Hackers are targeting WordPress websites running a vulnerable version of the WP Maps Pro plugin, which allows creating rogue administrator accounts without authentication. [...]

Recommended Actions

• Immediately identify and update WordPress sites running WP Maps Pro plugin to the latest patched version; check plugin version via WordPress admin panel or wp-content/plugins/wp-maps-pro/readme.txt.
• Block unauthenticated access to the vulnerable endpoint (if known, e.g., /wp-admin/admin-ajax.php?action=wp_maps_pro_create_admin) via web application firewall (WAF) rule or .htaccess/nginx location block.
• Audit WordPress user accounts for recently created administrators (post meta or user_registered timestamp) and remove unauthorized accounts; use SQL query: SELECT * FROM wp_users WHERE role='administrator' AND user_registered > '2026-05-20'.

Dutch authorities have announced the takedown of a botnet that enslaved millions of infected devices, including computers, tablets, smartphones, and IoT devices, to carry out malicious attacks. The bot network, per the Dutch Politie and the National Cyber Security Center (NCSC), consisted of at least 17 million infected devices. More than 200 servers located in the Netherlands acted as the

Recommended Actions

• Check network egress traffic for connections to known botnet C2 IPs from the takedown (e.g., via Dutch NCSC IOCs) using SIEM queries or firewall logs; block traffic to any identified IP ranges.
• Scan internal devices for signs of compromise using the botnet's known malware hashes (if published) with endpoint detection tools like CrowdStrike or Microsoft Defender AV.
• Review and harden IoT device configurations: change default credentials, disable unnecessary services (e.g., Telnet, SSH), and segment IoT networks from critical assets.

A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and detection opportunities to help organizations identify and disrupt related activity. The post Malicious npm packages abuse dependency confusion to profile developer environments appeared first on Microsoft Security Blog.

Recommended Actions

• Configure npm or Yarn to use scoped registry for internal packages (e.g., set npm config set @myco:registry https://registry.npmjs.org/) and enforce .npmrc with always-auth=true.
• Deploy egress filtering for npm registry traffic to block downloads from public registries for internal package names; use tools like Sonatype Nexus or JFrog Artifactory as a proxy.
• Monitor build logs for suspicious package installs (e.g., packages with names like 'mycompany-utils' but from public registry) and alert on mismatched hashes.

Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. The post Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection appeared first on Microsoft Security Blog.

Research Review Journal https://assets.contentstack.io/v3/assets/blt83c410d686aa5f84/blt3cff46f63887f83e/research-review-journal https://www.sans.edu/cyber-research Analysis of a Year of Files Uploaded to DShield Sensors https://isc.sans.edu/diary/Analysis%20of%20a%20Year%20of%20Files%20Uploaded%20to%20DShield%20Sensors/33026 The Word 'Toad' Gave Any Website Full Control of Chrome's Most Popular VPN https://amibeingpwned.com/blog/urban-vpn-postmessage-command-injection Silent Ransom Group...

Recommended Actions

• Review Chrome extensions for Urban VPN or similar VPN extensions; remove or update to patched versions if vulnerable to postMessage command injection.
• Deploy network monitoring for anomalous outbound connections from developer workstations (e.g., to unknown IPs on port 443) that may indicate VPN compromise.
• Implement Content Security Policy (CSP) headers on internal web apps to restrict postMessage origins and prevent cross-site scripting.

In this newsletter, Thor breaks down why you should stop relying solely on CVSS and start using EPSS and GCVE to focus your patching efforts on the threats that actually matter.

This white paper presents a concrete case study demonstrating the creation of a heap overflow vulnerability through the exploitation of the DICOM file format.

Recommended Actions

• Patch or update DICOM software (Orthanc server, pydicom, GDCM libraries) to latest versions; check for heap overflow fixes in changelogs.
• Sanitize DICOM file uploads in medical imaging systems: validate file structure with tools like dcmtk's dcm2xml before processing.
• Enable ASLR and stack canaries on systems running DICOM services (e.g., Orthanc on Linux) via compiler flags and system hardening.

Daily 5 min cyber security news summary. News, patches, vulnerabilities and trends in information and network security. SANS Stormcast Thursday, May 28th, 2026: Akira Ransomware; Vaultjacking; Poisoned Chatbot and Search Results;

Recommended Actions

• Block Akira ransomware indicators: file extensions (.akira), known C2 domains (e.g., via ThreatFox or Abuse.ch), and disable SMBv1 if not needed.
• Enable multi-factor authentication (MFA) on all VPN and remote access accounts (e.g., Cisco AnyConnect, Fortinet VPN) to prevent credential stuffing.
• Monitor for suspicious PsExec or WMI execution from non-admin workstations using Windows Event ID 4688 or Sysmon Event ID 1.

Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about how their hosting companies had assumed control over the technical infrastructure of Stark Industries Solutions, an Internet service provider sanctioned last year by the EU as a...

Recommended Actions

• Block traffic to IP ranges associated with the seized hosting providers (e.g., via Dutch police published lists) at network perimeter firewalls.
• Audit external-facing services for connections from known malicious ASNs; use tools like AbuseIPDB or Shodan to scan for open ports.
• Review DNS logs for queries to domains hosted on the seized infrastructure and sinkhole any identified malicious domains.

Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets on a public GitHub account. The inquiry comes as CISA is still struggling to contain the breach and invalidate the leaked credentials.

