A critical Windows Netlogon vulnerability (CVE-2026-41089) is being actively exploited in the wild, putting unpatched domain controllers at serious risk. Attackers need only network access to trigger the flaw — no authentication, no user interaction required — allowing full SYSTEM-level code execution and potential domain takeover.

Microsoft patched it in May 2026's Patch Tuesday update, alongside 15 other critical flaws. Belgium's Center for Cybersecurity has flagged it as a top-priority emergency fix. Security teams should patch domain controllers immediately, tighten network segmentation, and monitor for suspicious Netlogon traffic and unexpected admin account creation.

Source: Cybersecurity News

A cybercriminal group called Silent Ransom Group (SRG) has escalated its attacks on US law firms by impersonating IT staff — both over the phone and in person. Since 2023, the group has targeted law, insurance, finance, and healthcare firms using callback scams to trick employees into granting remote desktop access.

As of spring 2026, the FBI warns that when remote access fails, SRG sends an actor physically to the victim's office, convincing staff to plug in an external drive under the guise of IT maintenance. Data is then quietly exfiltrated using legitimate tools like WinSCP or Rclone — making traditional antivirus detection unlikely.

The FBI recommends verifying all visitor credentials, disabling external drive permissions, enforcing phishing-resistant MFA, and training staff to authenticate IT requests before granting any access.

Source: Infosecurity Magazine

A maximum-severity vulnerability in Samba's printing subsystem — CVE-2026-4480, CVSS 10.0 — lets unauthenticated attackers run arbitrary commands on affected Linux and Unix systems. The flaw lives in the %J substitution parameter used in print commands, which passes client-controlled input directly into a shell without escaping special characters. Since many Samba setups allow guest print job submissions by default, no credentials are needed to exploit it.

Patches are out: Samba versions 4.22.10, 4.23.8, and 4.24.3 fix the issue. Systems using printing = cups or iprint aren't affected. If patching isn't immediate, removing %J from your smb.conf print command is the safest workaround.

Source: Cybersecurity News

A critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980) has been exploited by at least two hacker groups to quietly poison over 700 websites with ClickFix malware. First disclosed February 19, 2026, the flaw lets unauthenticated attackers steal Admin API keys and rewrite article content at scale.

Researchers at Qianxin XLab spotted the campaign on May 7. By May 17, compromised sites included Harvard, Oxford, and Auburn University, spanning blockchain, fintech, and media industries. Visitors saw nothing suspicious — malicious JavaScript hid at the bottom of articles, eventually serving a fake Cloudflare verification page that tricked users into running malware themselves.

Ghost CMS admins should patch immediately, rotate all credentials, and audit access logs.

Source: Cyber Security News

Security firm Token Security discovered five chained vulnerabilities in Zapier that, together, could have let an attacker take over millions of user accounts — starting with nothing more than a free account.

The attack path ran from a code-writing feature through discarded credentials, into an internal storage system holding over 1,100 private software images. One image contained a publishing key for code running inside every logged-in user's browser — meaning a bad actor could have quietly hijacked automations across Zapier's 8,000+ integrations.

Researchers reported the flaws in February. Zapier triaged within four days, patched within three weeks, and paid the $3,000 maximum bounty. No exploitation was detected.

Source: CyberScoop

Security researchers at Adversa AI have uncovered a novel attack technique called SymJack that weaponizes AI coding agents to silently inject malicious code into software pipelines. The attack works by disguising a malicious symlink as an innocuous file, tricking developers into approving a simple copy command that secretly registers a rogue MCP server in the agent's configuration. On the next restart, the attacker's code runs unsandboxed — capable of stealing SSH keys, cloud tokens, and browser sessions.

Adversa tested SymJack across five major coding agents — Claude Code, Gemini CLI, Cursor, Grok Build, and GitHub Copilot CLI — and it worked on all of them. While most vendors dismissed the report, Anthropic quietly hardened Claude Code to resolve symlinks before requesting user approval. The attack isn't a software bug; it exploits developer trust in automation itself.

Source: SecurityWeek

Notepad++ has patched three security vulnerabilities in version v8.9.6.1, released May 26, 2026 — two of them critical. The worst, CVE-2026-48778, lets attackers plant a malicious executable path inside Notepad++'s config.xml file. When a user opens a folder via the command line menu, Windows runs the attacker's program instead. No validation, no warning.

A second critical flaw, CVE-2026-48800, works the same way but targets shortcuts.xml. Attack paths include modifying local config files, poisoning cloud-synced settings, or social engineering via archive extraction.

Anyone running v8.9.6 or earlier should update immediately from the official releases page.

Source: Cybersecurity News

Four widely-used Laravel localization packages were compromised in a supply chain attack starting May 22. Hackers rewrote Git tags across over 700 historical versions of laravel-lang/lang, http-statuses, attributes, and actions — without ever touching the official repos. Instead, they pointed tags to commits in a malicious fork they controlled.

The malware connected to a C&C server to deploy a PHP credential stealer targeting AWS, GCP, Azure keys, SSH private keys, Kubernetes tokens, browser passwords, crypto wallets, and more — across Windows, Linux, and macOS.

Any system that installed or updated these packages should be treated as compromised, and all secrets rotated immediately.

Source: SecurityWeek

A zero-day flaw in KnowledgeDeliver LMS (CVE-2026-5426) is being actively exploited to deploy BLUEBEAM, an in-memory web shell that leaves almost no forensic trace. Mandiant linked the attacks to a late-2025 breach, finding that hardcoded ASP.NET machine keys shared across customer installations let attackers forge malicious ViewState payloads and achieve remote code execution without authentication.

Once inside, attackers weakened file permissions, tampered with JavaScript files to push fake security alerts, and infected users with a targeted Cobalt Strike Beacon. The fix is straightforward but urgent: rotate machine keys to unique values per deployment immediately.

Source: Cybersecurity News

More than 5,500 GitHub repositories were infected with malware on May 18, 2026, in a supply chain attack called Megalodon. Attackers pushed 5,718 malicious commits across a six-hour window using two email addresses, injecting rogue GitHub Actions workflows designed to steal credentials, AWS keys, SSH private keys, API tokens, and dozens of other secrets from CI environments.

The attack was discovered after compromised versions of the Tiledesk npm package were published May 19–21. The maintainer unknowingly published from a poisoned source — the attacker never touched the npm account, only the GitHub repo. A dormant backdoor was also planted, triggerable later via the GitHub API using stolen tokens.

Source: SecurityWeek