🚨 Showboat #Linux malware targets Middle East telecom.

https://thehackernews.com/2026/05/showboat-linux-malware-hits-middle-east.html

Active since at least mid-2022, the modular framework enables remote shells, file transfers, process hiding, and SOCKS5 proxying to access internal LAN systems.

🚨 Critical Alert: Cisco Secure Workload Hit with CVSS 10.0 Flaw.

https://thehackernews.com/2026/05/cisco-patches-cvss-100-secure-workload.html

Unauthenticated attackers can exploit a REST API vulnerability (CVE-2026-20223) to steal sensitive data and make configuration changes across tenant boundaries with Site Admin privileges.

Affects both SaaS and on-prem deployments. No workarounds.

Patch immediately:
• 3.10 → 3.10.8.3
• 4.0 → 4.0.3.17
• 3.9 or older → Migrate now

🚨 CISA just added two actively exploited vulns to its KEV catalog.

https://thehackernews.com/2026/05/cisa-adds-exploited-langflow-and-trend.html

Critical RCE in Langflow (CVE-2025-34291, CVSS 9.4) and directory traversal in Trend Micro Apex One (on-prem).

Patch now if you're using either.

A 23-year-old Canadian man has been arrested over the alleged operation of Kimwolf, a #DDoS botnet that infected photo frames, webcams, and other devices.

The botnet issued 25,000+ attack commands and peaked at 31.4 Tbps.

Full story 👇 https://thehackernews.com/2026/05/kimwolf-ddos-botnet-operator-arrested.html

Many vulnerable Windows drivers were considered 'safe' because their code only runs with matching hardware.

New research shows you can often trigger them from user mode alone — no hardware needed.

This makes far more drivers practical for BYOVD attacks (e.g. killing EDRs).

Details → https://thehackernews.com/2026/05/making-vulnerable-drivers-exploitable.html

⚡ Megalodon pushed malicious CI/CD workflows to 5,561 #GitHub repos in 6 hours.

https://thehackernews.com/2026/05/megalodon-github-attack-targets-5561.html

Attackers used throwaway accounts and forged CI bot names to inject GitHub Actions payloads designed to steal CI secrets, cloud credentials, SSH keys, OIDC tokens, and source code secrets.

Check recent workflow changes, audit PATs/deploy keys, and review unexpected CI bot commits.

Ghostwriter is phishing Ukraine’s government with Prometheus-themed malware lures.

https://thehackernews.com/2026/05/ghostwriter-targets-ukraine-government.html

Compromised-account emails deliver PDF links that lead to ZIP-based JavaScript malware: OYSTERFRESH → OYSTERBLUES/OYSTERSHUCK.

Cobalt Strike is assessed as the final payload.

🚨 First VPN, a criminal VPN used by at least 25 ransomware groups, has been dismantled.

https://thehackernews.com/2026/05/first-vpn-dismantled-in-global-takedown.html

Authorities say the service helped criminals hide the origin of ransomware attacks, data theft, scanning, fraud, and DDoS activity.

The May 19–20 operation seized 33 servers and domains, including 1vpns[.]com, 1vpns[.]net, and 1vpns[.]org.

🚨 Drupal Core SQL injection is now actively exploited.

https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html

CISA added CVE-2026-9082 to its KEV catalog after exploitation was detected in the wild.

Imperva observed:
• 15,000+ attack attempts
• Nearly 6,000 targeted sites
• Activity across 65 countries
• Gaming and financial services sites hit hardest, at nearly 50% of attacks

The flaw affects all supported Drupal Core versions and could allow privilege escalation and remote code execution via specially crafted requests.

Patch now:
• Drupal 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, 10.4.10.
• Drupal 9.5 and 8.9 require manual patching.

🚨 Active exploit: LiteSpeed cPanel root flaw.

https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html

CVE-2026-48172 is a CVSS 10.0 vulnerability in LiteSpeed User-End cPanel Plugin that lets any cPanel user run arbitrary scripts as root.

🔸 Affected: v2.3–2.4.4
🔸 Not affected: WHM plugin
🔸 Fix: upgrade to WHM Plugin 5.3.1.0 with cPanel plugin v2.4.7+
🔸 IOC: cpanel_jsonapi_func=redisAble

🛑 Supply Chain Attack Alert: 700+ Laravel-Lang package versions compromised.

https://thehackernews.com/2026/05/laravel-lang-php-packages-compromised.html

The malicious code auto-runs via Composer, drops a cross-platform PHP stealer, and targets cloud keys, CI/CD tokens, browser data, crypto wallets, password managers, SSH keys, and .env files.

