An improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-1-26 allows a remote attacker to execute arbitrary code in the build environment. This vulnerability was patched on 26 January 2026, and no customer action is needed.

Recommended Actions

• Verify Google Cloud Build service is updated to version dated after 2026-01-26. No manual patching is required as per vendor statement.
• Audit Cloud Build triggers and service accounts to ensure least privilege, especially for triggers activated by comments.
• Review Cloud Build logs for any unusual build activity or unexpected code execution prior to the patch date.

Hackers are targeting WordPress websites running a vulnerable version of the WP Maps Pro plugin, which allows creating rogue administrator accounts without authentication. [...]

Recommended Actions

• Identify and inventory all WordPress installations using the 'WP Maps Pro' plugin via web application scanner or asset management.
• Immediately update WP Maps Pro plugin to the latest patched version or disable/remove it if not in use.
• Search WordPress user tables and audit logs for recently created administrator accounts, especially with unusual usernames or creation times.

Dutch authorities have announced the takedown of a botnet that enslaved millions of infected devices, including computers, tablets, smartphones, and IoT devices, to carry out malicious attacks. The bot network, per the Dutch Politie and the National Cyber Security Center (NCSC), consisted of at least 17 million infected devices. More than 200 servers located in the Netherlands acted as the

Recommended Actions

• Check network egress traffic for connections to known C2 IPs/domains associated with the dismantled botnet (obtain IOCs from NCSC-NL or abuse.ch).
• Review and update IoT device inventory; enforce network segmentation for IoT devices to limit lateral movement.
• Scan internal networks for devices with default or weak credentials using tools like Nmap or Nessus.

A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and detection opportunities to help organizations identify and disrupt related activity. The post Malicious npm packages abuse dependency confusion to profile developer environments appeared first on Microsoft Security Blog.

Recommended Actions

• Enforce npm registry scoping and use `.npmrc` files with `@myscope:registry` settings to prevent public package hijacking.
• Deploy egress filtering for npm installs from build servers to block connections to unexpected registries.
• Scan development and CI/CD environments for the 33 malicious npm packages (e.g., using `npm audit` or `npm ls`) and remove them.

Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. The post Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection appeared first on Microsoft Security Blog.

Daily 5 min cyber security news summary. News, patches, vulnerabilities and trends in information and network security. SANS Stormcast Friday, May 29th, 2026: @sans_edu research; Honeypot Log; VPN “Toad”; Silent Ransom Group

In this newsletter, Thor breaks down why you should stop relying solely on CVSS and start using EPSS and GCVE to focus your patching efforts on the threats that actually matter.

This white paper presents a concrete case study demonstrating the creation of a heap overflow vulnerability through the exploitation of the DICOM file format.

Recommended Actions

• If using Orthanc, Pydicom, or GDCM libraries, update to latest versions and test with malformed DICOM files for heap overflow resilience.
• Implement strict input validation and memory-safe parsing for any custom DICOM processing applications.
• Deploy endpoint detection (EDR) with heap protection (e.g., Microsoft Defender ASR, CrowdStrike Overwatch) on systems processing medical imaging data.

Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about how their hosting companies had assumed control over the technical infrastructure of Stark Industries Solutions, an Internet service provider sanctioned last year by the EU as a...

Recommended Actions

• Block network traffic to/from IP ranges associated with the seized hosting providers (e.g., Stark Industries Solutions infrastructure).
• Review any third-party hosting contracts and assess provider security practices, especially for EU-based critical services.
• Monitor for indicators of compromise (IOCs) related to Russian cyberattacks and disinformation campaigns targeting your organization.

Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets on a public GitHub account. The inquiry comes as CISA is still struggling to contain the breach and invalidate the leaked credentials.

Recommended Actions

• Immediately rotate all AWS GovCloud and AWS credentials, especially those used by contractors or in CI/CD pipelines.
• Scan public code repositories (GitHub, GitLab) for exposed secrets belonging to your organization using tools like TruffleHog or GitGuardian.
• Enforce mandatory use of secret management systems (AWS Secrets Manager, HashiCorp Vault) and block hardcoded credentials in code.

Defending against china-nexus covert networks of compromised devices executive summary Defending against China-nexus covert networks of compromised devices  Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defend against it  Summary With support from the UK Cyber League, this advisory has been jointly released by the National Cyber Security Centre (NCSC-UK) and international partners: ...

Recommended Actions

• Implement network segmentation and micro-segmentation to limit lateral movement of compromised devices.
• Deploy endpoint detection and response (EDR) with behavioral analysis to identify covert C2 channels (e.g., anomalous DNS, HTTPS beaconing).
• Apply NCSC-UK advisory mitigations for China-nexus TTPs, including strict outbound proxy rules and monitoring for compromised infrastructure.

