Cyber Security
Cybersecurity
Grafana Breach Traced to TanStack npm Supply Chain Attack
Grafana revealed the source code breach that exposed its GitHub repositories originated from a TanStack npm package poisoned by the TeamPCP threat actor.
CVE Vulnerability Alerts
CISA Orders Patch for Sixth Cisco SD-WAN Zero-Day of 2026
Cisco confirmed active exploitation of CVE-2026-20182, a CVSS 10.0 authentication bypass in SD-WAN, as CISA gave federal agencies three days to patch.
Application Security
Exchange Server XSS CVE-2026-42897 Exploited via Crafted Email
Microsoft confirmed active exploitation of CVE-2026-42897, an XSS flaw in on-premises Exchange Server triggered when victims open malicious emails in OWA.
Cybersecurity
Ghostwriter APT Deploys Cobalt Strike in Geofenced Ukraine Campaign
ESET documented a Ghostwriter spear-phishing campaign using geofenced PDFs to deliver Cobalt Strike against Ukrainian and Polish government targets since March 2026.
Application Security
OpenAI Confirms Breach via Mini Shai-Hulud npm Supply Chain Attack
OpenAI confirmed two employee devices were compromised through a supply chain attack, exposing code-signing certificates for macOS, Windows, iOS, and Android apps.
Cybersecurity
KongTuke IAB Uses Microsoft Teams to Deploy ModeloRAT in 5 Minutes
ReliaQuest found KongTuke impersonating IT help desk staff via Microsoft Teams to trick employees into running PowerShell, deploying ModeloRAT and selling access to ransomware groups.
Application Security
node-ipc npm Package Hid Credential Stealer Across Three Versions
Socket and StepSecurity found stealer backdoors in three node-ipc npm versions targeting 90 cloud and developer credential categories via an unknown new publisher account.
Application Security
PraisonAI CVE-2026-44338 Exploited 3h44m After Public Disclosure
Attackers began exploiting a missing-authentication flaw in PraisonAI's Flask API server 3 hours and 44 minutes after the CVE-2026-44338 advisory was published on May 11.
Application Security
Burst Statistics CVE-2026-8181 Draws 7,400 Attacks in 24 Hours
Wordfence blocked over 7,400 attacks against CVE-2026-8181 in the Burst Statistics WordPress plugin within 24 hours of disclosure, with 115,000 sites still unpatched.
Application Security
NGINX CVE-2026-42945 Under Active Exploitation After F5 Patch Drop
VulnCheck confirmed in-the-wild exploitation of NGINX CVE-2026-42945, a critical heap overflow, within days of F5's patch; 5.7 million servers are exposed.
Cybersecurity
CoinbaseCartel Steals Grafana Source Code via GitHub Token
Grafana Labs confirmed CoinbaseCartel stole its source code via a stolen GitHub token; the group has links to ShinyHunters; no customer data was affected.
Cybersecurity
MiniPlasma Windows Exploit Grants SYSTEM Access with No Patch
A researcher released a working MiniPlasma PoC granting SYSTEM access on fully patched Windows using an unpatched vulnerability first identified in 2020.
Application Security
Leaked Shai-Hulud Code Fuels npm Infostealer Wave Targeting Devs
Shai-Hulud malware source code fueled a wave of poisoned npm packages in the @antv ecosystem, including echarts-for-react with 1.1 million weekly downloads.
Cybersecurity
INTERPOL Operation Ramz: 201 Arrests in 13-Nation MENA Sweep
INTERPOL Operation Ramz arrested 201 suspects and seized 53 servers across 13 MENA countries in a five-month cybercrime crackdown concluding February 2026.
Application Security
Pwn2Own Berlin 2026 Closes with $1.3M in Zero-Day Prizes
Pwn2Own Berlin 2026 concluded with $1.3 million in prizes, including the first successful exploits of AI agent platforms in the competition's history.
Application Security
GitHub Actions Supply Chain Attack Hijacks actions-cool Tags
Attackers hijacked two actions-cool GitHub Actions workflows via imposter commits, stealing CI/CD credentials from all pipelines that ran them by version tag.
Cybersecurity
ShinyHunters Claims 600,000-Record 7-Eleven Salesforce Breach
ShinyHunters claimed and 7-Eleven confirmed a breach of its Salesforce CRM containing over 600,000 records, with a ransom demand issued to the retail chain.
Cybersecurity
Tycoon2FA Adds Device-Code Attack to Bypass Microsoft 365 MFA
Tycoon2FA's latest update adds device-code phishing that hands attackers a valid Microsoft 365 OAuth token without requiring the victim's password or MFA code.
Application Security
18-Year NGINX Flaw CVE-2026-42945 Enables Unauthenticated RCE
Security researcher depthfirst disclosed CVE-2026-42945, an 18-year heap overflow in NGINX's rewrite module enabling unauthenticated RCE. CVSS 9.2 critical.
Application Security
FamousSparrow APT Hit Azerbaijani Energy Firm in Three Waves
Bitdefender researchers documented three consecutive FamousSparrow intrusions against an Azerbaijani oil and gas firm between December 2025 and February 2026.
