Ticker feed
CISA added a high-severity SolarWinds Serv-U flaw, CVE-2026-28318 (CVSS 7.5), to its Known Exploited Vulnerabilities catalog on June 5, 2026 — the same day SolarWinds shipped the fix — with a remediation deadline of June 19 for federal agencies.
The vulnerability lets unauthenticated attackers crash Serv-U file transfer software remotely by sending a malicious POST request with a Content-Encoding: deflate header — no credentials required. That zero-privilege, network-accessible attack path makes it especially dangerous for organizations with Serv-U exposed to the internet. SolarWinds' own advisory made no mention of exploitation, and it's still unclear whether the flaw was used as a zero-day.
The fix is Serv-U 15.5.4 Hotfix 1, and the affected releases — 15.4.2, 15.5 and 15.5.1 — have already reached end of life, so some organisations will need an upgrade rather than a patch. Restrict Serv-U exposure behind a firewall or VPN, and monitor logs for suspicious POST requests.
Source: Cybersecurity News
CISA added a high-severity SolarWinds Serv-U flaw, CVE-2026-28318 (CVSS 7.5), to its Known Exploited Vulnerabilities catalog on June 5, 2026 — the same day SolarWinds shipped the fix — with a remediation deadline of June 19 for federal agencies.
The vulnerability lets unauthenticated attackers crash Serv-U file transfer software remotely by sending a malicious POST request with a Content-Encoding: deflate header — no credentials required. That zero-privilege, network-accessible attack path makes it especially dangerous for organizations with Serv-U exposed to the internet. SolarWinds' own advisory made no mention of exploitation, and it's still unclear whether the flaw was used as a zero-day.
The fix is Serv-U 15.5.4 Hotfix 1, and the affected releases — 15.4.2, 15.5 and 15.5.1 — have already reached end of life, so some organisations will need an upgrade rather than a patch. Restrict Serv-U exposure behind a firewall or VPN, and monitor logs for suspicious POST requests.
Source: Cybersecurity News
A critical vulnerability in the Everest Forms Pro WordPress plugin is under active attack, with Wordfence blocking over 29,300 exploitation attempts since April 13, 2026 — 17,900 of them on a single day, May 16. The flaw, CVE-2026-3300, scores a near-perfect 9.8 on the CVSS scale and affects all versions up to 1.9.12.
The bug lives in the plugin's "Complex Calculation" feature, where user inputs are concatenated into PHP code and passed to eval() without the single quotes being escaped. Attackers don't need credentials — they just submit a crafted form field. Sites that don't use Complex Calculation aren't exposed.
Most attacks aim to create rogue admin accounts via WordPress's own wp_insert_user() function, with one common payload creating a user named "diksimarina" — the foothold for uploading webshells and planting backdoors.
A patch (version 1.9.13) has been available since March 18. Update immediately.
Source: Cybersecurity News
A critical vulnerability in the Everest Forms Pro WordPress plugin is under active attack, with Wordfence blocking over 29,300 exploitation attempts since April 13, 2026 — 17,900 of them on a single day, May 16. The flaw, CVE-2026-3300, scores a near-perfect 9.8 on the CVSS scale and affects all versions up to 1.9.12.
The bug lives in the plugin's "Complex Calculation" feature, where user inputs are concatenated into PHP code and passed to eval() without the single quotes being escaped. Attackers don't need credentials — they just submit a crafted form field. Sites that don't use Complex Calculation aren't exposed.
Most attacks aim to create rogue admin accounts via WordPress's own wp_insert_user() function, with one common payload creating a user named "diksimarina" — the foothold for uploading webshells and planting backdoors.
A patch (version 1.9.13) has been available since March 18. Update immediately.
Source: Cybersecurity News
A debug setting accidentally left enabled in production releases of six Microsoft Android apps — Word, Excel, PowerPoint, OneNote, Loop and 365 Copilot — exposed billions of users to potential account takeover. Researchers at Enclave, who named the issue FlagLeft, found the flaw disabled a security check that prevents untrusted apps from grabbing Microsoft authentication tokens.
