Cyber Threat Brief
2026-05-30: Palo Alto GlobalProtect bypass is now actively exploited with CISA adding CVE-2026-0257 to KEV
Description
SHOW NOTES - 2026-05-30 STORIES COVERED * Today: * Gogs Zero-Day Exposes Servers to Remote Code Execution (CVE-2025-8110) [https://www.securityweek.com/gogs-zero-day-exposes-servers-to-remote-code-execution/] [Critical Alerts] * PAN-OS GlobalProtect Authentication Bypass Under Active Exploitation (CVE-2026-0257) [https://thehackernews.com/2026/05/pan-os-globalprotect-authentication.html] [Critical Alerts] * Marimo Post-Exploitation via LLM Agent (CVE-2026-39987) [https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html] [Critical Alerts] * Silent Ransom Group Escalates to Physical Intrusions [https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-22-7/] [Ransomware & Extortion] * Russia-Linked GREYVIBE Targets Ukraine with AI-Powered Campaigns [https://thehackernews.com/2026/05/new-russian-linked-greyvibe-targets.html] [Ransomware & Extortion] * The Com Criminal Collective Funds Violence via Cybercrime [https://www.darkreading.com/threat-intelligence/the-com-cyberattacks-violence-sexploitation] [Ransomware & Extortion] * Malicious npm Packages Abuse Dependency Confusion to Profile Environments [https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/] [Business & Infrastructure Threats] * Malicious Sicoob NuGet Package Steals Brazilian Banking Credentials [https://thehackernews.com/2026/05/malicious-sicoob-nuget-steals-banking.html] [Business & Infrastructure Threats] * 14 Malicious npm Packages Target AWS and CI/CD Secrets [https://thehackernews.com/2026/05/malicious-sicoob-nuget-steals-banking.html] [Business & Infrastructure Threats] * TrapDoor Supply Chain Campaign Hits 176 npm Packages [https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-22-7/] [Business & Infrastructure Threats] * ChatGPT Share Links Abused for Malware Distribution [https://www.bleepingcomputer.com/news/security/chatgpt-share-links-abused-to-host-fake-outage-pages-to-deliver-malware/] [Business & Infrastructure Threats] * Shadow AI: 2,000+ Vibe-Coded Apps Exposed Corporate Data [https://thehackernews.com/2026/05/what-2000-exposed-vibe-coded-apps.html] [Business & Infrastructure Threats] * Zapier Nearly Compromised via Multi-Step Exploit Chain [https://www.darkreading.com/vulnerabilities-threats/complex-cloud-integrations-small-errors-compromises] [Business & Infrastructure Threats] * Dutch Authorities Disrupt 17 Million Device Botnet [https://www.bleepingcomputer.com/news/security/dutch-govt-disrupts-malware-botnet-with-17-million-infected-devices/] [General Security News] * Stark Industries Hosting Network Dismantled [https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-22-7/] [General Security News] * Google Chrome Rolls Out Device Bound Session Credentials [https://www.bleepingcomputer.com/news/security/google-chrome-adds-session-cookie-theft-protection-for-all-users/] [General Security News] * California AG Sues 23andMe Over 2023 Breach [https://www.bleepingcomputer.com/news/security/california-ag-sues-23andme-over-2023-breach-exposing-health-data/] [General Security News] * DDoS-as-a-Service Market Evolves from Scripts to Polished Products [https://www.bleepingcomputer.com/news/security/from-5-attacks-to-botnet-powered-platforms-inside-the-ddos-as-a-service-market/] [General Security News] * Chrome 148 Patches 151 Vulnerabilities [https://www.securityweek.com/chrome-148-update-patches-151-vulnerabilities/] [Vulnerability Disclosures] * VS Code Remote SSH Extension Vulnerability [https://www.securityweek.com/in-other-news-trump-mobile-data-breach-fifa-world-cup-phishing-cisa-responds-to-supply-chain-attacks/] [Vulnerability Disclosures] * Veeam, Notepad++, Roundcube Patches [https://www.securityweek.com/in-other-news-trump-mobile-data-breach-fifa-world-cup-phishing-cisa-responds-to-supply-chain-attacks/] [Vulnerability Disclosures] * CISA Expands KEV Catalog with Supply Chain Attack CVEs [https://www.securityweek.com/in-other-news-trump-mobile-data-breach-fifa-world-cup-phishing-cisa-responds-to-supply-chain-attacks/] [Vulnerability Disclosures] * ChatGPhish Vulnerability in ChatGPT Web Summaries [https://thehackernews.com/2026/05/chatgphish-vulnerability-turns-chatgpt.html] [Vulnerability Disclosures] * SymJack and TrustFall: AI Coding Agent Attacks [https://thehackernews.com/2026/05/chatgphish-vulnerability-turns-chatgpt.html] [Vulnerability Disclosures] * CIFSwitch: Linux Local Root Vulnerability [https://www.schneier.com/blog/archives/2026/05/friday-squid-blogging-another-squid.html] [Vulnerability Disclosures] CVES REFERENCED CVE-2025-8110, CVE-2026-0257, CVE-2026-39987, CVE-2026-9872, CVE-2026-9873, CVE-2026-9874, CVE-2026-9875, CVE-2026-9876 INDICATORS OF COMPROMISE Domains: openew[.]app Read the full brief [https://carolinacleartech.com/brief/2026-05-30/]
1 month for 9 kr.
Then 99 kr. / month · Cancel anytime.
- Podcasts kun på Podimo
- 20 lydbogstimer pr. måned
- Gratis podcasts
All episodes
90 episodes
Comments
0Be the first to comment
Sign up now and become a member of the Cyber Threat Brief community!