Stay updated with the latest cybersecurity developments! This daily roundup highlights critical vulnerabilities, active exploits, data breaches, supply chain attacks, and emerging threats. In a landscape shaped by AI-enhanced attacks, persistent state actors, and rapid supply chain compromises, vigilance remains essential.
1. Multiple Vendors Patch Critical RCE, SQLi, and Privilege Escalation Flaws
Published: May 18, 2026
Ivanti, Fortinet, SAP, VMware, and n8n released urgent security updates addressing high-severity issues. Highlights include a critical Ivanti Xtraction flaw (CVE-2026-8043, CVSS 9.6) enabling information disclosure and client-side attacks via file name control, plus critical code execution risks in FortiAuthenticator and FortiSandbox.
2. New Windows “MiniPlasma” Zero-Day Grants SYSTEM Privileges on Patched Systems
Published: May 18, 2026
Researcher Chaotic Eclipse released a PoC for a lingering privilege escalation zero-day in the Windows Cloud Files Mini Filter Driver (cldflt.sys). The flaw, related to an unpatched or rolled-back issue from CVE-2020-17103, allows attackers to achieve SYSTEM-level access on fully updated Windows installations.
[Read more](https://thehackernews.com/ or https://www.bleepingcomputer.com/)
3. Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware
Published: May 18, 2026
Security researchers identified malicious npm packages (e.g., chalk-tempalte, axois-utils) published by the same user, containing infostealers and clones of the Shai-Hulud worm. These supply chain attacks have seen hundreds to thousands of downloads and pose risks to developers integrating them.
4. Microsoft May 2026 Patch Tuesday Addresses ~120-137 Vulnerabilities (No Zero-Days)
Published: Mid-May 2026 (ongoing relevance)
Microsoft’s latest Patch Tuesday fixed dozens of flaws across Windows, Edge, and related products, with many critical. No in-the-wild zero-days were addressed this cycle, offering a relative breather, though organizations should prioritize deployment. Cumulative updates for Windows 11 were also released.
[Read more](https://www.bleepingcomputer.com/ or Lansweeper/Krebs)
5. NGINX CVE-2026-42945 Actively Exploited in the Wild
Published: May 17, 2026
A heap buffer overflow in NGINX (versions up to 1.30.0) is under active exploitation, potentially leading to worker crashes or remote code execution (RCE) when ASLR is disabled. The flaw dates back to 2008 and affects both open-source and Plus editions.
6. Grafana Suffers GitHub Token Breach, Codebase Downloaded, Extortion Attempt
Published: May 17, 2026
Grafana disclosed unauthorized access via a compromised GitHub token, resulting in codebase download. No customer data was impacted, but the attacker attempted extortion. Credentials were invalidated, and additional safeguards implemented.
7. Funnel Builder WordPress Plugin Flaw Actively Exploited for Checkout Skimming
Published: May 16, 2026 (ongoing)
A critical unauthenticated flaw in the popular Funnel Builder plugin (pre-3.15.0.3, used by 40,000+ sites) allows JS injection into WooCommerce checkouts for payment data theft. Attackers mimic legitimate analytics scripts. Patch applied urgently.
[Read more](https://thehackernews.com/ or BleepingComputer)
8. Turla Evolves Kazuar Backdoor into Modular P2P Botnet
Published: May 15-16, 2026
Russian state-sponsored group Turla (Secret Blizzard) upgraded its Kazuar backdoor into a stealthy peer-to-peer botnet for persistent access, data collection, and long-term operations targeting government and defense sectors.
[Read more](https://thehackernews.com/ or BleepingComputer)
Additional recent context: Breaches like those affecting Baytech, BSynchro, and others continue to surface from mid-May, alongside broader trends in supply chain and identity attacks.
Stay Vigilant
Cyber threats evolve daily with faster exploitation of supply chains, zero-days, and AI-assisted tactics. Patch promptly, monitor third-party dependencies, enforce least privilege, and use multi-layered defenses. Subscribe for daily/weekly updates, and consider tools for vulnerability scanning and threat intelligence. Stay safe!