Intelligence · Updated daily

Security Intelligence

AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.

RSS feedCVE index906 entries

Vulnerabilities Malware Campaigns Supply Chain Policy Tools

Page 16 of 37

376–400 of 906

highCampaignContained

First VPN dismantled in Operation Saffron: law enforcement disrupts infrastructure used by 25 ransomware groups

European and North American authorities have shut down First VPN, a criminal VPN service that facilitated ransomware attacks, data theft, and DDoS operations for approximately 25 ransomware groups. The coordinated takedown represents a significant disruption to organised cybercrime infrastructure, though similar services remain operational.

23 May 2026First VPN Service, 25 ransomware groups (unnamed)

highToolActive

Kali365 Phishing-as-a-Service Exploits OAuth Token Capture Against Microsoft 365

The FBI has warned of Kali365, a Telegram-based phishing-as-a-service platform that captures legitimate OAuth tokens to gain unauthorised access to Microsoft 365 environments. The service has been actively used in campaigns since at least April 2024.

23 May 2026Microsoft 365

highSupply ChainContained

Dutch law enforcement dismantles bulletproof hosting infrastructure supporting organised cyber operations

Dutch financial crime authorities arrested two operators and seized 800 servers from a web hosting company that provided infrastructure for coordinated cyberattacks, interference campaigns, and disinformation operations. This represents a significant disruption to a criminal supply chain enabling multiple threat actors.

23 May 2026Unnamed web hosting company, Multiple threat actors relying on compromised infrastructure

criticalVulnerabilityActive

Twig Template Engine: Single Quote Escape Bypass in PHP Code Generation

A missing single-quote escape in Twig's Compiler::string() method allows attackers to break out of PHP string literals via malicious {% use %} template names, achieving unauthenticated remote code execution even in sandboxed environments.

CVE-2026-46633

22 May 2026Twig/twig

criticalVulnerabilityActive

BoxLite Capability-Based Permission Bypass Enabling Read-Only Mount Remounting

BoxLite's read-only mount implementation relies on MS_RDONLY flag applied post-boot rather than kernel-level enforcement, allowing container processes with unrestricted capabilities to remount directories as read-write. This breaks sandbox isolation in scenarios where untrusted code accesses host credentials, configuration, and source code.

CVE-2026-46695

22 May 2026BoxLite/BoxLite

highMalwareContained

Kimwolf IoT Botnet Operator Arrested: International Prosecution Marks Escalation in Law Enforcement Against DDoS-for-Hire Operators

Canadian authorities arrested a 23-year-old suspected operator of Kimwolf, an IoT botnet that compromised millions of devices for large-scale DDoS attacks. The arrest and cross-border charges signal coordinated enforcement against botnet operators who target journalists and security researchers.

22 May 2026Internet-of-Things devices (millions), Online services targeted by DDoS attacks, Media and security research organisations

criticalVulnerabilityActive

Cisco Secure Workload REST API Authentication Bypass Grants Unrestricted Admin Access

Insufficient validation in Cisco Secure Workload's REST APIs allows unauthenticated remote attackers to obtain Site Admin privileges. This represents a complete authentication bypass affecting a platform commonly used for workload security and compliance monitoring.

22 May 2026Cisco Secure Workload

criticalVulnerabilityEmerging

Cisco Secure Workload REST API Authentication Bypass Exposed Unauthenticated Data Access

Cisco patched a CVSS 10.0 flaw in Secure Workload REST API that permits unauthenticated remote attackers to access sensitive data through insufficient validation and authentication controls. Organisations running Secure Workload must patch immediately as the vulnerability requires no credentials or user interaction.

CVE-2026-20223

22 May 2026Cisco Secure Workload

informationalPolicyActive

CISA Opens Known Exploited Vulnerabilities Catalog to Community Submissions

CISA has introduced a nomination form allowing researchers, vendors, and industry partners to submit vulnerabilities for inclusion in its Known Exploited Vulnerabilities (KEV) catalog. This democratises the vulnerability reporting process and potentially accelerates the identification of actively exploited bugs.

22 May 2026CISA KEV Catalog

highVulnerabilityEmerging

Google's Accidental Disclosure of Unfixed Chromium Background Execution Vulnerability Risks Pre-Attack Intelligence Gathering

Google publicly exposed technical details of an unpatched Chromium vulnerability that permits JavaScript execution after browser closure, enabling remote code execution. Early disclosure before a fix is available significantly increases attacker adoption risk.

22 May 2026Chromium, Google Chrome

criticalVulnerabilityActive

Supply Chain Compromise: Malicious CAP.js Package Versions with Credential Harvesting

Compromised versions of @cap-js database packages (sqlite, postgres, db-service) published April 29, 2026 harvested credentials and attempted self-propagation. Any system with these versions installed must assume all local credentials (npm tokens, cloud keys, SSH keys, GitHub PATs) are compromised.

CVE-2026-46421

21 May 2026@cap-js/sqlite@2.2.2, @cap-js/postgres@2.2.2, @cap-js/db-service@2.10.1

highSupply ChainActive

npm Supply Chain Evolution: Multi-Stage Attacks and CI/CD Persistence Mechanisms Post-Shai Hulud

Unit 42 documents a shift in npm ecosystem attacks toward wormable malware, CI/CD persistence, and multi-stage payload delivery following the Shai Hulud incident. This represents an escalation in sophistication and suggests adversaries are moving beyond simple package hijacking to establish durable infrastructure.

