Stay ahead of emerging threats with expert analysis from 118 published security articles, vulnerability reports, and cybersecurity insights — updated daily with the latest CVEs, threat actor campaigns, and security advisories. Opening the week of May 18 – May 24, 2026 (Tuesday outlook): the new week kicks off with back-to-back CRITICAL advisories — NGINX rewrite-module flaw CVE-2026-42945 hit active exploitation within days of disclosure on Monday, an 18-year-old bug now sitting on every NGINX-fronted application stack, and Cisco Catalyst SD-WAN CVE-2026-20182 landed Sunday at CVSS 10.0 under active exploitation by UAT-8616 with no workaround. Carrying forward from last week, Microsoft Exchange XSS CVE-2026-42897 remains under active attack with CISA listing in the Known Exploited Vulnerabilities catalog, May 2026 Patch Tuesday's unauthenticated Netlogon and DNS RCE pair stays the priority server-side patch at CVSS 9.8, and Ivanti EPMM CVE-2026-6973 still triggers the 3-day federal deadline for any organization running on-prem mobile device management. If your business depends on an NGINX-fronted application, a Cisco SD-WAN fabric, on-premises Exchange, or Ivanti EPMM, this week's advisories require action today — start with the article-level remediation steps below.
Iranian APT MuddyWater deploys Dindoor backdoor against US banks, airports, and defense contractors using Deno JavaScript runtime. Detect and defend.
Critical Veeam Backup flaw lets attackers delete backup repos without credentials. Ransomware gangs exploiting CVE-2026-29849 to eliminate recovery options.
Read moreCISA confirmed active exploitation of CVE-2017-7921 (Hikvision cameras) and CVE-2021-22681 (Rockwell Automation controllers), both CVSS 9.8. Federal agencies must patch by March 26, 2026. Legacy vulnerabilities remain potent weapons in attacker arsenals.
Read moreCISA added CVE-2026-22719 (CVSS 8.1) to the Known Exploited Vulnerabilities catalog after confirming active exploitation. The command injection flaw in VMware Aria Operations allows unauthenticated RCE. Federal agencies must patch by March 24, 2026.
Read moreAkamai confirms APT28 (Fancy Bear/GRU) was actively exploiting CVE-2026-21513 (CVSS 8.8) in the MSHTML Framework before Microsoft's February patch. The attack uses crafted LNK files to bypass Mark-of-the-Web and execute malicious payloads as trusted local content.
Read moreAkamai confirmed Russia's APT28 was exploiting CVE-2026-21513 in Windows MSHTML before Microsoft released the February patch. The attack chains crafted LNK files to bypass Mark-of-the-Web and IE Enhanced Security, delivering payloads without user interaction.
Read moreShadowserver reports 900+ Sangoma FreePBX instances worldwide remain infected with web shells exploiting CVE-2025-64328 (CVSS 8.6). The INJ3CTOR3 threat actor deploys EncystPHP web shells for command execution and fraudulent outbound calls. US leads with 401 compromised systems.
Read moreZscaler ThreatLabz discovered ScarCruft (APT37) running the "Ruby Jumper" campaign that bridges air-gapped networks using weaponized USB drives. The operation abuses Zoho WorkDrive for C2 and deploys multiple malware families including THUMBSBD, FOOTWINE, and BLUELIGHT for surveillance and data exfiltration.
Read moreCisco disclosed CVE-2026-20127 (CVSS 10.0), an authentication bypass in Catalyst SD-WAN that sophisticated threat actor UAT-8616 has exploited since 2023. The attack chain creates rogue peers, downgrades software to exploit older CVEs, and achieves root persistence. CISA issued Emergency Directive 26-03 requiring 24-hour patching.
Read moreFormer L3Harris contractor Peter Williams sentenced to 87 months for selling eight zero-day exploits to Russian broker Operation Zero for $4 million. The U.S. government simultaneously sanctioned Operation Zero, its leader Sergey Zelenyuk, and connected entities for acquiring cyber tools harmful to national security.
Read moreAnthropic revealed that DeepSeek, Moonshot AI, and MiniMax ran industrial-scale distillation attacks using 24,000 fraudulent accounts to systematically extract Claude's reasoning, coding, and agentic capabilities across 16 million exchanges. Google disclosed similar attacks on Gemini weeks earlier.
Read moreAmazon Threat Intelligence reveals a Russian-speaking actor with limited skills compromised 600+ FortiGate devices using DeepSeek and Claude. The campaign exploited exposed management interfaces and weak credentials, demonstrating how AI has democratized sophisticated attack capabilities.
Read moreAmazon Threat Intelligence documents a Russian-speaking threat actor who compromised 600+ FortiGate devices across 55 countries using AI-assisted tools. No zero-days were exploited—just exposed management interfaces and weak credentials, with generative AI helping an unsophisticated attacker scale their operations.
Read moreUnit 42 documents active exploitation of CVE-2026-1731 (CVSS 9.9) in BeyondTrust Remote Support and PRA. Attackers are deploying web shells, VShell, Spark RAT, and exfiltrating PostgreSQL dumps. CISA confirms ransomware campaigns are leveraging this vulnerability.
Read moreESET researchers discovered PromptSpy, an Android malware that uses Google's Gemini AI to dynamically navigate device interfaces and maintain persistence. The malware sends screen captures to Gemini, which responds with tap instructions, effectively solving Android fragmentation for attackers.
Read moreA maximum-severity zero-day in Dell RecoverPoint for Virtual Machines (CVSS 10.0) has been exploited by Chinese state-sponsored hackers since mid-2024. The flaw involves hard-coded Tomcat credentials enabling root access. CISA has added it to the KEV catalog with a 3-day patch deadline.
Read moreFour of the most popular VS Code extensions with over 125 million combined installs contain critical vulnerabilities that could let attackers steal files, execute code, and compromise entire organizations from a developer workstation. Three remain unpatched.
Read moreGoogle released emergency updates to patch CVE-2026-2441, a high-severity use-after-free vulnerability in Chrome's CSS handling that attackers are actively exploiting. All Chromium-based browsers are affected.
Read moreGoogle patches CVE-2026-2441, a high-severity use-after-free in Chrome actively exploited in the wild. This is Chrome first zero-day of 2026. Update immediately.
Read moreA critical pre-authentication RCE vulnerability in BeyondTrust Remote Support and Privileged Remote Access is now being actively exploited after a proof-of-concept was published. With a CVSS of 9.9 and approximately 8,500 unpatched on-premise deployments exposed, organizations must patch immediately.
Read moreOur CyberOne MobileAssess platform performs deep static analysis, source code decompilation, and runtime security testing for iOS and Android apps. From one-time assessments to year-long continuous testing, we find what surface-level scanners miss.
Subscribe to our newsletter and get the latest security insights delivered to your inbox.
