⚡ Not via a fancy zero-day... #GitHub confirmed its internal repositories were breached after an employee device installed a poisoned Nx Console VS Code extension.

https://thehackernews.com/2026/05/github-internal-repositories-breached.html

TeamPCP exfiltrated ~3,800 repos in an 18-minute window.

The extension deployed a credential stealer targeting 1Password, GitHub tokens, AWS, and more via auto-updates.

🛑 [New] 9-Year-Old Linux Kernel Bug = Local Root on Default Debian, Ubuntu & Fedora.

https://thehackernews.com/2026/05/9-year-old-linux-kernel-flaw-enables.html

CVE-2026-46333 (ssh-keysign-pwn) lets any unprivileged user steal /etc/shadow + SSH host keys and run commands as root.

🔸 Public PoC available
🔸 Patch your kernel NOW
🔸 Quick temp fix - sysctl kernel.yama.ptrace_scope=2

🚨 Microsoft warns two Defender vulnerabilities are being actively exploited in the wild.

https://thehackernews.com/2026/05/microsoft-warns-of-two-actively.html

🔸 CVE-2026-41091 could allow attackers to gain SYSTEM privileges locally.
🔸 CVE-2026-45498 is a denial-of-service flaw impacting Defender.

CISA added both to KEV with a June 3, 2026 patch deadline.

🚨 ThreatsDay Bulletin – May 21, 2026 is LIVE!

🔥 47 zero-days
🤖 AI agents gone rogue
🧟 Old Linux rootkit still alive
...and 25 more fresh threats

Attackers are weaponizing the tools we trust.

Read full bulletin: https://thehackernews.com/2026/05/threatsday-bulletin-linux-rootkits.html

🛤️ A single cached AWS key — auto-stored after a normal login on one Windows machine. No misconfig. No policy violation.

Yet it could open a path to 98% of the company’s cloud entities.

Identity isn’t the perimeter. It’s the highway attackers use once inside.

Must-read: https://thehackernews.com/2026/05/when-identity-is-attack-path.html

🔥 Limited special offers

15K SOC teams and 600K security professionals worldwide trust ANY.RUN’s enterprise-grade threat analysis and intelligence to close critical malware & phishing gaps and cut MTTR.

Get your offer today ➡️ https://thn.news/anyrun-tg-plan-offer

🚨 Showboat #Linux malware targets Middle East telecom.

https://thehackernews.com/2026/05/showboat-linux-malware-hits-middle-east.html

Active since at least mid-2022, the modular framework enables remote shells, file transfers, process hiding, and SOCKS5 proxying to access internal LAN systems.

🚨 Critical Alert: Cisco Secure Workload Hit with CVSS 10.0 Flaw.

https://thehackernews.com/2026/05/cisco-patches-cvss-100-secure-workload.html

Unauthenticated attackers can exploit a REST API vulnerability (CVE-2026-20223) to steal sensitive data and make configuration changes across tenant boundaries with Site Admin privileges.

Affects both SaaS and on-prem deployments. No workarounds.

Patch immediately:
• 3.10 → 3.10.8.3
• 4.0 → 4.0.3.17
• 3.9 or older → Migrate now

🚨 CISA just added two actively exploited vulns to its KEV catalog.

https://thehackernews.com/2026/05/cisa-adds-exploited-langflow-and-trend.html

Critical RCE in Langflow (CVE-2025-34291, CVSS 9.4) and directory traversal in Trend Micro Apex One (on-prem).

Patch now if you're using either.

A 23-year-old Canadian man has been arrested over the alleged operation of Kimwolf, a #DDoS botnet that infected photo frames, webcams, and other devices.

The botnet issued 25,000+ attack commands and peaked at 31.4 Tbps.

Full story 👇 https://thehackernews.com/2026/05/kimwolf-ddos-botnet-operator-arrested.html

Many vulnerable Windows drivers were considered 'safe' because their code only runs with matching hardware.

New research shows you can often trigger them from user mode alone — no hardware needed.

This makes far more drivers practical for BYOVD attacks (e.g. killing EDRs).

Details → https://thehackernews.com/2026/05/making-vulnerable-drivers-exploitable.html

⚡ Megalodon pushed malicious CI/CD workflows to 5,561 #GitHub repos in 6 hours.

https://thehackernews.com/2026/05/megalodon-github-attack-targets-5561.html

Attackers used throwaway accounts and forged CI bot names to inject GitHub Actions payloads designed to steal CI secrets, cloud credentials, SSH keys, OIDC tokens, and source code secrets.

