🚨 Active exploit: LiteSpeed cPanel root flaw.

https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html

CVE-2026-48172 is a CVSS 10.0 vulnerability in LiteSpeed User-End cPanel Plugin that lets any cPanel user run arbitrary scripts as root.

🔸 Affected: v2.3–2.4.4
🔸 Not affected: WHM plugin
🔸 Fix: upgrade to WHM Plugin 5.3.1.0 with cPanel plugin v2.4.7+
🔸 IOC: cpanel_jsonapi_func=redisAble

🛑 Supply Chain Attack Alert: 700+ Laravel-Lang package versions compromised.

https://thehackernews.com/2026/05/laravel-lang-php-packages-compromised.html

The malicious code auto-runs via Composer, drops a cross-platform PHP stealer, and targets cloud keys, CI/CD tokens, browser data, crypto wallets, password managers, SSH keys, and .env files.

Laravel/PHP devs: check your composer.lock immediately.

🚨 Anthropic’s Claude Mythos Preview found 10,000+ severe software flaws in one month.

https://thehackernews.com/2026/05/claude-mythos-ai-finds-10000-high.html

The AI uncovered high- or critical-severity vulnerabilities across widely used software, including 1,726 confirmed flaws and 1,094 rated high or critical severity.

The findings have already led to 97 patches and 88 advisories.

One flaw, CVE-2026-5194 in WolfSSL, could allow certificate forgery.

⚠️ Supply chain attack hits Packagist.

https://thehackernews.com/2026/05/packagist-supply-chain-attack-infects-8.html

8 packages were compromised with malicious package.json postinstall scripts that downloaded and executed a Linux binary from GitHub Releases.

The payload was also linked to 777 GitHub files, including GitHub Actions workflow files.

Audit your dependencies and lockfiles.

🔥 npm now requires human 2FA approval before staged package releases become installable — even from CI/CD workflows.

https://thehackernews.com/2026/05/npm-adds-2fa-gated-publishing-and.html

New package versions uploaded with staged publishing are placed into a queue and must be explicitly approved by a maintainer before release.

Requirements:
• npm CLI 11.15.0+
• 2FA enabled
• Existing npm package
• Use npm stage publish

npm also added new install controls:
--allow-file
--allow-remote
--allow-directory

The updates are designed to strengthen defenses against software supply chain attacks targeting open-source ecosystems.

🚨 TrapDoor supply chain attack hits npm, PyPI, and Crates-io.

https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html

34 malicious packages across 384 versions were used to steal crypto wallets, SSH keys, cloud credentials, and developer secrets from crypto, DeFi, Solana, and AI environments.

The malware abused npm hooks, Python imports, and Rust build scripts for execution and persistence.

🚨 Lazarus deployed a new memory-only RAT against crypto and financial organizations.

https://thehackernews.com/2026/05/lazarus-deploys-remotepe-memory-only.html

The RemotePE malware executes entirely in memory with no filesystem artifacts, using DPAPI loaders, ETW patching, and Hell’s Gate techniques to evade detection and maintain stealthy access.

🚨 Hackers breached 700+ Ghost CMS websites to serve ClickFix malware attacks.

Read 🠒 https://thehackernews.com/2026/05/ghost-cms-cve-2026-26980-exploited-to.html

The attackers exploited critical flaw CVE-2026-26980 to steal admin API keys and inject malicious JavaScript into legitimate sites, including university, AI, blockchain, and fintech platforms.

Visitors were shown fake CAPTCHA pages that tricked them into running malware.

The alert firehose just met its match.

NDR has long been labeled noisy and overwhelming. But agentic AI is changing that — turning massive network data volume into a powerful advantage by autonomously correlating signals and surfacing prioritized, contextual threats.

Worth 45 seconds → https://thehackernews.com/2026/05/the-alert-firehose-finally-meets-its.html

axios had 70M weekly downloads. What's hiding in today’s open source packages?

axios hit 70M weekly downloads before anyone knew it was compromised. ActiveState's free OSS Health Check maps the packages most common to your industry. You’ll know your exposure before the next axios attack hits.

Get Health Check: https://thn.news/activestate-healthcheck

⚡ Another week, another pile of “how the hell is this still happening?” moments.