Any malicious Android app could silently request and receive login tokens, giving attackers access to emails, Teams messages and files. Worse, the stolen tokens were long-lived FOCI (Family of Client IDs) tokens that can be refreshed indefinitely and look identical to legitimate activity in logs, making detection nearly impossible.
Microsoft has patched all six apps, assigning CVE-2026-41100, CVE-2026-41101, CVE-2026-41102 and CVE-2026-42832. There's no confirmation the flaw was exploited before it was found — but if you have any of these apps installed, update them now.
Source: Dark Reading
A debug setting accidentally left enabled in production releases of six Microsoft Android apps — Word, Excel, PowerPoint, OneNote, Loop and 365 Copilot — exposed billions of users to potential account takeover. Researchers at Enclave, who named the issue FlagLeft, found the flaw disabled a security check that prevents untrusted apps from grabbing Microsoft authentication tokens.
Any malicious Android app could silently request and receive login tokens, giving attackers access to emails, Teams messages and files. Worse, the stolen tokens were long-lived FOCI (Family of Client IDs) tokens that can be refreshed indefinitely and look identical to legitimate activity in logs, making detection nearly impossible.
Microsoft has patched all six apps, assigning CVE-2026-41100, CVE-2026-41101, CVE-2026-41102 and CVE-2026-42832. There's no confirmation the flaw was exploited before it was found — but if you have any of these apps installed, update them now.
Source: Dark Reading
Bedfordshire Hospitals NHS Foundation Trust has revealed that personal data belonging to 32,927 patients was stolen and published online following the June 2024 ransomware attack on pathology supplier Synnovis. The stolen files cover patients who had laboratory or diagnostic results between 2011 and 2020, and were later posted on online forums.
The data was fragmented, incomplete and scattered across multiple documents, and it took specialists over a year to piece together — Synnovis only notified the trust in October 2025. Exposed information may include names, dates of birth, patient and NHS numbers, postcodes and test results.
The trust says there's no evidence the data has been misused. It has reviewed the material with forensic advisers, notified the Information Commissioner's Office and NHS England, and tightened its oversight of suppliers. Patients are urged not to click links or attachments in unexpected messages, and to be wary of calls or emails asking for personal information.
Source: BBC News
Bedfordshire Hospitals NHS Foundation Trust has revealed that personal data belonging to 32,927 patients was stolen and published online following the June 2024 ransomware attack on pathology supplier Synnovis. The stolen files cover patients who had laboratory or diagnostic results between 2011 and 2020, and were later posted on online forums.
The data was fragmented, incomplete and scattered across multiple documents, and it took specialists over a year to piece together — Synnovis only notified the trust in October 2025. Exposed information may include names, dates of birth, patient and NHS numbers, postcodes and test results.
The trust says there's no evidence the data has been misused. It has reviewed the material with forensic advisers, notified the Information Commissioner's Office and NHS England, and tightened its oversight of suppliers. Patients are urged not to click links or attachments in unexpected messages, and to be wary of calls or emails asking for personal information.
Source: BBC News
Kali365, a phishing-as-a-service platform the FBI warned about on 21 May 2026, has grown far more dangerous. Originally built to bypass MFA on Microsoft 365 accounts, it now impersonates AWS, Okta SSO, Xerox DocuShare, Germany's GMX, and a range of Russian platforms — Mail.ru, Yandex Disk, Odnoklassniki and MAX Messenger.
MAX Messenger is a Russian state-backed app the government has promoted as the country's national messaging service, reporting over 110 million registered users and more than 80 million daily active users as of April 2026.
Arctic Wolf researchers mapped 126 distinct malicious hosts running the same kit between 6 and 27 May. Kali365 abuses OAuth 2.0 device authorization: the attacker starts the login, then tricks the victim into approving it — so MFA is satisfied by the legitimate user and never blocks the theft.
At least 14 device code phishing kits are now circulating, including Tycoon2FA, Venom and CYB3R, and the threat is accelerating.
Defenders should restrict or disable device code flow via Conditional Access where it isn't needed, and block authentication-transfer policies. Arctic Wolf flags panel[.]securehubcloud[.]com as high-confidence C2, recommends blocking *.attachedfile[.]com as a unit, and identifies the kit by its "Preparing your secure document…" page.