Check recent workflow changes, audit PATs/deploy keys, and review unexpected CI bot commits.

Ghostwriter is phishing Ukraine’s government with Prometheus-themed malware lures.

https://thehackernews.com/2026/05/ghostwriter-targets-ukraine-government.html

Compromised-account emails deliver PDF links that lead to ZIP-based JavaScript malware: OYSTERFRESH → OYSTERBLUES/OYSTERSHUCK.

Cobalt Strike is assessed as the final payload.

🚨 First VPN, a criminal VPN used by at least 25 ransomware groups, has been dismantled.

https://thehackernews.com/2026/05/first-vpn-dismantled-in-global-takedown.html

Authorities say the service helped criminals hide the origin of ransomware attacks, data theft, scanning, fraud, and DDoS activity.

The May 19–20 operation seized 33 servers and domains, including 1vpns[.]com, 1vpns[.]net, and 1vpns[.]org.

🚨 Drupal Core SQL injection is now actively exploited.

https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html

CISA added CVE-2026-9082 to its KEV catalog after exploitation was detected in the wild.

Imperva observed:
• 15,000+ attack attempts
• Nearly 6,000 targeted sites
• Activity across 65 countries
• Gaming and financial services sites hit hardest, at nearly 50% of attacks

The flaw affects all supported Drupal Core versions and could allow privilege escalation and remote code execution via specially crafted requests.

Patch now:
• Drupal 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, 10.4.10.
• Drupal 9.5 and 8.9 require manual patching.

🚨 Active exploit: LiteSpeed cPanel root flaw.

https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html

CVE-2026-48172 is a CVSS 10.0 vulnerability in LiteSpeed User-End cPanel Plugin that lets any cPanel user run arbitrary scripts as root.

🔸 Affected: v2.3–2.4.4
🔸 Not affected: WHM plugin
🔸 Fix: upgrade to WHM Plugin 5.3.1.0 with cPanel plugin v2.4.7+
🔸 IOC: cpanel_jsonapi_func=redisAble

🛑 Supply Chain Attack Alert: 700+ Laravel-Lang package versions compromised.

https://thehackernews.com/2026/05/laravel-lang-php-packages-compromised.html

The malicious code auto-runs via Composer, drops a cross-platform PHP stealer, and targets cloud keys, CI/CD tokens, browser data, crypto wallets, password managers, SSH keys, and .env files.

Laravel/PHP devs: check your composer.lock immediately.

🚨 Anthropic’s Claude Mythos Preview found 10,000+ severe software flaws in one month.

https://thehackernews.com/2026/05/claude-mythos-ai-finds-10000-high.html

The AI uncovered high- or critical-severity vulnerabilities across widely used software, including 1,726 confirmed flaws and 1,094 rated high or critical severity.

The findings have already led to 97 patches and 88 advisories.

One flaw, CVE-2026-5194 in WolfSSL, could allow certificate forgery.

⚠️ Supply chain attack hits Packagist.

https://thehackernews.com/2026/05/packagist-supply-chain-attack-infects-8.html

8 packages were compromised with malicious package.json postinstall scripts that downloaded and executed a Linux binary from GitHub Releases.

The payload was also linked to 777 GitHub files, including GitHub Actions workflow files.

Audit your dependencies and lockfiles.

🔥 npm now requires human 2FA approval before staged package releases become installable — even from CI/CD workflows.

https://thehackernews.com/2026/05/npm-adds-2fa-gated-publishing-and.html

New package versions uploaded with staged publishing are placed into a queue and must be explicitly approved by a maintainer before release.

Requirements:
• npm CLI 11.15.0+
• 2FA enabled
• Existing npm package
• Use npm stage publish

npm also added new install controls:
--allow-file
--allow-remote
--allow-directory

The updates are designed to strengthen defenses against software supply chain attacks targeting open-source ecosystems.

🚨 TrapDoor supply chain attack hits npm, PyPI, and Crates-io.

https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html

34 malicious packages across 384 versions were used to steal crypto wallets, SSH keys, cloud credentials, and developer secrets from crypto, DeFi, Solana, and AI environments.

The malware abused npm hooks, Python imports, and Rust build scripts for execution and persistence.