May 22, 2026 · #64

Episode 64 — 22 May 2026 1. Max severity Cisco Secure Workload flaw gives Site Admin privileges Source: Bleeping Computer Cisco has released security updates to address a maximum-severity Secure Workload vulnerability that allows attackers to gain Site Admin privileges. Formerly known as Cisco Tetration, Cisco Secure Workload helps admins reduce their network's attack surface through zero trust... 2. Google accidentally exposed details of unfixed Chromium flaw Source: Bleeping Computer Google has accidentally leaked details about an unfixed issue in Chromium that keeps JavaScript running in the background even when the browser is closed, allowing remote code execution on the device. The flaw was reported by security researcher Lyra Rebane and acknowledged... 3. Microsoft warns of new Defender zero-days exploited in attacks Source: Bleeping Computer On Wednesday, Microsoft started rolling out security patches for two Defender vulnerabilities that have been exploited in zero-day attacks. The first one, tracked as CVE-2026-41091 , is a privilege escalation security flaw affecting Microsoft Malware Protection Engine... 4. Police seize “First VPN” service used in ransomware, data theft attacks Source: Bleeping Computer A virtual private network service called 'First VPN,' used in ransomware and data theft attacks, has been taken offline in a joint international law enforcement operation. Authorities have seized dozens of First VPN servers located in 27 countries, arrested the administrator,... 5. CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV Source: The Hacker News The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Langflow and Trend Micro Apex One to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities in question are... 6. Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada Source: Krebs on Security Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf , a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed denial-of-service (DDoS) attacks over... 7. Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks Source: The Hacker News Microsoft on Tuesday said it disrupted a malware-signing-as-a-service (MSaaS) operation that weaponized the company's Artifact Signing system to deliver malicious code and conduct ransomware and other attacks, compromising thousands of machines and networks across the world.... 8. Webworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph API Source: The Hacker News Cybersecurity researchers have flagged fresh activity from a China-aligned threat actor known as Webworm in 2025, deploying custom backdoors that employ Discord and Microsoft Graph API for command-and-control (C2 or C&C) communications. Webworm, first publicly documented by...