Source: Dark Reading
Kali365, a phishing-as-a-service platform the FBI warned about on 21 May 2026, has grown far more dangerous. Originally built to bypass MFA on Microsoft 365 accounts, it now impersonates AWS, Okta SSO, Xerox DocuShare, Germany's GMX, and a range of Russian platforms — Mail.ru, Yandex Disk, Odnoklassniki and MAX Messenger.
MAX Messenger is a Russian state-backed app the government has promoted as the country's national messaging service, reporting over 110 million registered users and more than 80 million daily active users as of April 2026.
Arctic Wolf researchers mapped 126 distinct malicious hosts running the same kit between 6 and 27 May. Kali365 abuses OAuth 2.0 device authorization: the attacker starts the login, then tricks the victim into approving it — so MFA is satisfied by the legitimate user and never blocks the theft.
At least 14 device code phishing kits are now circulating, including Tycoon2FA, Venom and CYB3R, and the threat is accelerating.
Defenders should restrict or disable device code flow via Conditional Access where it isn't needed, and block authentication-transfer policies. Arctic Wolf flags panel[.]securehubcloud[.]com as high-confidence C2, recommends blocking *.attachedfile[.]com as a unit, and identifies the kit by its "Preparing your secure document…" page.
Source: Dark Reading
Attackers published malicious versions of 32 packages in Red Hat's @redhat-cloud-services npm scope on Monday, June 1 — all within 72 seconds, pointing to automation. Researchers traced the entry point to a compromised Red Hat employee GitHub account, with GitHub Actions OIDC credentials used to publish. The affected packages have drawn nearly 10 million downloads over their lifetime.
The malware is a variant of the "Mini Shai-Hulud" worm, carrying the internal name "Miasma: The Spreading Blight." It harvests GitHub secrets, npm tokens, cloud credentials, SSH keys, Kubernetes and Vault material and more, then exfiltrates to attacker-controlled servers. At least 210 repositories containing stolen credentials have been identified.
Attribution is open. TeamPCP released this worm's source code publicly the previous month, so researchers say it could be TeamPCP or a copycat.
Critically, the payload ran from a preinstall hook — it executed during npm install, before the package was ever imported. Whether your code called the library is irrelevant.
Red Hat has published clean versions of all 32 packages and removed the malicious ones. It says the packages were limited to internal development, never published for customer consumption, and that it found no impact to customer or partner environments.
If you installed a compromised version, treat the environment as breached. Rotate every reachable credential, check lockfiles and CI logs for the affected versions, and rebuild from clean environments rather than reusing runners, workspaces or cached node_modules.
Source: SecurityWeek
Attackers published malicious versions of 32 packages in Red Hat's @redhat-cloud-services npm scope on Monday, June 1 — all within 72 seconds, pointing to automation. Researchers traced the entry point to a compromised Red Hat employee GitHub account, with GitHub Actions OIDC credentials used to publish. The affected packages have drawn nearly 10 million downloads over their lifetime.
The malware is a variant of the "Mini Shai-Hulud" worm, carrying the internal name "Miasma: The Spreading Blight." It harvests GitHub secrets, npm tokens, cloud credentials, SSH keys, Kubernetes and Vault material and more, then exfiltrates to attacker-controlled servers. At least 210 repositories containing stolen credentials have been identified.
Attribution is open. TeamPCP released this worm's source code publicly the previous month, so researchers say it could be TeamPCP or a copycat.
Critically, the payload ran from a preinstall hook — it executed during npm install, before the package was ever imported. Whether your code called the library is irrelevant.
Red Hat has published clean versions of all 32 packages and removed the malicious ones. It says the packages were limited to internal development, never published for customer consumption, and that it found no impact to customer or partner environments.
If you installed a compromised version, treat the environment as breached. Rotate every reachable credential, check lockfiles and CI logs for the affected versions, and rebuild from clean environments rather than reusing runners, workspaces or cached node_modules.