Advisory at a Glance Title Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure Original Publication April 7, 2026 Executive Summary Iran-affiliated advanced persistent threat (APT) actors are conducting exploitation activity targeting internet-facing operational technology (OT) devices, including programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley. This activity has led to PLC disruptions across several...

Recommended Actions

• Immediately isolate Rockwell Automation/Allen-Bradley PLCs from the internet; place behind firewalls with strict ingress/egress rules.
• Update PLC firmware to latest versions and disable unused services (e.g., web servers, FTP) on OT devices.
• Monitor network traffic to PLCs for anomalous commands or connections using OT-aware IDS/IPS (e.g., Claroty, Nozomi Networks).

DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.

Recommended Actions

• Update DOMPurify to version 3.2.7 or later. For version 2.x, migrate to version 3.x as 2.x is unpatched.
• If using DOMPurify with user input in `<textarea>` contexts, sanitize attribute values separately or implement additional output encoding.
• Test XSS protections by attempting to inject `</textarea>` payloads into attribute fields that are processed by DOMPurify.

An issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaign functionality, can inject a malicious payload within the Campaign Name. This data can be exported to a CSV file. Attackers can populate data fields that may attempt data exfiltration or other malicious activity when automatically executed by the spreadsheet software.

Recommended Actions

• Update Nokia Impact to Mobile 23_FP1 or later to patch the CSV injection vulnerability.
• Implement input validation on the 'Campaign Name' field to block characters used in CSV injection (e.g., `=`, `+`, `-`, `@`).
• Configure spreadsheet software (e.g., Microsoft Excel) to disable automatic execution of formulas when opening CSV files from external sources.

A Cross-Site Request Forgery (CSRF) vulnerability in Nokia IMPACT through 19.11.2.10-20210118042150283 allows a remote attacker to import and overwrite the entire application configuration. Specifically, in /ui/rest-proxy/entity/import, neither the X-CSRF-NONCE HTTP header nor the CSRF-NONCE cookie is validated.

Recommended Actions

• Update Nokia Impact to a version beyond 19.11.2.10-20210118042150283.
• Ensure the `X-CSRF-NONCE` HTTP header and `CSRF-NONCE` cookie are properly validated on all POST/PUT/DELETE requests to `/ui/rest-proxy/entity/import`.
• Implement CSRF tokens and same-site cookie policies for all authenticated sessions.

Through April 2026, Kimsuky deployed sophisticated malicious campaigns against South Korean military and corporate entities using tailored social engineering tactics including fake security software installation pages and spoofed Webex meeting pages leveraging legitimate meeting schedules. The threa

SideCopy APT, a Pakistan-linked threat group under the Transparent Tribe umbrella, executed a targeted spear phishing campaign against Afghanistan's Ministry of Finance and provincial revenue directorates. The attack begins with a Pashto-language LNK file disguised as a staff directory document, whi

We recently observed a multi-stage macOS intrusion campaign conducted by the North Korean state-sponsored threat group Sapphire Sleet (also tracked as BlueNoroff / UNC1069). The campaign specifically targets macOS environments within high-value financial sectors, including venture capital firms, Web

A supply chain attack targeting the npm ecosystem was identified involving 14 malicious packages published under the alias vpmdhaj. These packages typosquat well-known OpenSearch, ElasticSearch, and DevOps libraries, executing malicious payloads through npm lifecycle hooks during installation. The a

The Gentlemen is a ransomware-as-a-service operation tracked as Storm-2697, distinguished by combining robust per-file encryption using Curve25519 with XChaCha20 stream cipher alongside aggressive self-propagation capabilities designed for broad network compromise. Emerging in mid-2025 and transitio

In May 2026, threat actors exploited CVE-2026-35616, an improper access control vulnerability in FortiClient Endpoint Management Server (EMS), to bypass API authentication and execute privileged requests without credentials. Attackers leveraged trusted endpoint management infrastructure to push mali

A cybercrime campaign active since at least 2022 has been distributing cryptocurrency miners and RAT malware through illegal streaming sites and digital libraries. Victims are tricked via fake video player plugin updates or browser crash pages into downloading ZIP archives containing legitimate exec

JINX-0164, a financially motivated threat actor active since mid-2025, has been conducting sophisticated campaigns against cryptocurrency organizations. The actor employs LinkedIn-based social engineering, posing as recruiters or business partners to deliver custom macOS malware including AUDIOFIX (

A coordinated smishing operation spanning 19 countries across Europe, the Americas, and the Caucasus has been exposed, originating from fraudulent SMS messages impersonating Romania's government payment portal Ghișeul.ro. Investigation revealed 1,628 malicious URLs linked by a single 128-character c

Researchers uncovered a massive fraud ecosystem targeting the 2026 FIFA World Cup, identifying over 4,300 fraudulent domains impersonating FIFA's official website since August 2025. At the center operates GHOST STADIUM, a Chinese-speaking threat actor running a sophisticated phishing campaign across