Full recap: https://thehackernews.com/2026/05/weekly-recap-linux-flaws-defender-0.html

☠️ Repo Worms
🐧 Linux Flaws
🛡️ Defender 0-Days
📡 Router Botnets
📦 Supply Chain Hits
🎣 Smarter Phishing
🤖 AI-Found Vulns
📱 NFC Banking Malware
🧰 Fake Teams Apps
🌐 Smart Contract C2
💸 Tax Scam Lures
🔥 Active Exploits

Internet’s still running on bad configs, forgotten boxes, and pure luck.

🚨 One shared key. Every deployment at risk.

Attackers exploited CVE-2026-5426 in the KnowledgeDeliver LMS to gain unauthenticated RCE through hard-coded ASP-NET machineKeys, deploy the Godzilla (BLUEBEAM) web shell, and deliver Cobalt Strike Beacon on vulnerable internet-facing systems.

Read 🠒 https://thehackernews.com/2026/05/knowledgedeliver-lms-flaw-exploited-to.html

⚠️ Cybercriminals are flooding the web with FIFA World Cup 2026 scams — before the tournament even starts.

https://thehackernews.com/expert-insights/2026/05/before-whistle-ctm360-reveals-how.html

Security firm CTM360 uncovered over 7,000 themed domains, with 4,500+ registered in just the last 5 months. Already 1,000+ malicious sites and 1,000+ fake social accounts are live.

Don’t get scammed before the first whistle.

🚨 Iranian hackers deployed a new AI-assisted backdoor called MiniFast.

https://thehackernews.com/2026/05/iranian-hackers-deploy-minifast-and.html

IRGC-linked group Nimbus Manticore targeted aviation, software, telecom, and energy sectors across the U.S., Europe, and the Middle East.

The campaigns used:
• Phishing lures
• SEO poisoning
• Trojanized Zoom and SQL Developer installers
• Fake meeting invites
• AppDomain hijacking

Activity was tracked between February and April 2026.

🚨 India’s CERT-In has directed organizations to patch known exploited vulnerabilities in internet-facing systems within 12 hours where feasible as AI tools accelerate cyber attacks.

The guidance cites faster vulnerability discovery, phishing, malware generation, and exploitation workflows.

Read: https://thehackernews.com/2026/05/cert-in-mandates-12-hour-patching-for.html

Your "second factor" isn't as safe as you think.

Attackers don’t need to steal your MFA code anymore — they just exhaust you until you approve it.

MFA Prompt Bombing is quietly becoming one of the most effective attacks right now.

Read → https://thehackernews.com/2026/05/mfa-prompt-bombing-why-your-second.html

⚠️ SharePoint RCE Vulnerability.

Details → https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html

CVE-2026-45659 allows authenticated attackers with only Site Member permissions to execute code remotely on SharePoint Server.

The CVSS 8.8 flaw affects SharePoint Server 2016, 2019, and Subscription Edition.

The Zero Knowledge vault myth is over.

ETH Zurich (USENIX ‘26) identifies 27 attacks against cloud password managers. Storing secrets = a $150M+ systemic risk.

Unixi uSSO kills the vault via KDA:
🔹No central DB
🔹No phishing
🔹100% enforcement

Details: https://thn.news/centralization-risk

⚡AI is making DDoS attacks faster and smarter — helping attackers find weak spots, create new attack vectors, and scale attacks more efficiently.

Watch this WEBINAR to see how it works → https://thehackernews.com/2026/05/new-ai-ddos-attacks-are-smarter-learn.html

What you’ll get:
• Real examples of today’s AI-enhanced attacks
• How to find & fix hidden weaknesses fast
• Practical defenses you can apply immediately

🚨 MuddyWater hit 9 countries.

Read → https://thehackernews.com/2026/05/muddywater-uses-dll-side-loading-in.html

The Iranian hacking group targeted 9 organizations using signed Fortemedia and SentinelOne binaries to sideload malware, steal Chrome data, and quietly maintain access inside victim networks.

One intrusion lasted a full week inside a major South Korean electronics company.

AI uncovered a 27-year-old bug in OpenBSD that survived decades of human audits.

RunSafe Security’s CEO Joseph M. Saunders warns: you can’t patch your way out of this anymore.

With AI flooding teams with discoveries and EU CRA regulations incoming, remediation backlogs just became unmanageable.

Full insights here: https://thehackernews.com/expert-insights/2026/05/you-cant-patch-your-way-out-of-this-one.html