TECHZONE™

9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros https://thehackernews.com/2026/05/9-year-old-linux-kernel-flaw-enables.html Cybersecurity researchers have disclosed details of a vulnerability in the Linux kernel that remained undetected for nine years. The vulnerability, tracked as CVE-2026-46333 (CVSS score: 5.5), is a case of improper privilege management that could permit an unprivileged local user to disclose sensitive files and execute arbitrary commands as root on default installations of several major

GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension https://thehackernews.com/2026/05/github-internal-repositories-breached.html GitHub on Wednesday officially confirmed that the breach of its internal repositories was the result of a compromise of an employee device involving a poisoned version of the Nx Console Microsoft Visual Studio Code (VS Code) extension.  The development comes as the Nx team revealed that the extension, nrwl.angular-console, was breached after one of its developers' systems was hacked in the

Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks https://thehackernews.com/2026/05/highly-critical-drupal-core-flaw.html Drupal has released security updates for a "highly critical" security vulnerability in Drupal Core that could be exploited by attackers to achieve remote code execution, privilege escalation, or information disclosure. The vulnerability, now tracked as CVE-2026-9082, carries a CVSS score of 6.5 out of 10.0, per CVE.org. Drupal said the vulnerability resides in a database abstraction API that is

Webworm: New burrowing techniques https://www.welivesecurity.com/en/eset-research/webworm-new-burrowing-techniques/ ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal

The quest for greater tech independence https://www.welivesecurity.com/en/cybersecurity/quest-greater-tech-independence/ A complete decoupling from US technology is neither realistic nor necessary, but the changing environment does require nations and companies to reassess their relationships and dependencies

Microsoft Open-Sources RAMPART and Clarity to Secure AI Agents During Development https://thehackernews.com/2026/05/microsoft-open-sources-rampart-and.html Microsoft has unveiled two new open-source tools called RAMPART and Clarity to assist developers in better testing the security of artificial intelligence (AI) agents. RAMPART, short for Risk Assessment and Measurement Platform for Agentic Red Teaming, functions as a Pytest-native safety and security testing framework for writing and running safety and security tests for AI agents, covering

Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks https://thehackernews.com/2026/05/microsoft-takes-down-malware-signing.html Microsoft on Tuesday said it disrupted a malware-signing-as-a-service (MSaaS) operation that weaponized the company's Artifact Signing system to deliver malicious code and conduct ransomware and other attacks, compromising thousands of machines and networks across the world. The tech giant attributed the activity to a threat actor it calls Fox Tempest, which it said offered the MSaaS scheme

Webworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph API https://thehackernews.com/2026/05/webworm-deploys-echocreep-and-graphworm.html Cybersecurity researchers have flagged fresh activity from a China-aligned threat actor known as Webworm in 2025, deploying custom backdoors that employ Discord and Microsoft Graph API for command-and-control (C2 or C&C) communications. Webworm, first publicly documented by Broadcom-owned Symantec in September 2022, is assessed to be active since at least 2022, targeting government agencies

Agent AI is Coming. Are You Ready? https://thehackernews.com/2026/05/agent-ai-is-coming-are-you-ready.html New Industry Data Just Released Suggests Not. On May 19th, 2026, Orchid Security released the results of our Identity Gap: Snapshot 2026. Among the findings, "identity dark matter" (the unseen, unmanaged elements of identity) now overshadows the visible elements 57% vs. 43%. And it couldn't have occurred at a worse time, with enterprises embracing Agent AI with both arms (and unfortunately, as

Typosquatting Is No Longer a User Problem. It's a Supply Chain Problem https://thehackernews.com/2026/05/typosquatting-is-no-longer-user-problem.html AI-generated lookalike domains are now embedded inside the third-party scripts running on your web properties. Here's why your current stack can't see them, and what detection actually requires. Download the CISO Expert Guide to Typosquatting in the AI Era → TL;DR  Typosquatting is no longer a user problem. Attackers now embed lookalike domains inside legitimate third-party scripts.

Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit https://thehackernews.com/2026/05/microsoft-releases-mitigation-for.html Microsoft on Tuesday released a mitigation for a BitLocker bypass vulnerability named YellowKey following its public disclosure last week. The zero-day flaw, now tracked as CVE-2026-45585, carries a CVSS score of 6.8. It has been described as a BitLocker security feature bypass. "Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as 'YellowKey,'" the

Grafana GitHub Breach Exposes Source Code via TanStack npm Attack https://thehackernews.com/2026/05/grafana-github-breach-exposes-source.html Grafana Labs, on May 19, 2026, said an investigation into its recent breach found no evidence of customer production systems or operations being compromised. It said the scope of the incident is limited to the Grafana Labs GitHub environment, which includes public and private source code along with internal GitHub repositories. "After the initial assessment, we found that in addition to source

GitHub Investigating TeamPCP Claimed Breach of ~4,000 Internal Repositories https://thehackernews.com/2026/05/github-investigating-teampcp-claimed.html GitHub on Tuesday said it's investigating unauthorized access to its internal repositories after the notorious threat actor known as TeamPCP listed the platform's source code and internal organizations for sale on a cybercrime forum. "While we currently have no evidence of impact to customer information stored outside of GitHub's internal repositories (such as our customers' enterprises,

Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps https://thehackernews.com/2026/05/trapdoor-android-ad-fraud-scheme-hit.html Cybersecurity researchers have disclosed details of a new ad fraud and malvertising operation dubbed Trapdoor targeting Android device users. The activity, per HUMAN's Satori Threat Intelligence and Research Team, encompassed 455 malicious Android apps and 183 threat actor-owned command-and-control (C2) domains, turning the infrastructure into a pipeline for multi-stage fraud. "Users

Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials https://thehackernews.com/2026/05/github-actions-supply-chain-attack.html In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper, to run malicious code that harvests sensitive credentials and exfiltrates them to an attacker-controlled server. "Every existing tag in the repository has been moved to point to an imposter commit that does not appear in the action's normal commit history,

Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account https://thehackernews.com/2026/05/mini-shai-hulud-pushes-malicious-antv.html Cybersecurity researchers have discovered a fresh software supply chain attack campaign that has compromised various npm packages associated with the @antv ecosystem as part of the ongoing Mini Shai-Hulud attack wave. "The attack affects packages tied to the npm maintainer account atool, including echarts-for-react, a widely used React wrapper for Apache ECharts with roughly 1.1 million weekly

INTERPOL Operation Ramz Disrupts MENA Cybercrime Networks with 201 Arrests https://thehackernews.com/2026/05/interpol-operation-ramz-disrupts-mena.html INTERPOL has coordinated a first-of-its-kind cybercrime crackdown across the Middle East and North Africa (MENA) that led to 201 arrests and the identification of an additional 382 suspects. The initiative involved the efforts of 13 countries from the region between October 2025 and February 2026, aiming to investigate and neutralize malicious infrastructure, arrest perpetrators behind these

⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More https://thehackernews.com/2026/05/weekly-recap-exchange-0-day-npm-worm.html Monday opens with a trust problem. A mail server flaw is under active use. A network control system was targeted. Trusted packages were poisoned. A fake model page pushed a stealer. Then came the familiar ransom claim: the data was returned and deleted. The pattern is clear. One weak dependency can leak keys. One leaked key can open cloud access. One cloud foothold can become a production

How to Reduce Phishing Exposure Before It Turns into Business Disruption https://thehackernews.com/2026/05/how-to-reduce-phishing-exposure-before.html What happens when a phishing email looks clean enough to pass through security, but dangerous enough to expose the business after one click? That is the gap many SOCs still struggle with: the attacks that leave teams unsure what was exposed, who else was targeted, and how far the risk has spread. Early phishing detection closes that gap. It helps teams move from uncertainty to evidence faster,

Developer Workstations Are Now Part of the Software Supply Chain https://thehackernews.com/2026/05/developer-workstations-are-now-part-of.html Supply chain attackers are not only trying to slip malicious code into trusted software. They are trying to steal the access that makes trusted software possible. Recently, three separate campaigns hit npm, PyPI, and Docker Hub in a 48-hour window, and all three targeted secrets from developer environments and CI/CD pipelines, including API keys, cloud credentials, SSH keys, and tokens. This is