Security Brief Daily

Episode 57 — 15 May 2026 1. Hackers exploit auth bypass flaw in Burst Statistics WordPress plugin Source: Bleeping Computer Hackers are leveraging a critical authentication bypass vulnerability in the WordPress plugin Burst Statistics to obtain admin-level access to websites. Burst Statistics is a privacy-focused analytics plugin active on 200,000 WordPress sites and marketed as a lightweight... 2...

Episode 56 — 14 May 2026 1. Windows BitLocker zero-day gives access to protected drives, PoC released Source: Bleeping Computer A cybersecurity researcher has published proof-of-concept (PoC) exploits for two unpatched Microsoft Windows vulnerabilities named YellowKey and GreenPlasma, which are a BitLocker bypass and a privilege-escalation flaw. Known as Chaotic Eclipse or Nightmare Eclipse, the.....

Episode 55 — 13 May 2026 1. Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator Source: Bleeping Computer Fortinet has released security updates to address two critical vulnerabilities in FortiSandbox and FortiAuthenticator that could enable attackers to run commands or arbitrary code on unpatched systems. The first one, tracked as CVE-2026-44277, impacts the company's... 2...

Episode 54 — 12 May 2026 1. Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation Source: The Hacker News Google on Monday disclosed that it identified an unknown threat actor using a zero-day exploit that it said was likely developed with an artificial intelligence (AI) system, marking the first time the technology has been put to use in the wild in a malicious context...

Episode 53 — 11 May 2026 1. Google: Hackers used AI to develop zero-day exploit for web admin tool Source: Bleeping Computer Researchers at Google Threat Intelligence Group (GTIG) say that a zero-day exploit targeting a popular open-source web administration tool was likely generated using AI. The exploit could be leveraged to bypass the two-factor authentication (2FA) protection in a popular... 2...

Episode 51 — 09 May 2026 1. NVIDIA confirms GeForce NOW data breach affecting Armenian users Source: Bleeping Computer NVIDIA has confirmed in a statement for BleepingComputer that GeForce NOW user information has been exposed in a data breach. The gaming and hardware giant has clarified that the impact is limited to Armenia, and was caused by a compromise of the infrastructure operated by a... 2....

Episode 50 — 08 May 2026 1. New Linux 'Dirty Frag' zero-day gives root on all major distros Source: Bleeping Computer A new Linux zero-day vulnerability, named Dirty Frag, allows local attackers to gain root privileges on most major Linux distributions with a single command. Security researcher Hyunwoo Kim, who disclosed the flaw earlier today and published a proof-of-concept (PoC) exploit,... 2....

Episode 49 — 07 May 2026 1. New Cisco DoS flaw requires manual reboot to revive devices Source: Bleeping Computer Cisco released security updates to fix a Crosswork Network Controller (CNC) and Network Services Orchestrator (NSO) denial-of-service (DoS) vulnerability that requires manually rebooting targeted systems for recovery. Large enterprises and service providers leverage the CNC... 2. Criti...

Episode 48 — 06 May 2026 1. Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution Source: The Hacker News Palo Alto Networks has released an advisory warning that a critical buffer overflow vulnerability in its PAN-OS software has been exploited in the wild. The vulnerability, tracked as CVE-2026-0300, has been described as a case of unauthenticated remote code execution. I...

Episode 47 — 05 May 2026 1. Weaver E-cology critical bug exploited in attacks since March Source: Bleeping Computer Hackers have been exploiting a critical vulnerability (CVE-2026-22679) in the Weaver E-cology office automation since mid-March to run discovery commands. The attacks started five days after the software vendor released a security update to address the issue, and two weeks... 2. Amaz...

Episode 46 — 04 May 2026 1. Instructure confirms data breach, ShinyHunters claims attack Source: Bleeping Computer Educational tech giant Instructure has confirmed that data was stolen in a cyberattack, with the ShinyHunters extortion gang claiming responsibility. Instructure is a U.S.-based education technology company best known for developing Canvas, a widely used learning management... 2. Crit...

Episode 44 — 02 May 2026 1. Trellix Confirms Source Code Breach With Unauthorized Repository Access Source: The Hacker News Cybersecurity company Trellix has announced that it suffered a breach that enabled unauthorized access to a "portion" of its source code. It said it "recently identified" the compromise of its source code repository and that it began working with "leading forensic experts" to...