21 May 2026npm ecosystem, Node.js projects, CI/CD pipelines

informationalToolEmerging

Quantum Bridge's Series A Signals Growing Capital Mobilisation for Post-Quantum Cryptography Infrastructure

Quantum Bridge secured $8 million in Series A funding for quantum-safe key distribution technology, bringing total capitalisation to $16 million. This reflects accelerating investment in post-quantum cryptography solutions ahead of anticipated quantum computing threats.

21 May 2026Quantum Bridge

criticalSupply ChainActive

Supply-chain compromise through VS Code extension: GitHub's internal repos breached via poisoned Nx Console

GitHub confirmed that a breach of its internal repositories resulted from a compromised employee device running a malicious version of the Nx Console VS Code extension, after the extension's developer account was itself compromised.

21 May 2026GitHub, Nx Console (nrwl.angular-console), Microsoft Visual Studio Code

mediumPolicyActive

FTC enforcement action reveals widespread non-compliance with Take It Down Act among major platforms

The FTC has issued warning letters to 12 major technology firms for allegedly failing to comply with the Take It Down Act, which requires platforms to provide accessible removal mechanisms for nonconsensual intimate imagery and process deletion requests within 48 hours. This represents the first significant enforcement action under the statute and signals regulatory intent to hold platforms accountable for abuse prevention infrastructure.

21 May 202612 major technology companies (specific names not provided in source)

highMalwareContained

Ukrainian law enforcement dismantles infostealer operation run by 18-year-old, recovering 28,000 compromised accounts

Ukrainian cyberpolice and U.S. law enforcement identified and disrupted an infostealer malware operation run by an 18-year-old from Odesa who had compromised approximately 28,000 user accounts from a California-based online retailer. The case demonstrates effective international law enforcement coordination against financially-motivated cybercriminals operating from Eastern Europe.

21 May 2026Unnamed California-based online retail store

criticalVulnerabilityActive

MCP Gateway Authentication Bypass via Header Injection and Hardcoded Router Key

An unauthenticated attacker can bypass JWT session validation and rewrite upstream authority headers by exploiting a shared header check with a predictable or hardcoded router key, allowing unauthorized access to backend services including external APIs.

20 May 2026MCP Gateway (ext_proc router component)

criticalVulnerabilityActive

Coder Azure Instance Identity PKCS#7 Signature Validation Bypass

Coder's Azure identity validation fails to verify PKCS#7 signatures, allowing attackers to forge identity claims and steal workspace agent tokens without authentication. This enables downstream credential theft including SSH keys, OAuth tokens, and workspace secrets.

CVE-2026-46354

20 May 2026Coder/coder

highVulnerabilityResolved

Multi-vendor patch advisory: Eight TP-Link flaws join Adobe, OpenVPN, and Norton VPN disclosures

Cisco Talos disclosed 11 vulnerabilities across four vendors, with eight in TP-Link networking equipment alongside single flaws in Adobe Photoshop, OpenVPN, and Norton VPN. All have been patched by vendors following Cisco's coordinated disclosure policy.

20 May 2026TP-Link, Adobe Photoshop, OpenVPN +1

highVulnerabilityActive

Vulnerability Exploitation Displaces Credential Abuse as Primary Breach Vector in 2026 , Patching Delays and AI-Accelerated Attacks Drive Shift

Verizon's 2026 Data Breach Investigations Report reveals vulnerability exploitation has become the leading breach vector, surpassing credential theft, driven by accelerated attack timelines, delayed patch deployment, and increasing ransomware sophistication.

20 May 2026Enterprise organisations across sectors

highSupply ChainActive

Grafana GitHub Breach: Source Code Exposure Limited to Development Environment, Supply Chain Risk Via npm Artifacts Remains

Grafana Labs suffered a GitHub environment breach on May 19, 2026, exposing source code and internal repositories but not production systems. The incident appears connected to a TanStack npm attack vector, raising concerns about compromised package distribution.

20 May 2026Grafana Labs, npm ecosystem consumers, TanStack users

criticalVulnerabilityActive

Unpatched Huawei Zero-Day Exploited in Luxembourg National Telecoms Outage

A zero-day vulnerability in Huawei equipment was exploited to take down Luxembourg's entire telecoms network in 2023. The flaw remains unpatched and unacknowledged by Huawei, creating ongoing risk for other operators using affected equipment.

20 May 2026Huawei telecoms equipment, Luxembourg national telecoms network

highSupply ChainEmerging

GitHub Internal Repository Breach Exposes Private Code: TeamPCP Claims Access to 4,000 Repositories

TeamPCP claims to have breached GitHub's internal repositories and accessed approximately 4,000 private code repositories. This represents a potential supply-chain risk if the breach is verified, as GitHub's internal systems are trusted infrastructure for the software development ecosystem.

20 May 2026GitHub, GitHub Enterprise users

criticalVulnerabilityActive

Arcane Backend: Broken Access Control on GitOps Credential Management Endpoints

Eight git repository management endpoints in Arcane lack admin role enforcement, allowing any authenticated user to read, modify, and exfiltrate stored Git credentials. This breaks the confidentiality and integrity of GitOps configurations and enables lateral movement via credential theft.

CVE-2026-45625

19 May 2026Arcane/Arcane Backend

criticalVulnerabilityActive

Supply Chain Compromise: Malicious Dropper in mistralai PyPI Package v2.4.6

The mistralai PyPI package v2.4.6 was compromised with a malicious dropper that executes on module import on Linux systems, bypassing the legitimate release pipeline via PyPI Trusted Publishing. This represents a high-impact supply chain attack affecting all systems that installed this specific version.

19 May 2026mistralai/client-python==2.4.6