CVE-2026-9082 on DanSec Daily

Cybersecurity Brief – 2026-05-23

Sat, 23 May 2026 00:00:00 +0000

Major Incidents or Breaches

Cloud Atlas has targeted public sector and diplomatic entities in Russia and Belarus, employing new tools including PowerCloud, and leveraging ReverseSocks, SSH, and Tor for persistence on infected systems ^[1].
The Belarus-aligned threat actor Ghostwriter has conducted phishing campaigns against Ukrainian government entities using lures associated with the Prometheus online learning platform ^[10].
The Megalodon automated attack campaign pushed over 5,700 malicious commits to more than 5,500 GitHub repositories within six hours, exploiting CI/CD workflows ^[11].
Authorities in Europe and North America dismantled the “First VPN” criminal VPN service, which was used by at least 25 ransomware groups to facilitate attacks and obscure their origins ^[9]^[30].
Dutch authorities seized 800 servers belonging to a hosting provider that enabled cyberattacks, interference operations, and disinformation campaigns, arresting two individuals ^[14].
A Canadian man was arrested and charged in connection with operating the Kimwolf DDoS botnet, which infected nearly two million devices globally and was used for DDoS-for-hire attacks ^[13]^[20]^[29].
Former US executives pleaded guilty to concealing a tech support fraud scheme that impacted victims worldwide ^[15].

Newly Discovered Vulnerabilities

A maximum-severity vulnerability (CVE-2026-48172, CVSS 10.0) in the LiteSpeed User-End cPanel Plugin is under active exploitation, allowing attackers to execute scripts as root ^[7].
A critical SQL injection vulnerability (CVE-2026-9082) in Drupal Core is being actively exploited in the wild and has been added to CISA’s Known Exploited Vulnerabilities catalog ^[8]^[17]^[27].
Trend Micro patched a zero-day directory traversal vulnerability (CVE-2026-34926) in Apex One, which has been exploited in attacks targeting Windows systems ^[16]^[31].
Ubiquiti released updates to address three maximum severity vulnerabilities in UniFi OS, which could be exploited by remote, unauthenticated attackers ^[19].
Google released security updates for Chrome to address critical vulnerabilities that could allow remote code execution via malicious websites ^[33].

Notable Threat Actor Activity

Cloud Atlas has updated its toolkit, incorporating PowerCloud and using ReverseSocks, SSH, and Tor for persistence, targeting government and diplomatic organizations in Russia and Belarus ^[1].
Ghostwriter (UAC-0057/UNC1151), aligned with Belarus, is using Prometheus-themed phishing to target Ukrainian governmental bodies ^[10].
Multiple Iran-nexus threat actors, including Nimbus Manticore, have been active during recent Middle East geopolitical tensions, advancing Iran’s strategic cyber objectives ^[32].

Trends, Tools, or Tactics of Interest

The Tycoon 2FA phishing-as-a-service platform has evolved to leverage OAuth device code phishing, enabling compromise of accounts protected by multifactor authentication ^[2].
Automated malicious commit campaigns, exemplified by Megalodon, are targeting thousands of GitHub repositories by exploiting CI/CD workflows ^[11].
There is an observed trend of threat actors making Windows kernel drivers exploitable from user mode without requiring the original hardware, broadening the attack surface for Bring Your Own Vulnerable Driver (BYOVD) attacks ^[12].
Fake FIFA World Cup websites are targeting soccer fans with phishing schemes designed to steal money and personal data by mimicking official ticketing and merchandise flows ^[6].
Social engineering attacks against the healthcare sector are increasing in sophistication and frequency, as highlighted in Verizon’s 2026 Data Breach Investigations Report ^[22].

Regulatory or Policy Developments Affecting the Security Industry

Lawmakers in the US are demanding answers from CISA following a contractor-related data leak, raising questions about oversight and data security practices within the agency ^[25]^[28].
The addition of the Drupal Core SQL injection vulnerability to the CISA Known Exploited Vulnerabilities catalog mandates accelerated patching timelines for US federal agencies ^[8].

Sources

Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload - securelist.com
Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware - thehackernews.com
Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows - thehackernews.com
First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups - thehackernews.com
‘First VPN’ Cybercrime Service Disrupted, Administrator Arrested - securityweek.com
Netherlands seizes 800 servers of hosting firm enabling cyberattacks - bleepingcomputer.com
Kimwolf DDoS Botnet Operator Arrested in Canada Over DDoS-for-Hire Attacks - thehackernews.com
US and Canada arrest and charge suspected Kimwolf botnet admin - bleepingcomputer.com
Canadian Man Arrested for Operating Kimwolf Botnet - securityweek.com
Former US execs plead guilty to aiding tech support scammers - bleepingcomputer.com
LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root - thehackernews.com
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV - thehackernews.com
Drupal: Critical SQL injection flaw now targeted in attacks - bleepingcomputer.com
Drupal Vulnerability in Hacker Crosshairs Shortly After Disclosure - securityweek.com
Trend Micro warns of Apex One zero-day exploited in the wild - bleepingcomputer.com
TrendAI Patches Apex One Zero-Day Exploited in the Wild - securityweek.com
Ubiquiti patches three max severity UniFi OS vulnerabilities - bleepingcomputer.com
Update Chrome now: Critical bugs could let attackers run code - malwarebytes.com
Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict - research.checkpoint.com
Report: The Tycoon 2FA Phishing Kit Has Evolved - blog.knowbe4.com
Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective - thehackernews.com
Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise - welivesecurity.com
Verizon DBIR: Healthcare Fends Off Increased Social Engineering Attacks - darkreading.com
Lawmakers Demand Answers as CISA Tries to Contain Data Leak - krebsonsecurity.com
In Other News: Industrial Router Exploitation, CISA KEV Nomination Form, Gas Station Hacking - securityweek.com

Cybersecurity Brief – 2026-05-22

Fri, 22 May 2026 00:00:00 +0000

Major Incidents or Breaches

GitHub disclosed that attackers accessed internal repositories after compromising an employee device via a malicious Visual Studio Code extension. The breach was reportedly limited in scope but highlights successful social engineering against developer tooling ^[1].
Grafana confirmed that hackers accessed its GitHub repositories and stole codebase and other data by exploiting a token compromised during the TanStack supply chain attack, which had not been rotated ^[34].
A glitch in Robinhood’s account creation process was exploited to send phishing emails from the platform’s own systems to customers ^[3].
Canadian authorities arrested an individual alleged to be the botmaster behind Kimwolf, an IoT botnet that enslaved millions of devices for DDoS and credential stuffing attacks ^[28].
Law enforcement seized the ‘First VPN’ service, which was used to facilitate ransomware and data theft operations ^[16].

Newly Discovered Vulnerabilities

Cisco addressed a maximum-severity vulnerability (CVE-2026-20223) in Secure Workload’s REST API that allowed unauthenticated, remote attackers to access sensitive data and gain Site Admin privileges ^[6]^[15]^[35].
Microsoft disclosed and patched two actively exploited vulnerabilities in Defender, one allowing privilege escalation (CVE-2026-41091) and another enabling denial-of-service, both observed in the wild ^[9]^[40]^[42].
Trend Micro Apex One on-premise was found to have a directory traversal flaw (CVE-2026-34926) actively exploited in the wild ^[5]^[33].
Drupal patched a highly critical vulnerability (CVE-2026-9082) that could be exploited without authentication for information disclosure, privilege escalation, and remote code execution ^[38].
Google accidentally exposed details of an unfixed Chromium flaw that allows JavaScript to run in the background after the browser is closed, enabling potential remote code execution ^[11].
Google API keys were found to remain active for 23 minutes after deletion, contrary to the expected immediate invalidation ^[20].

