TECHZONE™

Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms https://thehackernews.com/2026/05/lazarus-deploys-remotepe-memory-only.html Cybersecurity researchers have shed light on a cross-platform malware called RemotePE that has been put to use by the North Korea-linked Lazarus Group in attacks targeting financial and cryptocurrency organizations. RemotePE, per NCC Group subsidiary Fox-IT, is part of a multi-stage attack chain that involves two loaders tracked as DPAPILoader and RemotePELoader. "DPAPILoader decrypts and

TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stealing malware. The campaign, codenamed TrapDoor, spans more than 34 malicious packages across over 384 versions. The earliest activity was recorded on May 22, 2026, at 8:20 p.m. UTC, with new packages published to the ecosystems in waves from a cluster of

npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks https://thehackernews.com/2026/05/npm-adds-2fa-gated-publishing-and.html GitHub has rolled out new controls for npm to improve the security of the software supply chain, giving maintainers the ability to explicitly approve a release prior to the packages becoming publicly available for installation. Called staged publishing, the feature is now generally available on npm. It mandates that a human maintainer pass a two-factor authentication (2FA) challenge to approve

Packagist Supply Chain Attack Infects 8 Packages Using GitHub-Hosted Linux Malware https://thehackernews.com/2026/05/packagist-supply-chain-attack-infects-8.html A new "coordinated" supply chain attack campaign has impacted eight packages on Packagist including malicious code designed to run a Linux binary retrieved from a GitHub Releases URL. "Although the affected packages were all Composer packages, the malicious code was not added to composer.json," Socket said. "Instead, it was inserted into package.json, targeting projects that ship JavaScript

Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software https://thehackernews.com/2026/05/claude-mythos-ai-finds-10000-high.html Anthropic on Friday disclosed that Project Glasswing has helped uncover more than 10,000 high- or critical-severity vulnerabilities across some of the most "systemically" important software across the world since the cybersecurity initiative went live last month. Project Glasswing is a defensive effort launched by the artificial intelligence (AI) company to secure critical global software

Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer https://thehackernews.com/2026/05/laravel-lang-php-packages-compromised.html Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework. The affected packages include - laravel-lang/lang laravel-lang/http-statuses laravel-lang/attributes laravel-lang/actions "The timing and pattern of the newly published tags

LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild. The flaw, tracked as CVE-2026-48172 (CVSS score: 10.0), relates to an instance of incorrect privilege assignment that an attacker could abuse to run arbitrary scripts with elevated permissions. "Any cPanel user (including an attacker or a compromised account) may

Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw impacting Drupal Core to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability in question is CVE-2026-9082 (CVSS score: 6.5), an SQL injection vulnerability affecting all supported versions of Drupal Core. "Drupal Core

Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise https://www.welivesecurity.com/en/cybersecurity/foul-play-fake-fifa-world-cup-websites-tickets/ Watch out for bogus World Cup websites that mimic official ticket and merchandise flows to steal money and personal data

First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups https://thehackernews.com/2026/05/first-vpn-dismantled-in-global-takedown.html Authorities in Europe and North America have announced the dismantling of a criminal virtual private network (VPN) service used by criminal actors to obscure the origins of ransomware attacks, data theft, scanning, and denial-of-service attacks. The disruption of First VPN Service was led by France and the Netherlands, with several other nations supporting the investigation since December

Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware https://thehackernews.com/2026/05/ghostwriter-targets-ukraine-government.html The Belarus-aligned threat actor known as Ghostwriter (aka UAC-0057 and UNC1151Ukraine's National Security and Defense Council) has been observed using lures related to Prometheus, a Ukrainian online learning platform, to target government organizations in the country. The activity, per the Computer Emergency Response Team of Ukraine (CERT-UA), involves sending phishing emails to government

Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows https://thehackernews.com/2026/05/megalodon-github-attack-targets-5561.html Cybersecurity researchers have disclosed details of a new automated campaign called Megalodon that has pushed 5,718 malicious commits to 5,561 GitHub repositories within a six-hour window. "Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected GitHub Actions workflows containing base64-encoded bash payloads that exfiltrate CI

Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective https://thehackernews.com/2026/05/making-vulnerable-drivers-exploitable.html 1 Introduction This article provides a technical analysis of how many Windows kernel mode drivers can be interacted with from user mode without the hardware they were developed for. This work was motivated by driver-oriented vulnerability research and the need to evaluate the exploitability of individual findings, which frequently affect code whose reachability is hardware-gated. The

Kimwolf DDoS Botnet Operator Arrested in Canada Over DDoS-for-Hire Attacks https://thehackernews.com/2026/05/kimwolf-ddos-botnet-operator-arrested.html The U.S. Department of Justice (DoJ) on Thursday announced the arrest of a Canadian man in connection with allegedly operating a distributed denial-of-service (DDoS) botnet known as Kimwolf. In tandem, Jacob Butler (aka Dort), 23, Ottawa, Canada, has been charged with offenses related to the development and operation of the botnet. Kimwolf is assessed to be a variant of AISURU. "Kimwolf

CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV https://thehackernews.com/2026/05/cisa-adds-exploited-langflow-and-trend.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Langflow and Trend Micro Apex One to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are listed below - CVE-2025-34291 (CVSS score: 9.4) - An origin validation error vulnerability in Langflow that could

Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access https://thehackernews.com/2026/05/cisco-patches-cvss-100-secure-workload.html Cisco has rolled out updates for a maximum-severity security flaw impacting Secure Workload that could allow an unauthenticated, remote attacker to access sensitive data. Tracked as CVE-2026-20223 (CVSS score: 10.0), the vulnerability arises from insufficient validation and authentication when accessing REST API endpoints. "An attacker could exploit this vulnerability if they are able to send

Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor https://thehackernews.com/2026/05/showboat-linux-malware-hits-middle-east.html Cybersecurity researchers have disclosed details of a new Linux malware dubbed Showboat that has been put to use in a campaign targeting a telecommunications provider in the Middle East since at least mid-2022. "Showboat is a modular post-exploitation framework designed for Linux systems, capable of spawning a remote shell, transferring files, and functioning as a SOCKS5 proxy," Lumen

ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories https://thehackernews.com/2026/05/threatsday-bulletin-linux-rootkits.html This week starts small. A token leaks. A bad package slips in. A login trick works. An old tool shows up again. At first, it feels like the usual mess. Then you see the pattern: attackers are not always breaking in. They are using the parts we already trust. That is what makes it worrying. The danger is in normal things now - updates, apps, cloud buttons, support chats, trusted accounts. AI

Microsoft Warns of Two Actively Exploited Defender Vulnerabilities https://thehackernews.com/2026/05/microsoft-warns-of-two-actively.html Microsoft has disclosed that a privilege escalation and a denial-of-service flaw in Defender has come under active exploitation in the wild. The former, tracked as CVE-2026-41091, is rated 7.8 on the CVSS scoring system. Successful exploitation of the flaw could allow an attacker to gain SYSTEM privileges. "Improper link resolution before file access ('link following') in Microsoft Defender

When Identity is the Attack Path https://thehackernews.com/2026/05/when-identity-is-attack-path.html Consider a cached access key on a single Windows machine. It got there the way most cached credentials do - a user logged in, and the key stored itself automatically. Standard AWS behavior. No one misconfigured anything or violated a policy. Yet that single key, which was easily accessible to a minor-league attacker, could have opened a path to some 98% of entities in the company's cloud