Intelligence · Updated daily

Security Intelligence

AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.

RSS feedCVE index906 entries

Vulnerabilities Malware Campaigns Supply Chain Policy Tools

Page 19 of 37

451–475 of 906

criticalVulnerabilityResolved

Exim BDAT use-after-free in GnuTLS builds creates RCE window for mail infrastructure

CVE-2026-45185 is a use-after-free vulnerability in Exim's BDAT command handling that affects GnuTLS-compiled builds, enabling memory corruption and potential code execution on mail servers. Given Exim's deployment across internet-facing mail infrastructure, this poses significant risk to email delivery chains.

CVE-2026-45185

13 May 2026Exim MTA (GnuTLS builds), Mail infrastructure running affected configurations

highSupply ChainResolved

Foxconn North American Operations Targeted: Supply Chain Resilience Under Pressure

Foxconn confirmed a cyberattack affecting multiple North American manufacturing facilities across six US states and Mexico, but has withheld specifics on scope and impact. The incident threatens critical supply chains for consumer electronics and automotive components.

13 May 2026Foxconn, Electronics manufacturing supply chain

highCampaignResolved

Congressional Pressure on Instructure After Repeated ShinyHunters Breaches of Canvas Learning Platform

The U.S. House Committee on Homeland Security has demanded testimony from Instructure executives regarding two separate cyberattacks by the ShinyHunters extortion group against Canvas, which exposed student data and disrupted educational institutions during critical exam periods.

13 May 2026Instructure Canvas

criticalVulnerabilityResolved

Supply Chain Compromise via GitHub Actions OIDC Token Extraction and Cache Poisoning

Attackers exploited a pull_request_target misconfiguration combined with GitHub Actions cache poisoning and in-memory OIDC token extraction to publish 84 malicious npm package versions under a trusted publisher identity, delivering credential-harvesting malware at install time.

CVE-2026-45321

12 May 2026@tanstack/* (42 packages, 84 malicious versions)

highCampaignResolved

Adversaries scaling AI-augmented exploitation and access operations at industrial capacity

Google Threat Intelligence Group reports that adversaries have progressed from experimental AI use to industrial-scale deployment of generative models for vulnerability exploitation, reconnaissance, and initial access. This represents a qualitative shift in threat capability and operational maturity.

12 May 2026Enterprise networks, Cloud infrastructure, AI/ML services

informationalToolResolved

Frame Security raises $50M for security awareness platform, signalling investor confidence in human-risk mitigation

Frame Security, a security awareness and training platform, has emerged from stealth with $50M in funding from prominent venture firms. This reflects sustained investor interest in addressing human-centric security risks rather than purely technical vulnerabilities.

12 May 2026

criticalSupply ChainResolved

TeamPCP Supply Chain Attack Targets Checkmarx Jenkins Plugin: Second Compromise in Weeks

Threat actor TeamPCP compromised the Checkmarx Jenkins AST plugin on the Jenkins Marketplace, following their earlier attack on Checkmarx's KICS tool. Affected users must immediately downgrade to version 2.0.13-829.vc72453fa_1c16 or earlier to avoid potential system compromise.

12 May 2026Checkmarx Jenkins AST Plugin, Checkmarx, Jenkins

mediumPolicyResolved

Texas antitrust action targets Netflix data collection and default autoplay on children's profiles

Texas is suing Netflix for alleged unauthorised data collection and sharing practices, characterising the conduct as 'surveillance machinery'. The suit also seeks to restrict autoplay defaults on children's accounts, signalling regulatory focus on data practices and child safety.

12 May 2026Netflix

mediumPolicyResolved

GM's $12.75M CCPA Settlement Exposes Automaker Data Monetisation Practices

General Motors agreed to a $12.75 million settlement with California over alleged CCPA violations stemming from the sale of driver data without proper consent. The case highlights how automotive manufacturers are monetising connected vehicle data as a revenue stream while often failing to obtain explicit consumer permission.

12 May 2026General Motors

highCampaignResolved

German law enforcement dismantles Crimenetwork marketplace reboot, arrests operator after €3.6M revenue generation

German police shut down a relaunched version of the Crimenetwork darknet marketplace and arrested its administrator. The operation demonstrates sustained law enforcement capability against criminal infrastructure despite repeated takedown and relaunch cycles.

11 May 2026Crimenetwork marketplace users and operators

informationalToolResolved

YARA-X 1.16.0 routine maintenance release with incremental improvements

YARA-X, the Rust-based malware analysis pattern matching engine, released version 1.16.0 with 4 improvements and 4 bug fixes. This is routine maintenance with no security implications identified.

11 May 2026YARA-X

highCampaignResolved

Sustained Multi-Sector Phishing Campaign Targets 500+ Organisations Across Critical Infrastructure

A years-long phishing campaign has compromised over 500 organisations across aviation, energy, infrastructure, logistics, public administration, and technology sectors. The extended campaign duration and cross-sector targeting suggest either a sophisticated threat actor or multiple coordinated groups with sustained operational capability.

