Announcing Bitskrieg
https://deadeclipse666.blogspot.com/2026/05/announcing-bitskrieg.html
Vulnerability in Gogs
https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed/
Oracle Critical Security Patch Update Advisory - May 2026
https://www.oracle.com/security-alerts/cspumay2026.html
GlobalProtect Authentication Bypass Vulnerabilities CVE-2026-0257
https://security.paloaltonetworks.com/CVE-2026-0257

Research Review Journal
https://assets.contentstack.io/v3/assets/blt83c410d686aa5f84/blt3cff46f63887f83e/research-review-journal
https://www.sans.edu/cyber-research
Analysis of a Year of Files Uploaded to DShield Sensors
https://isc.sans.edu/diary/Analysis%20of%20a%20Year%20of%20Files%20Uploaded%20to%20DShield%20Sensors/33026
The Word 'Toad' Gave Any Website Full Control of Chrome's Most Popular VPN
https://amibeingpwned.com/blog/urban-vpn-postmessage-command-injection
Silent Ransom Group Impersonating IT Personnel through Social Engineering
https://www.ic3.gov/CSA/2026/260526.pdf

Reconstructing an Akira Ransomware Kill Chain from Perimeter and Endpoint Logs
https://isc.sans.edu/diary/Reconstructing%20an%20Akira%20Ransomware%20Kill%20Chain%20from%20Perimeter%20and%20Endpoint%20Logs/33024
Vaultjacking: One Captured PIN, the Entire Google Password Manager Vault
https://phishu.net/blogs/blog-vaultjacking-phishing-the-google-password-manager-vault-in-the-phishu-framework.html
From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities
https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/

Possible ACR Stealer From Page Impersonating Claude
https://isc.sans.edu/diary/Possible%20ACR%20Stealer%20From%20Page%20Impersonating%20Claude/33018
Microsoft SharePoint Remote Code Execution Vulnerability CVE-2026-45659
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659
Multiple Vulnerabilities in Angular Language Service VS Code Extension
https://github.com/angular/angular/security/advisories/GHSA-ccq4-xmxr-8hcq

Microsoft Access VBA
https://isc.sans.edu/diary/Microsoft%20Access%20VBA/33012
An Example of Stack String in High Level Language
https://isc.sans.edu/diary/An%20Example%20of%20Stack%20String%20in%20High%20Level%20Language/33008
Cross-Platform NPM Stealer
https://isc.sans.edu/diary/Cross-Platform%20NPM%20Stealer/33006
Laravel Lang Compromised with RCE Backdoor Across
https://socket.dev/blog/laravel-lang-compromise
Google API keys keep working after you delete them
https://www.aikido.dev/blog/google-api-keys-deletion

Selective HTTP Proxying in Linux
https://isc.sans.edu/diary/Selective%20HTTP%20Proxying%20in%20Linux/33002
Megalodon: Mass GitHub Repo Backdooring via CI Workflows
https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows/
MSFT Patches Recent Windows Defender Flaws CVE-2026-41091, CVE-2026-45498, CVE-2026-45584
https://x.com/fabian_bader/status/2057198207243804881
Cisco Secure Workload Unauthorized API Access Vulnerability CVE-2026-20223
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-pnbsa-g8WEnuy

GitHub Breach
https://x.com/github/status/2056949168208552080
Agentic Threat Intelligence Feed - VS Code Extensions
https://agentmesh.knostic.ai/extensions
More NGINX Vulnerabilities
https://x.com/nebusecurity/status/2057071579876753643
https://my.f5.com/manage/s/article/K000161307
Microsoft Publishes YellowKey Mitigation CVE-2026-45585
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585
Incomplete Sonicwall Patch CVE-2024-12802
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0001

TeamPCP Supply Chain Campaign: Activity Through 2026-05-17
https://isc.sans.edu/diary/TeamPCP%20Supply%20Chain%20Campaign%3A%20Activity%20Through%202026-05-17/32994
https://slsa.dev/spec/v0.1/levels
Github Action Compromise
https://www.stepsecurity.io/blog/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltrates-ci-cd-credentials
How Storm-2949 turned a compromised identity into a cloud-wide breach
https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/

New Malware Libraries means New Signatures
https://isc.sans.edu/diary/%5BGuest%20Diary%5D%20%20New%20Malware%20Libraries%20means%20New%20Signatures/32986
Addressing Exchange Server May 2026 vulnerability CVE-2026-42897
https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498
Microsoft Authenticator Update CVE-2026-41615
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41615
ssh-keysign-pwn (CVE-2026-46333) Patches Released
https://almalinux.org/blog/2026-05-15-ssh-keysign-pwn-cve-2026-46333/

Tearing apart website fraud to see how it works. (@sans_edu)
https://isc.sans.edu/diary/%5BGUEST%20DIARY%5D%20Tearing%20apart%20website%20fraud%20to%20see%20how%20it%20works./32958
Simple bypass of the link preview function in Outlook Junk folder
https://isc.sans.edu/diary/Simple%20bypass%20of%20the%20link%20preview%20function%20in%20Outlook%20Junk%20folder/32990
NGINX Vulnerability
https://depthfirst.com/nginx-rift
Cisco SDWan 0-Day
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW