EPISODE · May 30, 2026 · 4 MIN
May 30, 2026 · #72
from Security Brief Daily · host Security Brief Daily
Episode 72 — 30 May 2026 1. PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation Source: The Hacker News Palo Alto Networks has warned that a recently disclosed medium-severity security flaw impacting PAN-OS and Prisma Access has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-0257 (CVSS score: 7.8), refers to a case of authentication bypass... 2. California AG sues 23andMe over 2023 breach exposing health data Source: Bleeping Computer California Attorney General Rob Bonta filed a lawsuit against 23andMe, now Chrome Holding Co., over the company’s failure to protect sensitive customer genetic and personal information. Improper security led to a high-profile data breach in 2023 that exposed the sensitive... 3. New Gogs zero-day flaw lets hackers get remote code execution Source: Bleeping Computer An unpatched zero-day vulnerability in the Gogs self-hosted Git service can allow attackers to gain remote code execution (RCE) on Internet-facing instances. Designed as an alternative to GitHub Enterprise or GitLab and written in Go, Gogs is often exposed online for remote... 4. ChatGPT share links abused to host fake outage pages to deliver malware Source: Bleeping Computer Threat actors are abusing ChatGPT's content-sharing feature to display fake OpenAI outage pages that direct users to download malware disguised as the ChatGPT desktop application. The "LLMShare" campaign, discovered by Push Security , uses Google ads to direct users searching... 5. Hackers exploit FortiClient EMS flaw to push infostealer malware Source: Bleeping Computer Hackers are exploiting an authentication bypass vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS) to deliver an undocumented credential stealer called EKZ. The attacker disguised the malware as an update for Fortinet endpoints and executed it... 6. Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit Source: The Hacker News An unknown threat actor has been observed using a large language model (LLM) agent to conduct post-compromise actions after obtaining initial access following the exploitation of a publicly-accessible Marimo network using a recently disclosed vulnerability. "The attacker... 7. New Russia-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks Source: The Hacker News A previously undocumented threat actor dubbed GREYVIBE has been attributed to ongoing and persistent attacks targeting Ukraine and Ukraine-related entities since at least August 2025. GREYVIBE, per WithSecure, is assessed to be a Russian-speaking group operating broadly in... 8. Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer Source: The Hacker News Threat actors are continuing to exploit a critical, now-patched security flaw impacting FortiClient Endpoint Management Server (EMS) deployments to deliver credential-stealing malware. "The campaign abused trusted endpoint management infrastructure to deliver malware across...
What this episode covers
Episode 72 — 30 May 2026 1. PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation Source: The Hacker News Palo Alto Networks has warned that a recently disclosed medium-severity security flaw impacting PAN-OS and Prisma Access has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-0257 (CVSS score: 7.8), refers to a case of authentication bypass... 2. California AG sues 23andMe over 2023 breach exposing health data Source: Bleeping Computer California Attorney General Rob Bonta filed a lawsuit against 23andMe, now Chrome Holding Co., over the company’s failure to protect sensitive customer genetic and personal information. Improper security led to a high-profile data breach in 2023 that exposed the sensitive... 3. New Gogs zero-day flaw lets hackers get remote code execution Source: Bleeping Computer An unpatched zero-day vulnerability in the Gogs self-hosted Git service can allow attackers to gain remote code execution (RCE) on Internet-facing instances. Designed as an alternative to GitHub Enterprise or GitLab and written in Go, Gogs is often exposed online for remote... 4. ChatGPT share links abused to host fake outage pages to deliver malware Source: Bleeping Computer Threat actors are abusing ChatGPT's content-sharing feature to display fake OpenAI outage pages that direct users to download malware disguised as the ChatGPT desktop application. The "LLMShare" campaign, discovered by Push Security , uses Google ads to direct users searching... 5. Hackers exploit FortiClient EMS flaw to push infostealer malware Source: Bleeping Computer Hackers are exploiting an authentication bypass vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS) to deliver an undocumented credential stealer called EKZ. The attacker disguised the malware as an update for Fortinet endpoints and executed it... 6. Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit Source: The Hacker News An unknown threat actor has been observed using a large language model (LLM) agent to conduct post-compromise actions after obtaining initial access following the exploitation of a publicly-accessible Marimo network using a recently disclosed vulnerability. "The attacker... 7. New Russia-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks Source: The Hacker News A previously undocumented threat actor dubbed GREYVIBE has been attributed to ongoing and persistent attacks targeting Ukraine and Ukraine-related entities since at least August 2025. GREYVIBE, per WithSecure, is assessed to be a Russian-speaking group operating broadly in... 8. Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer Source: The Hacker News Threat actors are continuing to exploit a critical, now-patched security flaw impacting FortiClient Endpoint Management Server (EMS) deployments to deliver credential-stealing malware. "The campaign abused trusted endpoint management infrastructure to deliver malware across...
NOW PLAYING
May 30, 2026 · #72
No transcript for this episode yet
Similar Episodes
No similar episodes found.
Similar Podcasts
No similar podcasts found.