11 May 2026Aviation sector organisations, Critical infrastructure operators, Energy sector organisations +3

criticalVulnerabilityResolved

Ollama Memory Disclosure via Out-of-Bounds Read Affects 300k+ Deployments

CVE-2026-7482, a critical out-of-bounds read flaw in Ollama, permits unauthenticated remote attackers to extract entire process memory from affected instances. With an estimated 300,000+ servers exposed globally, this represents immediate risk to organisations running unpatched deployments.

CVE-2026-7482

11 May 2026Ollama

highCampaignResolved

Malvertising campaign exploits Google Ads and Claude.ai to deliver macOS malware via search hijacking

Attackers are running a malvertising campaign using Google Ads and Claude.ai shared chats to redirect users searching for Claude downloads to malware installers. The campaign exploits search engine placement and trusted service reputation to compromise macOS systems.

11 May 2026macOS, Google Ads, Claude.ai +1

criticalVulnerabilityResolved

Unauthenticated NEF PFD Management API—Authentication Bypass in free5GC

free5GC's NEF service exposes the nnef-pfdmanagement API without OAuth2 validation, allowing unauthenticated attackers to read sensitive PFD application data and manipulate subscriptions. This PoC confirms a deployment-wide authentication bypass in production-declared routes.

CVE-2026-44330

10 May 2026free5GC/nef:v4.2.0, free5GC/nef:v4.2.1

criticalVulnerabilityResolved

Snipe-IT API Authorization Bypass Enables Unauthenticated File Upload & Code Execution

Snipe-IT versions ≤8.4.0 suffer from an authorization bypass in the file upload API endpoint that allows authenticated users with only 'view' permissions to upload arbitrary files, leading to remote code execution. Defenders must immediately patch or restrict API access.

CVE-2026-37709

10 May 2026grokability/snipe-it (≤8.4.0)

criticalSupply ChainResolved

Canvas LMS Supply Chain Extortion: 275M Student Records at Risk Across 9,000 Institutions

Cybercriminals breached Canvas, a learning management system serving 9,000 educational institutions, and defaced login pages with ransom demands whilst threatening to leak records for 275 million students and faculty. The attack represents a supply-chain compromise of education infrastructure affecting operational continuity at scale.

10 May 2026Canvas LMS, Educational institutions (schools, colleges, universities)

highCampaignResolved

Multiple Emerging Threats Spanning Infrastructure, Linux, and Mobile Attack Vectors

SecurityWeek reports on three concurrent threat developments: a train system attacker's arrest, PamDOORa Linux backdoor discovery, and novel mobile malware abusing Windows Phone Link for OTP theft, alongside policy moves on patch cycle acceleration and espionage targeting drone manufacturers.

10 May 2026Linux systems, Windows Phone Link, Critical infrastructure (rail) +1

highVulnerabilityResolved

cPanel/WHM Patches Three Privilege Escalation and RCE Vulnerabilities Affecting Hosting Infrastructure

cPanel has released patches for three vulnerabilities including insufficient input validation in feature file handling and unspecified code execution issues. These affect a critical infrastructure component used by hosting providers and require immediate patching.

CVE-2026-29201

10 May 2026cPanel, Web Host Manager (WHM)

mediumPolicyResolved

GM's $12M CCPA Settlement Signals Enforcement Escalation on Automotive Data Monetisation

General Motors agreed to pay $12 million to California, marking the largest CCPA fine in over five years, for alleged privacy violations involving driver data. This settlement demonstrates regulatory willingness to impose substantial penalties on automotive manufacturers for data handling practices.

10 May 2026General Motors

criticalSupply ChainResolved

JDownloader Supply Chain Compromise Distributes Python RAT via Official Website

Attackers compromised the JDownloader website and replaced legitimate installers with malicious builds containing a Python-based remote access trojan, affecting both Windows and Linux users downloading from the official source.

10 May 2026JDownloader, Windows users, Linux users

criticalVulnerabilityResolved

Sandbox Escape via Mutable Proxies in vm2

A critical vulnerability in vm2 allows attackers to mutate host prototypes, enabling sandbox escapes. The PoC highlights the risk of untrusted code accessing and modifying core JavaScript objects.

CVE-2026-44005

7 May 2026vm2

criticalVulnerabilityResolved

NodeVM Builtin Allowlist Bypass via Module Loading

The `module` builtin in NodeVM allows bypassing the built-in allowlist, enabling sandbox escape and remote code execution.

CVE-2026-43999

7 May 2026NodeVM (vm2) versions <9.0.1

criticalVulnerabilityResolved

vm2 Sandbox Escape Exposes Node.js Applications to Direct Host Compromise

A critical sandbox escape vulnerability in vm2 allows attackers to execute arbitrary code directly on the host system, potentially compromising any Node.js application using vm2 for code isolation.

7 May 2026vm2 (Node.js library), Applications using vm2 for code isolation

highCampaignResolved

Google Ads Hijacked for ManageWP Phishing: Paid Search Results Target WordPress Administrators

Threat actors are purchasing Google Ads to rank malicious phishing pages for ManageWP login terms, intercepting administrators searching for legitimate access. This exploits Google's ad system to deliver credential theft at scale against a platform managing thousands of WordPress deployments.

7 May 2026ManageWP, GoDaddy, WordPress administrators