Source: SecurityWeek
A security flaw in Palo Alto Networks' PAN-OS GlobalProtect VPN, tracked as CVE-2026-0257, is being actively exploited — and organizations running unpatched systems are at real risk. Attackers are forging authentication cookies to impersonate legitimate users and gain VPN access without valid credentials.
Palo Alto published its advisory on May 13, but Rapid7 confirmed successful exploitation across multiple customer environments as early as May 17 — including cookie authentication to the local admin account. A second wave on May 21 established working VPN tunnels with internal network access. CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 29.
Palo Alto revised the CVSS score upward from 4.7 to 7.8, moving it from medium to high severity. Rapid7 argues it warrants critical-level urgency regardless — an unauthenticated admin VPN session into your internal network is serious.
Exposure is configuration-dependent: exploitation needs the authentication override feature enabled, with cookie encryption tied to a certificate an attacker can derive the public key from. If you can't patch immediately, disable authentication override or issue a dedicated certificate for it. Fixes span 10.2, 11.1, 11.2, 12.1 and Prisma Access — check the advisory for your branch.
Source: Dark Reading
A security flaw in Palo Alto Networks' PAN-OS GlobalProtect VPN, tracked as CVE-2026-0257, is being actively exploited — and organizations running unpatched systems are at real risk. Attackers are forging authentication cookies to impersonate legitimate users and gain VPN access without valid credentials.
Palo Alto published its advisory on May 13, but Rapid7 confirmed successful exploitation across multiple customer environments as early as May 17 — including cookie authentication to the local admin account. A second wave on May 21 established working VPN tunnels with internal network access. CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 29.
Palo Alto revised the CVSS score upward from 4.7 to 7.8, moving it from medium to high severity. Rapid7 argues it warrants critical-level urgency regardless — an unauthenticated admin VPN session into your internal network is serious.
Exposure is configuration-dependent: exploitation needs the authentication override feature enabled, with cookie encryption tied to a certificate an attacker can derive the public key from. If you can't patch immediately, disable authentication override or issue a dedicated certificate for it. Fixes span 10.2, 11.1, 11.2, 12.1 and Prisma Access — check the advisory for your branch.
Source: Dark Reading
A Russian state-linked worm tied to the FSB's Gamaredon group is targeting Ukrainian government, military, and critical infrastructure — and it's remarkably hard to detect. Security firm Sekoia reconstructed the active infection chain behind a dozen detections it logged in January 2026.
It starts with a booby-trapped xHTML file. A malicious RAR archive then exploits a WinRAR path traversal flaw, CVE-2025-8088 (CVSS 8.8 High, 8.4 under v4.0), to drop a hidden HTA file into the Startup folder that runs on next login. WinRAR patched this in 7.13 on July 30, 2025, and CISA flagged it as actively exploited weeks later.
The worm, dubbed GammaWorm, hides its modules in NTFS Alternate Data Streams — a native Windows feature that leaves no visible trace in directory listings. It spreads via USB drives and network shares, pulls C2 addresses from Telegram and Cloudflare, and hands off to GammaSteel, a PowerShell stealer that exfiltrates files from local and network drives.
Sekoia recommends a full system wipe for infected machines: the malware constantly pulls fresh payloads from those dead drops, so cleaning attempts usually end with a fallback restoring it. Update WinRAR for Windows to 7.13 or later — anything up to 7.12 is still exposed.
Source: Infosecurity Magazine
A Russian state-linked worm tied to the FSB's Gamaredon group is targeting Ukrainian government, military, and critical infrastructure — and it's remarkably hard to detect. Security firm Sekoia reconstructed the active infection chain behind a dozen detections it logged in January 2026.
It starts with a booby-trapped xHTML file. A malicious RAR archive then exploits a WinRAR path traversal flaw, CVE-2025-8088 (CVSS 8.8 High, 8.4 under v4.0), to drop a hidden HTA file into the Startup folder that runs on next login. WinRAR patched this in 7.13 on July 30, 2025, and CISA flagged it as actively exploited weeks later.
The worm, dubbed GammaWorm, hides its modules in NTFS Alternate Data Streams — a native Windows feature that leaves no visible trace in directory listings. It spreads via USB drives and network shares, pulls C2 addresses from Telegram and Cloudflare, and hands off to GammaSteel, a PowerShell stealer that exfiltrates files from local and network drives.