Episode 43 — 01 May 2026 1. US ransomware negotiators get 4 years in prison over BlackCat attacks Source: Bleeping Computer Two former employees of cybersecurity incident response companies Sygnia and DigitalMint were sentenced to four years in prison each for targeting U.S. companies in BlackCat (ALPHV) ransomware attacks. 40-year-old Ryan Clifford Goldberg (a former Sygnia incident response... 2...

Episode 42 — 30 Apr 2026 1. Hackers exploit RCE flaws in Qinglong task scheduler for cryptomining Source: Bleeping Computer Hackers are exploiting two authentication bypass vulnerabilities in the Qinglong open-source task scheduling tool to deploy cryptominers on developers' servers. Exploitation started in early February, before the security issues were disclosed publicly at the end of the month,...

Episode 41 — 29 Apr 2026 1. CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV Source: The Hacker News The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting ConnectWise ScreenConnect and Microsoft Windows to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities... 2. R...

Episode 40 — 28 Apr 2026 1. Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202 Source: The Hacker News Microsoft on Monday revised its advisory for a now-patched, high-severity security flaw impacting Windows Shell to acknowledge that it has been actively exploited in the wild. The vulnerability in question is CVE-2026-32202 (CVSS score: 4.3), a spoofing vulnerability that... 2...

Episode 39 — 27 Apr 2026 1. American utility firm Itron discloses breach of internal IT network Source: Bleeping Computer Utility technology company Itron, Inc. has disclosed that an unauthorized third party accessed some of its internal systems during a cyberattack. The company states that it activated its cybersecurity response plan when detecting the activity last month, notified law... 2. Thre...

Episode 38 — 26 Apr 2026 1. ADT confirms data breach after ShinyHunters leak threat Source: Bleeping Computer Home security giant ADT has confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom is paid. In a statement shared today, the company said it detected unauthorized access to customer and prospective customer data on April... 2. Firestar...

Episode 37 — 25 Apr 2026 1. ADT confirms data breach after ShinyHunters leak threat Source: Bleeping Computer Home security giant ADT has confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom is paid. In a statement shared today, the company said it detected unauthorized access to customer and prospective customer data on April... 2. Over 10,...

Episode 36 — 24 Apr 2026 1. LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure Source: The Hacker News A high-severity security flaw in LMDeploy, an open-source toolkit for compressing, deploying, and serving LLMs, has come under active exploitation in the wild less than 13 hours after its public disclosure. The vulnerability, tracked as CVE-2026-33626 (CVSS score: 7.5),... 2. CI...

Episode 35 — 23 Apr 2026 1. New Mirai campaign exploits RCE flaw in EoL D-Link routers Source: Bleeping Computer A new Mirai-based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability affecting D-Link DIR-823X routers, to enlist devices into the botnet. CVE-2025-29635 allows an attacker to execute arbitrary commands on remote devices by... 2. Micr...

Episode 34 — 22 Apr 2026 1. Microsoft releases emergency patches for critical ASP.NET flaw Source: Bleeping Computer Microsoft has released out-of-band (OOB) security updates to patch a critical ASP.NET Core privilege escalation vulnerability. The security flaw (tracked as CVE-2026-40372 ) was found in the ASP.NET Core Data Protection cryptographic APIs, and it could allow unauthenticated... 2. Ov...

Episode 33 — 21 Apr 2026 1. China's Apple App Store infiltrated by crypto-stealing wallet apps Source: Bleeping Computer A set of 26 malicious apps on Apple App Store impersonate popular wallets, such as Metamask, Coinbase, Trust Wallet, and OneKey, to steal recovery or seed phrases and drain them of cryptocurrency assets. The threat actor used multiple methods to imitate official products,... 2....

Episode 32 — 20 Apr 2026 1. Vercel confirms breach as hackers claim to be selling stolen data Source: Bleeping Computer Update 4/19/26: Added additional information from Vercel that was disclosed after publishing. Cloud development platform Vercel has disclosed a security incident after threat actors claimed to have breached its systems and are attempting to sell stolen data. Vercel is a cloud......

Episode 28 — 16 Apr 2026 1. US nationals behind DPRK IT worker 'laptop farm' sent to prison Source: Bleeping Computer Two U.S. nationals have been sent to prison for helping North Korean remote information technology (IT) workers to pose as U.S. residents and get hired by over 100 companies across the country, including many Fortune 500 firms. 42-year-old Kejia Wang and 39-year-old Zhenxing... 2....