Security & Risk
141 analyses
The extortion group CoinbaseCartel claimed access to the domain panasonic.aero on 22 May 2026. Panasonic Avionics serves more than 200 airlines and covers approximately 70% of the global fleet of aircraft equipped with IFE systems.
GitHub's CISO attributed the breach of 3,800 internal repositories to a malicious version of the Nx Console extension for VS Code, linked to a supply chain attack against TanStack's npm packages on 11 May.
The TeamPCP group compromised a GitHub employee's device with a tampered VS Code extension to exfiltrate approximately 3,800 internal repositories. The company confirms that customer data was not affected.
Without requiring authentication, CVE-2026-9082 has been scored 20/25 in Drupal's risk system and may lead to remote code execution in installations using PostgreSQL. Patch available this Thursday.
The Nitrogen group claims to have exfiltrated 8 TB across 11 million files from Foxconn, including technical drawings of Apple projects, Google, and Nvidia. AppleInsider confirmed today the presence of Apple server schematics in the leaked material.
Critical vulnerability CVE-2026-42945, present in NGINX since 2008, was actively exploited three days after proof of concept publication. It affects all versions between 0.6.27 and 1.30.0, responsible for 32.8% of global web servers.
SAP S/4HANA receives a fix for SQL injection with CVSS 9.6 in the same month that over half of global customers complete their migration to the version. FortiAuthenticator and FortiSandbox are updated against access control vulnerabilities, and n8n accumulates five CVEs with 9.4.
CVE-2026-20182 Allows Authentication Bypass on Catalyst SD-WAN Controller and Escalation to Root. Group Identified as UAT-8616 Was Already Modifying NETCONF Settings on Compromised Systems. CISA Demanded Fix Within Three Days.
CVE-2026-42897 allows execution of JavaScript via opened email in Outlook Web Access. CISA mandated remediation by 29 May. The flaw affects Exchange Server 2016, 2019, and Subscription Edition, but does not impact Exchange Online.
A supply chain attack on the TanStack project release pipeline compromised 84 artefacts in 42 npm packages, impacting OpenAI, which confirmed the compromise of application signing keys for Windows, macOS, iOS, and Android, and initiated the re-release of all apps with new certificates.
Grafana Labs confirmed on 17 May that a third party obtained an access token for the company's corporate GitHub and downloaded part of the source code. The company refused the ransom demand from the CoinbaseCartel group, citing guidance from the FBI to justify its stance.
A buffer overflow in the NGINX rewrite module, present in the code since 2008, led F5 to issue an emergency patch after VulnCheck recorded exploitation attempts against honeypots. The vulnerability has a CVSS score of 9.2 and affects versions 0.6.27 to 1.30.0.