Burst Statistics CVE-2026-8181 Draws 7,400 Attacks in 24 Hours
May 19, 2026
Wordfence blocked over 7,400 attacks against CVE-2026-8181 in the Burst Statistics WordPress plugin within 24 hours of disclosure, with 115,000
News
Burst Statistics CVE-2026-8181 Draws 7,400 Attacks in 24 Hours
Wordfence blocked over 7,400 attacks against CVE-2026-8181 in the Burst Statistics WordPress plugin within 24 hours of disclosure, with 115,000 sites still unpatched.
NGINX CVE-2026-42945 Under Active Exploitation After F5 Patch Drop
VulnCheck confirmed in-the-wild exploitation of NGINX CVE-2026-42945, a critical heap overflow, within days of F5's patch; 5.7 million servers are exposed.
CoinbaseCartel Steals Grafana Source Code via GitHub Token
Grafana Labs confirmed CoinbaseCartel stole its source code via a stolen GitHub token; the group has links to ShinyHunters; no customer data was affected.
MiniPlasma Windows Exploit Grants SYSTEM Access with No Patch
A researcher released a working MiniPlasma PoC granting SYSTEM access on fully patched Windows using an unpatched vulnerability first identified in 2020.
Leaked Shai-Hulud Code Fuels npm Infostealer Wave Targeting Devs
Shai-Hulud malware source code fueled a wave of poisoned npm packages in the @antv ecosystem, including echarts-for-react with 1.1 million weekly downloads.
INTERPOL Operation Ramz: 201 Arrests in 13-Nation MENA Sweep
INTERPOL Operation Ramz arrested 201 suspects and seized 53 servers across 13 MENA countries in a five-month cybercrime crackdown concluding February 2026.
Pwn2Own Berlin 2026 Closes with $1.3M in Zero-Day Prizes
Pwn2Own Berlin 2026 concluded with $1.3 million in prizes, including the first successful exploits of AI agent platforms in the competition's history.
GitHub Actions Supply Chain Attack Hijacks actions-cool Tags
Attackers hijacked two actions-cool GitHub Actions workflows via imposter commits, stealing CI/CD credentials from all pipelines that ran them by version tag.
ShinyHunters Claims 600,000-Record 7-Eleven Salesforce Breach
ShinyHunters claimed and 7-Eleven confirmed a breach of its Salesforce CRM containing over 600,000 records, with a ransom demand issued to the retail chain.
Tycoon2FA Adds Device-Code Attack to Bypass Microsoft 365 MFA
Tycoon2FA's latest update adds device-code phishing that hands attackers a valid Microsoft 365 OAuth token without requiring the victim's password or MFA code.
NGINX CVE-2026-42945 Under Active Exploitation After F5 Patch Drop
May 19, 2026
VulnCheck confirmed in-the-wild exploitation of NGINX CVE-2026-42945, a critical heap overflow, within days of F5’s patch; 5.7 million servers are
CoinbaseCartel Steals Grafana Source Code via GitHub Token
May 19, 2026
Grafana Labs confirmed CoinbaseCartel stole its source code via a stolen GitHub token; the group has links to ShinyHunters; no
MiniPlasma Windows Exploit Grants SYSTEM Access with No Patch
May 19, 2026
A researcher released a working MiniPlasma PoC granting SYSTEM access on fully patched Windows using an unpatched vulnerability first identified
Leaked Shai-Hulud Code Fuels npm Infostealer Wave Targeting Devs
May 19, 2026
Shai-Hulud malware source code fueled a wave of poisoned npm packages in the @antv ecosystem, including echarts-for-react with 1.1 million
INTERPOL Operation Ramz: 201 Arrests in 13-Nation MENA Sweep
May 19, 2026
INTERPOL Operation Ramz arrested 201 suspects and seized 53 servers across 13 MENA countries in a five-month cybercrime crackdown concluding
Pwn2Own Berlin 2026 Closes with $1.3M in Zero-Day Prizes
May 19, 2026
Pwn2Own Berlin 2026 concluded with $1.3 million in prizes, including the first successful exploits of AI agent platforms in the
GitHub Actions Supply Chain Attack Hijacks actions-cool Tags
May 19, 2026
Attackers hijacked two actions-cool GitHub Actions workflows via imposter commits, stealing CI/CD credentials from all pipelines that ran them by
ShinyHunters Claims 600,000-Record 7-Eleven Salesforce Breach
May 19, 2026
ShinyHunters claimed and 7-Eleven confirmed a breach of its Salesforce CRM containing over 600,000 records, with a ransom demand issued
Tycoon2FA Adds Device-Code Attack to Bypass Microsoft 365 MFA
May 19, 2026
Tycoon2FA’s latest update adds device-code phishing that hands attackers a valid Microsoft 365 OAuth token without requiring the victim’s password
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.