Trump Mobile Exposes 27,000 Customer Records via Insecure API
May 25, 2026
Security researcher Louis found that Trump Mobile’s HTTP POST API returned 27,000 customer records without any authorization check during the
Application Security
Trump Mobile Exposes 27,000 Customer Records via Insecure API
Security researcher Louis found that Trump Mobile's HTTP POST API returned 27,000 customer records without any authorization check during the T1 phone launch.
Splunk CVE-2026-20239 Logs Session Cookies in Plaintext
Splunk CVE-2026-20239 writes active session cookies to the _internal index in plaintext, exposing analyst tokens to any user or process reading that index.
Chromium Service Worker PoC Exploit Published for 42-Month-Old Bug
Google published PoC exploit code for an unpatched 42-month Chromium Service Worker flaw enabling persistent JavaScript execution after the browser is closed.
Banana RAT Hijacks Brazil Pix QR Codes via NF-e Lures
SHADOW-WATER-063 deploys Banana RAT via fraudulent Brazilian NF-e invoice lures, hijacking Pix QR codes to redirect instant payments to attacker-held accounts.
INJ3CTOR3 Deploys JOMANGY Webshell in FreePBX Campaign
CRIL documented INJ3CTOR3 deploying new JOMANGY webshell alongside a six-layer self-healing persistence mechanism against FreePBX VoIP systems for toll fraud.
NGINX 1.31.0 Zero-Day nginx-poolslip Bypasses ASLR
Researcher Vega publicly disclosed nginx-poolslip, an unpatched RCE zero-day in NGINX 1.31.0 that bypasses ASLR and threatens tens of millions of servers.
BadIIS Malware-as-a-Service Hijacks IIS Servers for SEO Fraud
Cisco Talos exposed BadIIS, a Chinese-speaking MaaS platform hijacking IIS servers to redirect traffic and manipulate search rankings since 2021.
TamperedChef Hides Malware Inside Signed Apps
Palo Alto's Unit 42 documented TamperedChef, a signed-app malware campaign with 12,000 global infections using digitally signed certificates to evade detection.
Chrome 148 Patches Critical WebRTC Use-After-Free
Google patched 16 Chrome vulnerabilities including critical CVE-2026-9111, a WebRTC use-after-free enabling drive-by exploitation without user interaction.
Anthropic Silently Fixed Claude Code Null-Byte Sandbox Escape
A null-byte sandbox bypass in Claude Code allowed credential exfiltration via prompt injection, present from October 2025 until Anthropic's silent March patch.
Splunk CVE-2026-20239 Logs Session Cookies in Plaintext
May 22, 2026
Splunk CVE-2026-20239 writes active session cookies to the _internal index in plaintext, exposing analyst tokens to any user or process
Chromium Service Worker PoC Exploit Published for 42-Month-Old Bug
May 22, 2026
Google published PoC exploit code for an unpatched 42-month Chromium Service Worker flaw enabling persistent JavaScript execution after the browser
Banana RAT Hijacks Brazil Pix QR Codes via NF-e Lures
May 22, 2026
SHADOW-WATER-063 deploys Banana RAT via fraudulent Brazilian NF-e invoice lures, hijacking Pix QR codes to redirect instant payments to attacker-held
INJ3CTOR3 Deploys JOMANGY Webshell in FreePBX Campaign
May 22, 2026
CRIL documented INJ3CTOR3 deploying new JOMANGY webshell alongside a six-layer self-healing persistence mechanism against FreePBX VoIP systems for toll fraud.
NGINX 1.31.0 Zero-Day nginx-poolslip Bypasses ASLR
May 22, 2026
Researcher Vega publicly disclosed nginx-poolslip, an unpatched RCE zero-day in NGINX 1.31.0 that bypasses ASLR and threatens tens of millions
BadIIS Malware-as-a-Service Hijacks IIS Servers for SEO Fraud
May 22, 2026
Cisco Talos exposed BadIIS, a Chinese-speaking MaaS platform hijacking IIS servers to redirect traffic and manipulate search rankings since 2021.
TamperedChef Hides Malware Inside Signed Apps
May 22, 2026
Palo Alto’s Unit 42 documented TamperedChef, a signed-app malware campaign with 12,000 global infections using digitally signed certificates to evade
Chrome 148 Patches Critical WebRTC Use-After-Free
May 22, 2026
Google patched 16 Chrome vulnerabilities including critical CVE-2026-9111, a WebRTC use-after-free enabling drive-by exploitation without user interaction.
Anthropic Silently Fixed Claude Code Null-Byte Sandbox Escape
May 21, 2026
A null-byte sandbox bypass in Claude Code allowed credential exfiltration via prompt injection, present from October 2025 until Anthropic’s silent
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.