VulnHub

Drupal is set to release a core security update today to address a significant vulnerability that could be exploited by attackers shortly after its announcement. The organization has cautioned that malicious actors are likely to create exploits within hours of the update going public. This means that any websites or applications running on affected versions of Drupal could be at risk if they do not update promptly. Users of Drupal should prioritize applying this critical update to protect their systems from potential attacks. The announcement underscores the need for vigilance in maintaining the security of web applications, particularly those built on widely used platforms like Drupal.

A new malware strain known as Banana RAT is targeting customers of 16 Brazilian banks through deceptive tactics involving fake invoices and misleading security update screens. This malware is designed to steal sensitive information by tricking users into scanning fraudulent QR codes. The attack not only compromises personal data but also poses a significant financial risk to victims. As cybercriminals increasingly exploit these social engineering techniques, it's vital for users to remain vigilant and question unexpected communications that ask for sensitive information. The situation underscores the need for heightened security awareness among banking customers.

Researchers recently released a proof of concept (PoC) for a vulnerability in the Linux kernel known as DirtyDecrypt, which was patched back in April. This vulnerability allows local attackers to gain elevated privileges, potentially giving them root access to affected systems. While the vulnerability was addressed in a previous update, the release of the PoC means that those who haven't applied the patch could be at risk. It is crucial for users and administrators of Linux systems to ensure they are running the latest updates to mitigate this risk. The implications of this vulnerability are significant, especially for environments where security is paramount, such as servers and critical infrastructure.

A new variant of the SHub macOS infostealer has been discovered that tricks users into believing they need to install a security update. Using AppleScript, this malware presents a fake update message, which, when interacted with, leads to the installation of a backdoor on the user's system. This malicious software primarily targets macOS users, potentially compromising their personal information and system integrity. The ability to deceive users with a legitimate-looking update notice makes this variant particularly concerning. It underscores the need for users to be vigilant about unexpected prompts and verify updates directly from Apple's official channels.

A vulnerability in the Funnel Builder plugin for WordPress, which is used by over 40,000 websites, has been exploited by attackers to steal payment data. This flaw allows unauthenticated users to change global settings through an unprotected checkout endpoint. As a result, any website using this plugin could be at risk of having sensitive payment information compromised. Website owners should take immediate action to secure their sites, as the potential for financial loss and damage to customer trust is significant. This incident serves as a reminder for users to regularly update their plugins and monitor for security patches.

Google's latest Chrome update, version 148, addresses several critical vulnerabilities, including a serious use-after-free issue affecting various browser components. This type of vulnerability can allow attackers to execute arbitrary code, potentially leading to unauthorized access or data breaches. Users of Chrome should update to the latest version to ensure their browsers are secure. Keeping browsers up to date is crucial, as these vulnerabilities can be exploited if left unpatched. The update underscores the ongoing need for vigilance in cybersecurity, especially given the frequency of browser-based attacks.

OpenAI has confirmed that two of its employees' devices were compromised in a recent supply chain attack involving TanStack, which affected a wide range of npm and PyPI packages. As a precautionary measure, OpenAI has rotated its code-signing certificates to enhance security. This incident highlights the vulnerabilities that can arise from supply chain attacks, where attackers target third-party packages to infiltrate larger systems. While OpenAI has not specified if any of its applications were directly exploited, the breach raises concerns about the security of software dependencies and the potential risks to users and developers who rely on these packages. Companies are reminded to regularly review their security practices and update their systems accordingly.

Recent cyber campaigns attributed to Chinese advanced persistent threat (APT) groups have expanded their targets and updated their tactics. The group known as Salt Typhoon has reportedly attacked an energy entity in Azerbaijan, raising concerns about the security of critical infrastructure in the region. Another group, Twill Typhoon, has focused on entities in Asia, deploying an updated remote access Trojan (RAT) that enhances their capabilities. These developments suggest that these APTs are adapting to better infiltrate and exploit various sectors, which could lead to increased risks for organizations in affected areas. As these campaigns evolve, organizations need to bolster their cybersecurity measures to defend against such sophisticated attacks.

A new malware known as 'Mini Shai-Hulud' has compromised hundreds of open-source packages in a significant supply-chain attack. This malware has targeted major registries, disguising itself behind legitimate release signatures, which allows it to infiltrate software updates unnoticed. As a result, developers and organizations relying on these open-source packages may unknowingly integrate malicious code into their applications. This incident emphasizes the vulnerabilities present in the software update process and raises concerns about the security of open-source software. Researchers are urging developers to be vigilant and to verify the integrity of their dependencies before use.

Instructure, the company behind the educational platform Canvas, has come to an agreement with the cybercrime group ShinyHunters after they breached Instructure's network. The attackers threatened to leak 3.65TB of sensitive information, which includes data from thousands of schools and universities. Instructure announced the agreement in an update, although specifics of the deal were not disclosed. This incident raises concerns about the security of educational institutions and the potential exposure of student and faculty information. The breach highlights the vulnerabilities that many organizations face in safeguarding their networks against cyber threats.

In May 2026, a significant update was released, addressing 130 Common Vulnerabilities and Exposures (CVEs), including 30 classified as critical. These vulnerabilities impact various software and systems, potentially affecting millions of users and organizations. Notably, the update includes patches for several widely-used products, emphasizing the urgent need for companies to apply these updates to protect their systems from potential exploitation. Researchers warn that failure to address these vulnerabilities could lead to serious security breaches, as attackers often target systems that have not been updated. Users and IT departments should prioritize these patches to enhance their cybersecurity posture and mitigate risks associated with the newly disclosed vulnerabilities.

The article discusses several cybersecurity topics, including new vulnerabilities and incidents. Notably, it mentions a zero-day exploit affecting Canvas, a learning management system used by educational institutions. This vulnerability could allow attackers to execute unauthorized code, putting sensitive student data at risk. Additionally, it highlights the QuasarRat malware, which has been observed in the wild, targeting various systems. The article also touches on compliance issues faced by companies like Anthropic regarding EU regulations, which can impact their operations. Overall, these developments serve as a reminder for organizations to stay vigilant and update their security measures regularly to protect against evolving threats.