKey and GreenPlasma, were publicly dropped after researchers expressed dissatisfaction with Microsoft's handling.
GemStuffer Campaign Abuses 150+ RubyGems as Data Dead Drops
Socket identified GemStuffer, a campaign abusing 150+ RubyGems packages to scrape UK government council portals and publish collected data as gem archives.
SAP S/4HANA SQL Injection CVE-2026-34260 Rated CVSS 9.6
SAP's May 2026 Security Patch Day fixes CVE-2026-34260, a CVSS 9.6 SQL injection in S/4HANA Enterprise Search that lets authenticated attackers read or delete ERP ...
PHP SOAP Extension RCE CVE-2026-6722 Patched Across All Branches
PHP patched CVE-2026-6722, a use-after-free RCE in the SOAP extension, across all active branches (8.2, 8.3, 8.4, 8.5) — exposing any server handling SOAP requests.
cPanel Patches Three CVEs as Sorry Ransomware Hits 44K Servers
cPanel released a second emergency patch in ten days — CVE-2026-29202 and CVE-2026-29203 enable code execution — as Sorry ransomware hits 44,000 servers.
Checkmarx Jenkins Plugin Backdoored in TeamPCP Supply Chain
TeamPCP backdoored the Checkmarx Jenkins AST scanner plugin in a third supply chain wave, following March Trivy and April KICS attacks. Version 2026.5.09 was compromised; ...
Five Malicious NuGet Packages Target Chinese .NET Developers
Socket discovered five NuGet packages typosquatting Chinese .NET UI libraries — IR.DantUI, IR.OscarUI, and three more — amassing 65,000 downloads while stealing credentials from 12 ...
18-Year NGINX Flaw CVE-2026-42945 Enables Unauthenticated RCE
May 14, 2026
Security researcher depthfirst disclosed CVE-2026-42945, an 18-year heap overflow in NGINX’s rewrite module enabling unauthenticated RCE. CVSS 9.2 critical.
FamousSparrow APT Hit Azerbaijani Energy Firm in Three Waves
May 14, 2026
Bitdefender researchers documented three consecutive FamousSparrow intrusions against an Azerbaijani oil and gas firm between December 2025 and February 2026.
YellowKey and GreenPlasma: Unpatched Windows Zero-Days Released
May 14, 2026
Two unpatched Windows zero-days, YellowKey and GreenPlasma, were publicly dropped after researchers expressed dissatisfaction with Microsoft’s handling.
GemStuffer Campaign Abuses 150+ RubyGems as Data Dead Drops
May 14, 2026
Socket identified GemStuffer, a campaign abusing 150+ RubyGems packages to scrape UK government council portals and publish collected data as
SAP S/4HANA SQL Injection CVE-2026-34260 Rated CVSS 9.6
May 13, 2026
SAP’s May 2026 Security Patch Day fixes CVE-2026-34260, a CVSS 9.6 SQL injection in S/4HANA Enterprise Search that lets authenticated
PHP SOAP Extension RCE CVE-2026-6722 Patched Across All Branches
May 13, 2026
PHP patched CVE-2026-6722, a use-after-free RCE in the SOAP extension, across all active branches (8.2, 8.3, 8.4, 8.5) — exposing
cPanel Patches Three CVEs as Sorry Ransomware Hits 44K Servers
May 12, 2026
cPanel released a second emergency patch in ten days — CVE-2026-29202 and CVE-2026-29203 enable code execution — as Sorry ransomware
Checkmarx Jenkins Plugin Backdoored in TeamPCP Supply Chain
May 12, 2026
TeamPCP backdoored the Checkmarx Jenkins AST scanner plugin in a third supply chain wave, following March Trivy and April KICS
Five Malicious NuGet Packages Target Chinese .NET Developers
May 12, 2026
Socket discovered five NuGet packages typosquatting Chinese .NET UI libraries — IR.DantUI, IR.OscarUI, and three more — amassing 65,000 downloads
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.