Cybersecurity
Capcom ID Breach Exposes 11.77 Million Email Addresses
Cybersecurity
Capcom ID Breach Exposes 11.77 Million Email Addresses
TOP CYBERSECURITY HEADLINES
CVE Vulnerability Alerts
Arista Patches Exploited VeloCloud Orchestrator Zero-Day
CVE Vulnerability Alerts
Okta Patches Four Access Gateway Flaws Including CVSS 9.1 Bug
CVE Vulnerability Alerts
ZDI Posts Unpatched Linux KSMBD RCE Flaws to Public Mailing Lists
This Week’s Security Spotlight
Application Security
GitLab Patches CVSS 10.0 Unauthenticated RCE Flaw CVE-2026-110264
CVE Vulnerability Alerts
Okta Patches Four Access Gateway Flaws Including CVSS 9.1 Bug
Application Security
PHP Ships Emergency Patches for PHP2Shell as Exploitation Begins
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Ghostwriter APT Deploys Cobalt Strike in Geofenced Ukraine Campaign
ESET documented a Ghostwriter spear-phishing campaign using geofenced PDFs to deliver Cobalt Strike against Ukrainian and Polish government targets since March 2026.
OpenAI Confirms Breach via Mini Shai-Hulud npm Supply Chain Attack
OpenAI confirmed two employee devices were compromised through a supply chain attack, exposing code-signing certificates for macOS, Windows, iOS, and Android apps.
KongTuke IAB Uses Microsoft Teams to Deploy ModeloRAT in 5 Minutes
ReliaQuest found KongTuke impersonating IT help desk staff via Microsoft Teams to trick employees into running PowerShell, deploying ModeloRAT and selling access to ransomware groups.
node-ipc npm Package Hid Credential Stealer Across Three Versions
Socket and StepSecurity found stealer backdoors in three node-ipc npm versions targeting 90 cloud and developer credential categories via an unknown new publisher account.
PraisonAI CVE-2026-44338 Exploited 3h44m After Public Disclosure
Attackers began exploiting a missing-authentication flaw in PraisonAI's Flask API server 3 hours and 44 minutes after the CVE-2026-44338 advisory was published on May 11.
Burst Statistics CVE-2026-8181 Draws 7,400 Attacks in 24 Hours
Wordfence blocked over 7,400 attacks against CVE-2026-8181 in the Burst Statistics WordPress plugin within 24 hours of disclosure, with 115,000 sites still unpatched.
NGINX CVE-2026-42945 Under Active Exploitation After F5 Patch Drop
VulnCheck confirmed in-the-wild exploitation of NGINX CVE-2026-42945, a critical heap overflow, within days of F5's patch; 5.7 million servers are exposed.
CoinbaseCartel Steals Grafana Source Code via GitHub Token
Grafana Labs confirmed CoinbaseCartel stole its source code via a stolen GitHub token; the group has links to ShinyHunters; no customer data was affected.
MiniPlasma Windows Exploit Grants SYSTEM Access with No Patch
A researcher released a working MiniPlasma PoC granting SYSTEM access on fully patched Windows using an unpatched vulnerability first identified in 2020.
Leaked Shai-Hulud Code Fuels npm Infostealer Wave Targeting Devs
Shai-Hulud malware source code fueled a wave of poisoned npm packages in the @antv ecosystem, including echarts-for-react with 1.1 million weekly downloads.
INTERPOL Operation Ramz: 201 Arrests in 13-Nation MENA Sweep
INTERPOL Operation Ramz arrested 201 suspects and seized 53 servers across 13 MENA countries in a five-month cybercrime crackdown concluding February 2026.
Pwn2Own Berlin 2026 Closes with $1.3M in Zero-Day Prizes
Pwn2Own Berlin 2026 concluded with $1.3 million in prizes, including the first successful exploits of AI agent platforms in the competition's history.
GitHub Actions Supply Chain Attack Hijacks actions-cool Tags
Attackers hijacked two actions-cool GitHub Actions workflows via imposter commits, stealing CI/CD credentials from all pipelines that ran them by version tag.
ShinyHunters Claims 600,000-Record 7-Eleven Salesforce Breach
ShinyHunters claimed and 7-Eleven confirmed a breach of its Salesforce CRM containing over 600,000 records, with a ransom demand issued to the retail chain.
Tycoon2FA Adds Device-Code Attack to Bypass Microsoft 365 MFA
Tycoon2FA's latest update adds device-code phishing that hands attackers a valid Microsoft 365 OAuth token without requiring the victim's password or MFA code.
18-Year NGINX Flaw CVE-2026-42945 Enables Unauthenticated RCE
Security researcher depthfirst disclosed CVE-2026-42945, an 18-year heap overflow in NGINX's rewrite module enabling unauthenticated RCE. CVSS 9.2 critical.
FamousSparrow APT Hit Azerbaijani Energy Firm in Three Waves
Bitdefender researchers documented three consecutive FamousSparrow intrusions against an Azerbaijani oil and gas firm between December 2025 and February 2026.
MuddyWater Targeted South Korean Electronics Maker via DLL Sideloading
Iran-linked MuddyWater targeted nine organizations globally in 2026, including a South Korean electronics firm, using legitimate vendor DLLs for sideloading.
Linux Kernel Fragnesia CVE-2026-46300 Grants Root via Page Cache
CVE-2026-46300 Fragnesia is a third Linux kernel LPE enabling root access via page cache corruption with no race condition required. Patches available.
YellowKey and GreenPlasma: Unpatched Windows Zero-Days Released
Two unpatched Windows zero-days, YellowKey and GreenPlasma, were publicly dropped after researchers expressed dissatisfaction with Microsoft's handling.