Recommended Actions

• Immediately rotate all AWS IAM keys, especially those in GovCloud, and enable MFA for root and IAM users; use AWS CLI: aws iam create-access-key --user-name <user>.
• Scan GitHub, GitLab, and public repos for leaked credentials using tools like TruffleHog or GitGuardian; revoke any exposed keys or tokens.
• Enforce AWS IAM policies to deny actions from unrecognized IP ranges and require MFA for sensitive API calls.

Defending against china-nexus covert networks of compromised devices executive summary Defending against China-nexus covert networks of compromised devices&nbsp; Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defend against it&nbsp; Summary With support from the UK Cyber League, this advisory has been jointly released by the National Cyber Security Centre (NCSC-UK) and international partners:&nbsp;...

Recommended Actions

• Deploy network segmentation to isolate critical systems from general corporate networks; use VLANs and firewall rules to restrict east-west traffic.
• Implement strict outbound proxy rules to block traffic to known APT C2 domains (e.g., from NCSC-UK advisories) and log all allowed outbound connections.
• Enable memory scanning for rootkits on endpoints using tools like Windows Defender Credential Guard or Linux kernel module signing enforcement.

Advisory at a Glance Title Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure Original Publication April 7, 2026 Executive Summary Iran-affiliated advanced persistent threat (APT) actors are conducting exploitation activity targeting internet-facing operational technology (OT) devices, including programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley. This activity has led to PLC disruptions across several...

Recommended Actions

• Immediately patch or update Rockwell Automation/Allen-Bradley PLC firmware to latest versions; check for advisories on CVE-2023-3595 or similar.
• Block internet access to OT networks: disable port forwarding for TCP/44818 (EtherNet/IP) and UDP/2222 on perimeter firewalls.
• Deploy network monitoring for anomalous Modbus or CIP traffic to/from PLCs using tools like Wireshark with ICS-specific dissectors.

In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommended Actions

• Apply Android kernel patches for CVE-2026-0030 (mem_protect.c) via vendor security updates; check for patch level in /proc/version.
• Restrict direct kernel module loading via sysctl kernel.modules_disabled=1 on affected Android/Linux devices.
• Monitor for unusual dmesg logs indicating memory corruption in host_check_page_state_range.

In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommended Actions

• Update Android kernel to fix CVE-2026-0029 in pkvm.c; require devices to have security patch level >= 2026-06-05.
• Disable hypervisor features (e.g., Android Protected VM) if not needed by setting ro.boot.vm=0 in bootloader config.
• Use SELinux policies to restrict access to /dev/kvm and /sys/kernel/debug/pkvm.

In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Recommended Actions

• Patch Android kernel for CVE-2026-0028 (mem_protect.c integer overflow); verify via kernel version string.
• Enable kernel address space layout randomization (KASLR) and stack protector in kernel build config.
• Audit /proc/self/maps for unexpected shared memory regions on Android devices.

Through April 2026, Kimsuky deployed sophisticated malicious campaigns against South Korean military and corporate entities using tailored social engineering tactics including fake security software installation pages and spoofed Webex meeting pages leveraging legitimate meeting schedules. The threa

SideCopy APT, a Pakistan-linked threat group under the Transparent Tribe umbrella, executed a targeted spear phishing campaign against Afghanistan's Ministry of Finance and provincial revenue directorates. The attack begins with a Pashto-language LNK file disguised as a staff directory document, whi

We recently observed a multi-stage macOS intrusion campaign conducted by the North Korean state-sponsored threat group Sapphire Sleet (also tracked as BlueNoroff / UNC1069). The campaign specifically targets macOS environments within high-value financial sectors, including venture capital firms, Web

A supply chain attack targeting the npm ecosystem was identified involving 14 malicious packages published under the alias vpmdhaj. These packages typosquat well-known OpenSearch, ElasticSearch, and DevOps libraries, executing malicious payloads through npm lifecycle hooks during installation. The a

The Gentlemen is a ransomware-as-a-service operation tracked as Storm-2697, distinguished by combining robust per-file encryption using Curve25519 with XChaCha20 stream cipher alongside aggressive self-propagation capabilities designed for broad network compromise. Emerging in mid-2025 and transitio

In May 2026, threat actors exploited CVE-2026-35616, an improper access control vulnerability in FortiClient Endpoint Management Server (EMS), to bypass API authentication and execute privileged requests without credentials. Attackers leveraged trusted endpoint management infrastructure to push mali

A cybercrime campaign active since at least 2022 has been distributing cryptocurrency miners and RAT malware through illegal streaming sites and digital libraries. Victims are tricked via fake video player plugin updates or browser crash pages into downloading ZIP archives containing legitimate exec

JINX-0164, a financially motivated threat actor active since mid-2025, has been conducting sophisticated campaigns against cryptocurrency organizations. The actor employs LinkedIn-based social engineering, posing as recruiters or business partners to deliver custom macOS malware including AUDIOFIX (

A coordinated smishing operation spanning 19 countries across Europe, the Americas, and the Caucasus has been exposed, originating from fraudulent SMS messages impersonating Romania's government payment portal Ghișeul.ro. Investigation revealed 1,628 malicious URLs linked by a single 128-character c

Researchers uncovered a massive fraud ecosystem targeting the 2026 FIFA World Cup, identifying over 4,300 fraudulent domains impersonating FIFA's official website since August 2025. At the center operates GHOST STADIUM, a Chinese-speaking threat actor running a sophisticated phishing campaign across