threat-intel Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software Anthropic’s Project Glasswing has identified over 10,000 high-severity vulnerabilities in widely used software, primarily through its Claude Mythos Preview AI model. This initiative focuses on proactively identifying and… The Hacker News · May 23, 2026 Critical CVE-2026-5194aivulnerabilitypatching
supply-chain Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer A sophisticated supply chain attack targeting Laravel-Lang PHP packages has been identified, involving the mass modification of Git tags to inject a cross-platform credential-stealing framework. The attacker leveraged co… The Hacker News · May 23, 2026 Critical USsupply-chaincredential-stealingphp
vulnerability Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw impacting Drupal Core to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active… The Hacker News · May 23, 2026 Critical CVE-2026-9082
data-breach CISA Security Leak A contractor for CISA inadvertently exposed sensitive credentials and internal system details through a public GitHub repository. This included access to highly privileged AWS GovCloud accounts and information about CISA… Schneier on Security · May 22, 2026 Critical USgithubawscredentials
vulnerability Trend Micro warns of Apex One zero-day exploited in the wild Japanese cybersecurity software company Trend Micro has addressed an Apex One zero-day vulnerability exploited in attacks targeting Windows systems. BleepingComputer · May 22, 2026 Critical CVE-2026-34926CVE-2025-54948CVE-2022-40139
vulnerability Ubiquiti patches three max severity UniFi OS vulnerabilities Ubiquiti Networks has released security patches for three critical vulnerabilities within its UniFi OS operating system, addressing potential remote exploitation risks. These flaws include improper access control, path t… BleepingComputer · May 22, 2026 Critical CVE-2026-34908CVE-2026-34909CVE-2026-34910UScommand injectionaccess controlpath traversal
supply-chain Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows A sophisticated cyberattack, dubbed Megalodon, has targeted over 5,500 GitHub repositories using malicious CI/CD workflows. The attacker leveraged throwaway accounts and forged author identities to exfiltrate sensitive d… The Hacker News · May 22, 2026 Critical IRILci/cdgithubsupply chain
vulnerability TrendAI Patches Apex One Zero-Day Exploited in the Wild CVE-2026-34926 is a directory traversal flaw that can be exploited against the on-premise version of Apex One. The post TrendAI Patches Apex One Zero-Day Exploited in the Wild appeared first on SecurityWeek . SecurityWeek · May 22, 2026 Critical CVE-2026-34926
vulnerability Cisco Patches Critical Vulnerability in Secure Workload Insufficient validation and authentication in the Secure Workload’s REST APIs provide remote attackers with Site Admin privileges. The post Cisco Patches Critical Vulnerability in Secure Workload appeared first on Securi… SecurityWeek · May 21, 2026 Critical CVE-2026-20223
vulnerability ABB B&R PCs This CISA advisory details a vulnerability (CVE-2023-45229 through CVE-2023-45237) affecting ABB B&R PCs, specifically versions of the EDK2 Network Package. The vulnerability, a critical out-of-bounds read, allows for re… CISA Advisories · May 21, 2026 Critical CVE-2023-45229CVE-2023-45230CVE-2023-45231uefidhcpv6remote code execution
vulnerability Drupal Patches Highly Critical Vulnerability Exposing Websites to Hacking CVE-2026-9082 can be exploited without authentication for information disclosure, privilege escalation, and remote code execution. The post Drupal Patches Highly Critical Vulnerability Exposing Websites to Hacking appear… SecurityWeek · May 21, 2026 Critical CVE-2026-9082
threat-intel Patch Now: Critical Flaw in OT Robot OS Gives Attackers Control A critical command injection vulnerability (CVE-2026-8153) was discovered in the operating system of Universal Robots’ PolyScope 5 collaborative robots. This flaw allows unauthenticated attackers to gain remote access an… Dark Reading · May 20, 2026 Critical CVE-2026-8153DEcommand injectionotrobotics
supply-chain Typosquatting Is No Longer a User Problem. It's a Supply Chain Problem This article highlights a significant shift in cyberattack tactics, moving away from traditional phishing and towards a supply chain attack leveraging AI-generated lookalike domains and compromised third-party scripts. T… The Hacker News · May 20, 2026 Critical USsupply-chainbrowserai
vulnerability How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102) This article details a vulnerability (CVE-2026-3102) in ExifTool for macOS, allowing an attacker to execute arbitrary commands by injecting malicious data into the FileCreateDate metadata field. The vulnerability stems f… Securelist · May 20, 2026 Critical CVE-2026-3102CVE-2021-22204exiftoolmacosmetadata
vulnerability Max-severity flaw in ChromaDB for AI apps allows server hijacking A critical vulnerability (CVE-2026-45829) has been identified in the ChromaDB project, allowing unauthenticated attackers to execute arbitrary code on exposed servers. This flaw stems from a misplacement of authenticatio… BleepingComputer · May 19, 2026 Critical CVE-2026-45829apipythonfastapi
threat-intel ScadaBR CISA has issued an advisory regarding critical vulnerabilities in ScadaBR version 1.2.0, a SCADA system. The vulnerabilities include missing authentication, OS command injection, and CSRF, potentially allowing unauthenti… CISA Advisories · May 19, 2026 Critical CVE-2026-8602CVE-2026-8603CVE-2026-8604scadavulnerabilityremote code execution
vulnerability SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access SEPPMail Secure E-Mail Gateway has been found to contain multiple critical vulnerabilities, including remote code execution (RCE) and unauthorized access to mail traffic. These flaws, detailed in a report by InfoGuard La… The Hacker News · May 19, 2026 Critical CVE-2026-2743CVE-2026-7864CVE-2026-44125remote code executionemail securitylog rotation
threat-intel 'Claw Chain' Vulnerabilities Threaten OpenClaw Deployments New vulnerabilities, dubbed 'Claw Chain,' have been discovered in the OpenClaw open-source AI agent framework, posing a significant risk to deployments. These four flaws – CVE-2026-44112, CVE-2026-44115, CVE-2026-44118,… Dark Reading · May 18, 2026 Critical CVE-2026-44112CVE-2026-44115CVE-2026-44118aiagentvulnerability
supply-chain TeamPCP Supply Chain Campaign: Activity Through 2026-05-17, (Mon, May 18th) The TeamPCP supply chain campaign intensified significantly on May 17th, 2026, marked by the confirmed compromise of a Checkmarx Jenkins plugin and the emergence of a new Mini Shai-Hulud worm. This campaign targeted npm… SANS Internet Storm Center · May 18, 2026 Critical CVE-2026-45321CVE-2025-29927CVE-2025-55182GBILIRsupply-chainnpmpypi
threat-intel Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws Multiple vendors, including Ivanti, Fortinet, SAP, and VMware, have released security patches to address critical vulnerabilities across their products. These vulnerabilities include remote code execution, SQL injection,… The Hacker News · May 18, 2026 Critical CVE-2026-8043CVE-2026-44277CVE-2026-26083USUKremote code executionsql injectionprivilege escalation
