Attackers briefly hijacked Bitwarden’s NPM package for its CLI as part of a wider Checkmarx supply chain compromise claimed by TeamPCP, with references to the “Shai-Hulud” malware. Developers who pulled the tainted package face potential credential exposure, underscoring the rising risk of dependency and CI/CD pipeline abuse.
Source: Security Week
Federal agency’s Cisco firewall infected with FIRESTARTER backdoor, persisted post-patch
CISA detailed a 2025 intrusion in which a U.S. federal civilian agency’s Cisco Firepower device (ASA software) was implanted with the FIRESTARTER backdoor. The malware enabled remote access and maintained persistence even after security updates, spotlighting the need for thorough ASA/Firepower hardening and post-patch validation.
Source: Security Week
PhantomRPC: New Windows RPC privilege escalation technique
Kaspersky researchers disclosed a Windows RPC architecture weakness enabling attackers to craft a fake RPC server to escalate privileges. The technique broadens post-compromise options for adversaries and raises the bar for endpoint hardening, RPC service exposure, and detection of anomalous inter-process calls.
Source: SecureList
‘Pack2TheRoot’ bug gives local Linux users root via PackageKit (CVE-2026-41651)
A high-severity flaw in PackageKit, present for nearly 12 years, allows unprivileged users to install or remove system packages without authorization and potentially gain full root access. Tracked as CVE-2026-41651 (CVSS 8.8), the issue highlights the enduring risk of legacy code paths and the importance of prompt distro patching.
Source: Security Affairs
LLM tooling under fire: LMDeploy SSRF (CVE-2026-33626) exploited within 13 hours
An SSRF flaw in LMDeploy, an open-source toolkit for compressing and serving large language models, was exploited less than 13 hours after disclosure. The rapid weaponization underscores how AI infrastructure components are becoming high-velocity targets and why teams must treat ML/LLM stacks like critical application surfaces.
Source: TheHackerNews
Medical data of 500,000 UK Biobank volunteers listed for sale
Despite strict access controls, data from half a million UK Biobank participants appeared for sale on Alibaba, raising alarms over biomedical research data security and de-identification limits. The incident is a stark reminder that sensitive health datasets and their access controls are prime targets for data brokers and threat actors alike.
Source: MalwareBytes Blog
US and allies warn of industrialized Chinese botnets built on hacked routers and IoT
The U.S., U.K., and eight partner nations warned that state-backed Chinese groups are harnessing fleets of compromised routers and IoT devices to power data theft and disruptive operations. The advisory reinforces the urgency of securing edge gear with timely patching, segmentation, and credential hygiene to blunt botnet scale.
Source: SCMagazine
You May Also Be Interested In...
UNC6692 impersonates help desk staff to drop SNOW malware via Microsoft Teams
CISA adds 4 exploited vulnerabilities to KEV, sets May 2026 deadline
CrowdStrike launches Project QuiltWorks to tackle AI-discovered software flaws