News

A malicious version of the Checkmarx Jenkins AST plugin was published to the Jenkins Marketplace as part of a supply chain attack, SecurityWeek reports. According to Checkmarx, users should ensure they are running version 2.0.13-829.vc72453fa_1c16 of the…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a flaw in BerriAI LiteLLM, tracked as CVE-2026-42208, to its Known Exploited Vulnerabilities catalog, with a CVSS score of 9.3. At the end of April, attackers rapidly exploited the…

SecurityWeek reports a newly disclosed local privilege escalation flaw in major Linux distributions, named Dirty Frag and Copy Fail 2, tracked as CVE-2026-43284 and CVE-2026-43500, which lets an unprivileged user escalate to root. The vulnerability affects…

The second iteration of the Crimenetwork crime marketplace, which had over 22,000 users and more than 100 sellers, was shut down by the German police last week. Crimenetwork had been resurrected after its December 2024 takedown, and the original platform had…

Instagram has removed end-to-end encryption for its direct messages, with the change taking effect on 8 May 2026 and giving Meta access to chats that were previously readable only by the sender and recipient. Users affected are advised to download any media…

A week in security (May 4 – May 10) was published by Malwarebytes Labs on 11 May 2026. According to Malwarebytes Labs, the week’s highlights include a post noting that Microsoft says Edge’s plaintext password behavior is “by design” and coverage of…

According to SOCRadar, more than four years into a phishing campaign, hundreds of victims across multiple sectors have been affected, with the campaign dubbed Operation HookedWing. The operation was first documented in 2022, and over four years more than…

The ISC Stormcast for 11 May 2026 highlights a green threat level and confirms the day’s handler on duty as Didier Stevens. The diary page is a standard ISC update, listing Monday’s briefing as part of the ongoing Stormcast series and providing the usual…

According to SANS Internet Storm Center, YARA-X has released version 1.16.0, detailing four improvements alongside four bugfixes. The diary note, published on 10 May 2026 and last updated at 22:37:08 UTC, attributes authorship to Didier Stevens. It…

cPanel has released security updates for three flaws in cPanel & WHM that could let an attacker read files, run arbitrary code, or escalate privileges, though there is no current evidence of active exploitation. The vulnerabilities are CVE-2026-29201 (CVSS…

JDownloader’s official website was compromised in a supply chain style attack between 6 May and 7 May 2026, with attackers replacing legitimate Windows and Linux installers to deliver malicious files. The Windows installer reportedly carried a Python-based…

The Security Affairs Malware newsletter Round 96, written by Pierluigi Paganini and published on 10 May 2026, offers a curated collection of malware research and coverage from around the international security landscape. According to Security Affairs, the…

Security Affairs’ newsletter Round 576 – INTERNATIONAL EDITION, written by Pierluigi Paganini, arrived on 10 May 2026 and offers a curated weekly round-up of security reporting for an international audience. The issue highlights a set of featured stories,…

Researchers have uncovered Quasar Linux RAT (QLNX), a fileless Linux implant that targets developers and DevOps environments to steal credentials, log keystrokes, monitor systems, and provide remote access. The malware runs directly from memory, uses…

Braintrust warned customers to rotate API keys after attackers gained unauthorized access to one of the company’s AWS accounts, potentially exposing secrets used to connect to cloud-based AI models. The firm said it discovered suspicious activity on 4 May…

Elastic Security Labs’ report, published on 9 May 2026, examines Linux kernel privilege escalation vulnerabilities Copy Fail and DirtyFrag that exploit subtle page cache corruption to reach root, with Copy Fail already reported as exploited in the wild. It…

RansomHouse, a ransomware group, claimed responsibility for breaching cybersecurity firm Trellix, exposing its internal systems. They published screenshots to support their claims. Trellix confirmed unauthorized access to part of its source code repository…

According to ABW, Poland’s Internal Security Agency, hackers breached ICS at five water treatment plants in 2025, marking one of Europe’s clearest state-linked incursions into industrial control systems managing public water supplies. The affected sites were…

A newly disclosed Linux local privilege escalation vulnerability known as “Dirty Frag” enables escalation from an unprivileged user to root through vulnerable kernel networking and memory-fragment handling components, including esp4, esp6 (CVE-2026-43284),…

SecurityWeek reports the emergence of PamDOORa, a Linux backdoor marketed by a threat actor known as ‘darkworm’ that targets the Linux Pluggable Authentication Module (PAM) stack. The post-exploitation tool is designed to provide persistent SSH access while…

Microsoft says Edge’s plaintext password behaviour is “by design,” according to Microsoft. A security researcher tested major Chromium-based browsers and found Edge loads the entire password vault into plaintext process memory at startup, where it remains…