Vulnerability News

Trusted sources. Verified information.
CVEs · Zero-days · Threat research · Tech
📡 @ElusivePrivacy |

[Elusive @ElusivePrivacy]

Silent Ransom Group

Russia-linked extortion gang escalates from phone calls to physical office visits. Silent Ransom Group (UNC3753 / Luna Moth / Chatty Spider) poses as IT support to breach US law firms and professional services. 38 firms leaked.

Data exfiltration within hours of initial contact. New Mandiant report covers Jan–May 2026 campaign.

Source: BleepingComputer / Mandiant / FBI FLASH
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

C0XMO Botnet

New Gafgyt variant spreads via a 5-year-old DD-WRT router flaw, then kills rival malware to monopolize the device.

C0XMO exploits CVE-2021-27137 a stack buffer overflow in the UPnP service for unauthenticated access. Cross-platform, moving between architectures. FortiGuard Labs discovered it.

Source: BleepingComputer / FortiGuard Labs
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

Miasma Worm Hits Microsoft GitHub

1/2⚠️The Miasma supply chain worm has hit 73 Microsoft GitHub repositories across four orgs Azure, Azure-Samples, Microsoft, and MicrosoftDocs. GitHub disabled access to the impacted repos. The worm re-compromised the "durabletask" PyPI package, previously targeted by TeamPCP last month for Linux credential theft.

@VulnerabilityNw

[Elusive @ElusivePrivacy]

2/2 Miasma is an evolved variant of Mini Shai-Hulud, mutating rapidly new poisoned repos created daily with slight description variations. The worm steals secrets from developer environments and self-propagates via compromised CI/CD pipelines. This is the most significant enterprise-grade supply chain escalation to date.

Source: The Hacker News / OpenSourceMalware
Full analysis → @VulnerabilityNw

[Elusive @ElusivePrivacy]

AI Agent 21 FFmpeg Zero-Days

1/2🔓An autonomous AI agent from RevEng AI discovered 21 confirmed zero-days in FFmpeg each with a reproducible PoC after scanning the project's 1.5M lines of C. Claude Mythos also pulled a 16-year-old H.264 flaw from FFmpeg for $10K. In the same week, Google shipped Chrome 149 with patches for 429 security bugs the most in a single release.

[Elusive @ElusivePrivacy]

2/2 Chrome's worst: CVE-2026-10881, CVSS 9.6 an out-of-bounds read/write in ANGLE that escapes the sandbox. Google paid $97K for it. The trend is accelerating: AI agents are finding bugs faster than teams can patch. The February benchmark had an agent reproduce PoCs for 50%+ of 100 Linux kernel N-days.

Source: The Hacker News / RevEng AI
Full analysis → @VulnerabilityNw

[Elusive @ElusivePrivacy]

Smart TV Proxies for AI Scraping

Researcher reverse-engineers Bright Data's iOS SDK embedded in free apps, it turns always-on smart TVs into exit nodes for AI web-scraping traffic. The successor to Luminati (the Hola VPN scandal), Bright Data sells residential proxy access to AI companies bypassing datacenter IP blocks. The SDK's peer tunnel has fewer security checks than most malware.

Source: The Hacker News / Lowpass
Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

ChatGPT Lockdown Mode

OpenAI rolls out Lockdown Mode for ChatGPT an optional security setting that kills live browsing, canvas networking, image retrieval, and file downloads to block URL-based data exfiltration via prompt injection. Not intended for everyone, but a meaningful hardening option for orgs handling sensitive data.

Source: The Hacker News / OpenAI
Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

Everest Forms Pro RCE

WordPress Everest Forms Pro under active attack.
CVE-2026-3300, CVSS 9.8 unauthenticated RCE via crafted file upload. Wordfence blocked 29,300+ exploitation attempts since April 13. 4,000 active
installs exposed.

Source: BleepingComputer / Wordfence
Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

Five Eyes: Chinese Spy Recruitment

Five Eyes agencies warn Chinese operatives are posing as recruiters on professional platforms to target government and military personnel.

Goal: compromise individuals with access to classified or privileged information. Tailored fake job offers serve as the initial vector.

Source: SecurityWeek
Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

SolarWinds Serv-U (CISA KEV)

CISA added SolarWinds Serv-U (CVE-2026-28318) to the KEV catalog active exploitation confirmed.

The high-severity resource consumption flaw lets unauthenticated attackers crash servers remotely. Federal agencies have a binding patch deadline.

Source: BleepingComputer / CISA
Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

Claude Code GH Action Prompt Injection

Microsoft Threat Intelligence found a prompt injection pathway in Claude Code's GitHub Action that could exfiltrate workflow secrets under specific conditions.

Anthropic patched after coordinated disclosure. Research includes attack chain analysis and CI/CD hardening guidance.

Source: Microsoft Security Blog
Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

Chrome 149: 429 Patches

Chrome 149 patches 429 vulnerabilities over 100 rated critical or high severity.

Dominated by use-after-free flaws and insufficient input validation. The surge reflects Google's AI-assisted fuzzing pipeline reaching maturity. Update immediately.

Source: SecurityWeek
Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

Chinese APT UNC5221

Chinese espionage group UNC5221 deployed three malware families to persist in compromised Microsoft 365 environments.

Brickstorm backdoor paired with previously undocumented Plenet and AgentPSD cloud-focused persistence tools targeting tenant credentials post-breach.

Source: BleepingComputer
Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

IronWorm + Miasma npm Supply Chain

Two concurrent npm supply chain attacks. IronWorm — a Rust-built stealer that hides behind an eBPF kernel rootkit and phones home over Tor. A new Miasma worm variant self-replicates across poisoned packages. JFrog: 50+ packages compromised across both campaigns. ⚠️

Source: The Hacker News / JFrog

Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

Android Spyware Asin

Android spyware Asin targets Arabic-speaking users through decoy sites posing as news portals, PDF tools, and war map apps.

ESET tracked multiple campaigns since early 2025 each wave uses distinct C2 infrastructure.

Capabilities: SMS interception, call logging, file exfiltration.

Source: The Hacker News / ESET
Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

Cisco SD-WAN Zero-Day

1/2: Cisco's 7th SD-WAN zero-day of 2026 is under active exploit.

CVE-2026-20245 enables unauthenticated root command execution on Catalyst SD-WAN Manager.

No patch available Cisco confirmed in-the-wild exploitation Thursday. 🔓

[Elusive @ElusivePrivacy]

2/2: Seven zero-days in one product line over six months signals a deeply compromised attack surface.

Defenders: restrict SD-WAN Manager access to trusted IPs immediately. Monitor mgmt-plane for anomalous activity.
CISA notification likely imminent.

Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

🔓 Cisco Unified CM CVE-2026-20230, CVSS 9.8. Unauthenticated SSRF gives remote attackers root privileges. Public PoC available.

Affects Unified Communications Manager and Session Management Edition. Cisco released patches; CISA KEV nomination expected.

Source: BleepingComputer / SecurityWeek
Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw

[Elusive @ElusivePrivacy]

Poisoned WhatsApp, Slack, or SMS notifications can hijack Google Gemini voice assistant on Android no malicious app install required.

Researchers demonstrated smart home control via Google Home, initiating Zoom calls, and reading messages aloud, all triggered through crafted notification content.

Source: SecurityWeek
Full analysis → https://t.co/Slr9YmI7KM
Follow @VulnerabilityNw