Notable Threat Actor Activity

Chinese cyber-espionage groups have been targeting telecommunications providers in the Middle East and Central Asia with new Linux (Showboat) and Windows (JFMBackdoor) malware families ^[7]^[14]^[22].
TeamPCP, a threat group, has been conducting an unprecedented scale of software supply chain attacks, recently impacting GitHub and hundreds of organizations ^[27].
China-linked APT Webworm utilized Discord, Microsoft Graph, and SOCKS proxies such as SoftEther VPN for attacks targeting EU governments ^[18].

Trends, Tools, or Tactics of Interest

Attackers are increasingly targeting developer tools and software supply chains, as evidenced by incidents involving GitHub, TanStack, and TeamPCP ^[1]^[27]^[34].
The Underminr domain-fronting attack method enables threat actors to exploit content delivery mechanisms for website brand hijacking by modifying web requests and cloaking malicious activity ^[23].
Crypto drainer platforms like Lucifer DaaS are scaling wallet theft through sophisticated phishing and automation rather than direct wallet hacking ^[13].
A new cross-platform Node.js stealer was observed, designed to exfiltrate credentials and other data, with heavy obfuscation to evade detection ^[29].
AI-driven vulnerability discovery is contributing to a surge in Chrome vulnerability reports, with over 200 vulnerabilities patched in recent releases ^[41].
AI agent identity management is emerging as a significant area of concern, with new research highlighting budgetary shifts and the need for governance as AI agent projects proliferate in enterprises ^[21].

Regulatory or Policy Developments Affecting the Security Industry

CISA updated its Known Exploited Vulnerabilities (KEV) catalog to include new vulnerabilities and introduced a nomination form to facilitate broader reporting and tracking of exploited flaws ^[5]^[32].
The US Federal Trade Commission (FTC) fined three firms nearly $1 million for selling a purported “Active Listening” technology for targeted advertising, which was found to be fraudulent ^[26].

Sources

[Heads Up] GitHub Breach Shows Developer Tools Are Social Engineering Targets - blog.knowbe4.com
Grafana Says Codebase and Other Data Stolen via TanStack Supply Chain Attack - securityweek.com
Robinhood Glitch Allowed Attackers to Send Phishing Emails to Customers - blog.knowbe4.com
Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada - krebsonsecurity.com
Police seize “First VPN” service used in ransomware, data theft attacks - bleepingcomputer.com
Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access - thehackernews.com
Max severity Cisco Secure Workload flaw gives Site Admin privileges - bleepingcomputer.com
Cisco Patches Critical Vulnerability in Secure Workload - securityweek.com
Microsoft Warns of Two Actively Exploited Defender Vulnerabilities - thehackernews.com
Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days - securityweek.com
Microsoft Defender vulnerabilities are being exploited in the wild - malwarebytes.com
CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV - thehackernews.com
TrendAI Patches Apex One Zero-Day Exploited in the Wild - securityweek.com
Drupal Patches Highly Critical Vulnerability Exposing Websites to Hacking - securityweek.com
Google accidentally exposed details of unfixed Chromium flaw - bleepingcomputer.com
Google API Keys Remain Active After Deletion - darkreading.com
Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor - thehackernews.com
Chinese hackers target telcos with new Linux, Windows malware - bleepingcomputer.com
Chinese APTs Share Linux Backdoor in Central Asia Telco Attacks - darkreading.com
A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale - wired.com
China's Webworm Uses Discord, Microsoft Graphs to Hack EU Govts. - darkreading.com
Content Delivery Exploit Opens Websites to Brand Hijacking - darkreading.com
Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet - bleepingcomputer.com
Cross-Platform NPM Stealer, (Fri, May 22nd) - isc.sans.edu
Google’s Surge in Chrome Vulnerability Discoveries Likely Driven by AI - securityweek.com
AI Agents Are Shifting Identity Security Budget Dynamics - darkreading.com
CISA Enhances Known Exploited Vulnerabilities Catalog to Include New Nomination Form - cisa.gov
‘Creepy’ Listening Tool for Targeted Ads Didn’t Actually Work, FTC Says - wired.com