Laravel/PHP devs: check your composer.lock immediately.

🚨 Anthropic’s Claude Mythos Preview found 10,000+ severe software flaws in one month.

https://thehackernews.com/2026/05/claude-mythos-ai-finds-10000-high.html

The AI uncovered high- or critical-severity vulnerabilities across widely used software, including 1,726 confirmed flaws and 1,094 rated high or critical severity.

The findings have already led to 97 patches and 88 advisories.

One flaw, CVE-2026-5194 in WolfSSL, could allow certificate forgery.

⚠️ Supply chain attack hits Packagist.

https://thehackernews.com/2026/05/packagist-supply-chain-attack-infects-8.html

8 packages were compromised with malicious package.json postinstall scripts that downloaded and executed a Linux binary from GitHub Releases.

The payload was also linked to 777 GitHub files, including GitHub Actions workflow files.

Audit your dependencies and lockfiles.

🔥 npm now requires human 2FA approval before staged package releases become installable — even from CI/CD workflows.

https://thehackernews.com/2026/05/npm-adds-2fa-gated-publishing-and.html

New package versions uploaded with staged publishing are placed into a queue and must be explicitly approved by a maintainer before release.

Requirements:
• npm CLI 11.15.0+
• 2FA enabled
• Existing npm package
• Use npm stage publish

npm also added new install controls:
--allow-file
--allow-remote
--allow-directory

The updates are designed to strengthen defenses against software supply chain attacks targeting open-source ecosystems.

🚨 TrapDoor supply chain attack hits npm, PyPI, and Crates-io.

https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html

34 malicious packages across 384 versions were used to steal crypto wallets, SSH keys, cloud credentials, and developer secrets from crypto, DeFi, Solana, and AI environments.

The malware abused npm hooks, Python imports, and Rust build scripts for execution and persistence.

🚨 Lazarus deployed a new memory-only RAT against crypto and financial organizations.

https://thehackernews.com/2026/05/lazarus-deploys-remotepe-memory-only.html

The RemotePE malware executes entirely in memory with no filesystem artifacts, using DPAPI loaders, ETW patching, and Hell’s Gate techniques to evade detection and maintain stealthy access.

🚨 Hackers breached 700+ Ghost CMS websites to serve ClickFix malware attacks.

Read 🠒 https://thehackernews.com/2026/05/ghost-cms-cve-2026-26980-exploited-to.html

The attackers exploited critical flaw CVE-2026-26980 to steal admin API keys and inject malicious JavaScript into legitimate sites, including university, AI, blockchain, and fintech platforms.

Visitors were shown fake CAPTCHA pages that tricked them into running malware.

The alert firehose just met its match.

NDR has long been labeled noisy and overwhelming. But agentic AI is changing that — turning massive network data volume into a powerful advantage by autonomously correlating signals and surfacing prioritized, contextual threats.

Worth 45 seconds → https://thehackernews.com/2026/05/the-alert-firehose-finally-meets-its.html

axios had 70M weekly downloads. What's hiding in today’s open source packages?

axios hit 70M weekly downloads before anyone knew it was compromised. ActiveState's free OSS Health Check maps the packages most common to your industry. You’ll know your exposure before the next axios attack hits.

Get Health Check: https://thn.news/activestate-healthcheck

⚡ Another week, another pile of “how the hell is this still happening?” moments.

Full recap: https://thehackernews.com/2026/05/weekly-recap-linux-flaws-defender-0.html

☠️ Repo Worms
🐧 Linux Flaws
🛡️ Defender 0-Days
📡 Router Botnets
📦 Supply Chain Hits
🎣 Smarter Phishing
🤖 AI-Found Vulns
📱 NFC Banking Malware
🧰 Fake Teams Apps
🌐 Smart Contract C2
💸 Tax Scam Lures
🔥 Active Exploits

Internet’s still running on bad configs, forgotten boxes, and pure luck.

🚨 One shared key. Every deployment at risk.

Attackers exploited CVE-2026-5426 in the KnowledgeDeliver LMS to gain unauthenticated RCE through hard-coded ASP-NET machineKeys, deploy the Godzilla (BLUEBEAM) web shell, and deliver Cobalt Strike Beacon on vulnerable internet-facing systems.

Read 🠒 https://thehackernews.com/2026/05/knowledgedeliver-lms-flaw-exploited-to.html