Burst Statistics CVE-2026-8181 Draws 7,400 Attacks in 24 Hours
May 19, 2026
Wordfence blocked over 7,400 attacks against CVE-2026-8181 in the Burst Statistics WordPress plugin within 24 hours of disclosure, with 115,000
Application Security
Burst Statistics CVE-2026-8181 Draws 7,400 Attacks in 24 Hours
Wordfence blocked over 7,400 attacks against CVE-2026-8181 in the Burst Statistics WordPress plugin within 24 hours of disclosure, with 115,000 sites still unpatched.
NGINX CVE-2026-42945 Under Active Exploitation After F5 Patch Drop
VulnCheck confirmed in-the-wild exploitation of NGINX CVE-2026-42945, a critical heap overflow, within days of F5's patch; 5.7 million servers are exposed.
Leaked Shai-Hulud Code Fuels npm Infostealer Wave Targeting Devs
Shai-Hulud malware source code fueled a wave of poisoned npm packages in the @antv ecosystem, including echarts-for-react with 1.1 million weekly downloads.
Pwn2Own Berlin 2026 Closes with $1.3M in Zero-Day Prizes
Pwn2Own Berlin 2026 concluded with $1.3 million in prizes, including the first successful exploits of AI agent platforms in the competition's history.
GitHub Actions Supply Chain Attack Hijacks actions-cool Tags
Attackers hijacked two actions-cool GitHub Actions workflows via imposter commits, stealing CI/CD credentials from all pipelines that ran them by version tag.
18-Year NGINX Flaw CVE-2026-42945 Enables Unauthenticated RCE
Security researcher depthfirst disclosed CVE-2026-42945, an 18-year heap overflow in NGINX's rewrite module enabling unauthenticated RCE. CVSS 9.2 critical.
FamousSparrow APT Hit Azerbaijani Energy Firm in Three Waves
Bitdefender researchers documented three consecutive FamousSparrow intrusions against an Azerbaijani oil and gas firm between December 2025 and February 2026.
YellowKey and GreenPlasma: Unpatched Windows Zero-Days Released
Two unpatched Windows zero-days, YellowKey and GreenPlasma, were publicly dropped after researchers expressed dissatisfaction with Microsoft's handling.
GemStuffer Campaign Abuses 150+ RubyGems as Data Dead Drops
Socket identified GemStuffer, a campaign abusing 150+ RubyGems packages to scrape UK government council portals and publish collected data as gem archives.
SAP S/4HANA SQL Injection CVE-2026-34260 Rated CVSS 9.6
SAP's May 2026 Security Patch Day fixes CVE-2026-34260, a CVSS 9.6 SQL injection in S/4HANA Enterprise Search that lets authenticated attackers read or delete ERP ...
NGINX CVE-2026-42945 Under Active Exploitation After F5 Patch Drop
May 19, 2026
VulnCheck confirmed in-the-wild exploitation of NGINX CVE-2026-42945, a critical heap overflow, within days of F5’s patch; 5.7 million servers are
Leaked Shai-Hulud Code Fuels npm Infostealer Wave Targeting Devs
May 19, 2026
Shai-Hulud malware source code fueled a wave of poisoned npm packages in the @antv ecosystem, including echarts-for-react with 1.1 million
Pwn2Own Berlin 2026 Closes with $1.3M in Zero-Day Prizes
May 19, 2026
Pwn2Own Berlin 2026 concluded with $1.3 million in prizes, including the first successful exploits of AI agent platforms in the
GitHub Actions Supply Chain Attack Hijacks actions-cool Tags
May 19, 2026
Attackers hijacked two actions-cool GitHub Actions workflows via imposter commits, stealing CI/CD credentials from all pipelines that ran them by
18-Year NGINX Flaw CVE-2026-42945 Enables Unauthenticated RCE
May 14, 2026
Security researcher depthfirst disclosed CVE-2026-42945, an 18-year heap overflow in NGINX’s rewrite module enabling unauthenticated RCE. CVSS 9.2 critical.
FamousSparrow APT Hit Azerbaijani Energy Firm in Three Waves
May 14, 2026
Bitdefender researchers documented three consecutive FamousSparrow intrusions against an Azerbaijani oil and gas firm between December 2025 and February 2026.
YellowKey and GreenPlasma: Unpatched Windows Zero-Days Released
May 14, 2026
Two unpatched Windows zero-days, YellowKey and GreenPlasma, were publicly dropped after researchers expressed dissatisfaction with Microsoft’s handling.
GemStuffer Campaign Abuses 150+ RubyGems as Data Dead Drops
May 14, 2026
Socket identified GemStuffer, a campaign abusing 150+ RubyGems packages to scrape UK government council portals and publish collected data as
SAP S/4HANA SQL Injection CVE-2026-34260 Rated CVSS 9.6
May 13, 2026
SAP’s May 2026 Security Patch Day fixes CVE-2026-34260, a CVSS 9.6 SQL injection in S/4HANA Enterprise Search that lets authenticated
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.