Sekoia recommends a full system wipe for infected machines: the malware constantly pulls fresh payloads from those dead drops, so cleaning attempts usually end with a fallback restoring it. Update WinRAR for Windows to 7.13 or later — anything up to 7.12 is still exposed.
Source: Infosecurity Magazine
Belgium's Centre for Cybersecurity says a critical Windows Netlogon flaw (CVE-2026-41089, CVSS 9.8) is being actively exploited in the wild, putting unpatched domain controllers at serious risk. Microsoft says it has found no evidence for the claim and didn't rate the bug likely to be exploited — but it still tells customers to patch.
The flaw is a stack-based buffer overflow. Attackers need only network access to trigger it — no authentication, no user interaction — allowing full SYSTEM-level code execution and potential domain takeover.
Microsoft patched it on May 12, alongside 15 other critical flaws. Every supported Server branch from 2016 to 2025 has a fixed build; Server 2012 and 2012 R2 are affected too and need Extended Security Updates, and Acros Security has micropatches for unsupported systems.
The CCB says patch as quickly as possible. Prioritise domain controllers, tighten network segmentation, and monitor for Netlogon crashes, anomalous authentication and unexpected admin account creation.
Source: Cybersecurity News
Belgium's Centre for Cybersecurity says a critical Windows Netlogon flaw (CVE-2026-41089, CVSS 9.8) is being actively exploited in the wild, putting unpatched domain controllers at serious risk. Microsoft says it has found no evidence for the claim and didn't rate the bug likely to be exploited — but it still tells customers to patch.
The flaw is a stack-based buffer overflow. Attackers need only network access to trigger it — no authentication, no user interaction — allowing full SYSTEM-level code execution and potential domain takeover.
Microsoft patched it on May 12, alongside 15 other critical flaws. Every supported Server branch from 2016 to 2025 has a fixed build; Server 2012 and 2012 R2 are affected too and need Extended Security Updates, and Acros Security has micropatches for unsupported systems.
The CCB says patch as quickly as possible. Prioritise domain controllers, tighten network segmentation, and monitor for Netlogon crashes, anomalous authentication and unexpected admin account creation.
Source: Cybersecurity News
A cybercriminal group called Silent Ransom Group (SRG), also tracked as Luna Moth, has escalated its attacks on US law firms by impersonating IT staff — both over the phone and in person. It has hit law firms since spring 2023, and insurance, finance and healthcare firms too, using callback scams to trick employees into granting remote desktop access.
In a May 26 FLASH alert, the FBI warns that when remote access fails, SRG sends an actor physically to the victim's office, convincing staff to plug in an external drive under the guise of IT maintenance. Data is then quietly exfiltrated using legitimate tools like WinSCP or Rclone — making traditional antivirus detection unlikely.
SRG then threatens to sell or post the stolen files, and calls the firm's own employees and clients to pressure it into paying.
The FBI recommends verifying visitor credentials and taking copies of their ID, disabling external drive permissions, blocking port 22 where possible, enforcing phishing-resistant MFA, and training staff to authenticate IT requests before granting any access.
Source: Infosecurity Magazine
A cybercriminal group called Silent Ransom Group (SRG), also tracked as Luna Moth, has escalated its attacks on US law firms by impersonating IT staff — both over the phone and in person. It has hit law firms since spring 2023, and insurance, finance and healthcare firms too, using callback scams to trick employees into granting remote desktop access.
In a May 26 FLASH alert, the FBI warns that when remote access fails, SRG sends an actor physically to the victim's office, convincing staff to plug in an external drive under the guise of IT maintenance. Data is then quietly exfiltrated using legitimate tools like WinSCP or Rclone — making traditional antivirus detection unlikely.
SRG then threatens to sell or post the stolen files, and calls the firm's own employees and clients to pressure it into paying.
The FBI recommends verifying visitor credentials and taking copies of their ID, disabling external drive permissions, blocking port 22 where possible, enforcing phishing-resistant MFA, and training staff to authenticate IT requests before granting any access.
Source: Infosecurity Magazine
