en
CVE-2026-26980: Ghost CMS SQL Injection Actively Exploited to Hijack 700+ Sites for ClickFix Attacks
Technical breakdown of the Ghost CMS SQL injection exploited at scale to inject fake browser update (ClickFix) malware into 700+ websites.
News
en
Megalodon: 5,561 GitHub Repos Backdoored via Infostealer-Sourced CI Credentials
How campaign Megalodon weaponized infostealer-harvested developer secrets to backdoor 5,561 GitHub repositories in automated CI runs.
en
CopyFail, Dirty Frag, and Fragnesia: The Linux Kernel Page Cache LPE Trilogy
Technical breakdown of CopyFail, Dirty Frag, and Fragnesia: how three page-cache memory flaws enabled unprivileged local root escalation in the Linux kernel.
en
Security Roundup: Exchange Zero-Day, GitHub Breach, Cisco SD-WAN, Defender Zero-Days — Week of May 21, 2026
Weekly briefing: Microsoft Exchange OWA zero-day XSS, TeamPCP GitHub breach (3.8K repos), Cisco SD-WAN UAT-8616, and Defender zero-days.
en
CVE-2026-41091 & CVE-2026-45498: Microsoft Defender Zero-Days Under Active Exploitation
Technical root cause for the dual Microsoft Defender zero-days exploited to evade AV scanning and achieve privilege escalation.
en
CVE-2026-20182: Cisco SD-WAN Authentication Bypass Exploited by Nation-State Actor UAT-8616
How nation-state threat group UAT-8616 weaponized a Cisco SD-WAN authentication bypass to compromise enterprise transit hubs.
en
GitHub Internal Breach: TeamPCP Exfiltrates 3,800 Repos via Poisoned VS Code Extension
Investigation into how TeamPCP used a poisoned VS Code Marketplace extension to pivot into developer workstations and exfiltrate 3,800 GitHub repositories.
en
CVE-2026-42897: Microsoft Exchange OWA XSS Zero-Day — No Patch, Active Exploitation
How threat actors are actively weaponizing an unpatched stored XSS zero-day in Microsoft Exchange OWA to hijack mailbox session tokens.
en
Mini Shai-Hulud: The TanStack Supply Chain Attack That Defeated SLSA Provenance
How the Mini Shai-Hulud attack poisoned TanStack npm packages and bypassed SLSA Level 3 build provenance guarantees.