Signal Check

This episode digs into the week's quiet but persistent threats—Linux rootkits, router zero-days, and AI adversarial probing—before covering major incidents including Grafana Labs' GitHub breach and a zero-day exploit in Trend Micro's own security software. Adrian North wraps up with a sobering reminder that even CISA contractors aren't immune to mistakes, as exposed AWS GovCloud credentials sat publicly on GitHub.

Stories covered:

- ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories (The Hacker News) - https://thehackernews.com/2026/05/threatsday-bulletin-linux-rootkits.html

- Grafana Labs Security Breach - Hackers Access GitHub and Download Codebase - CyberSecurityNews (CyberSecurityNews) - https://news.google.com/rss/articles/CBMia0FVX3lxTE00aWtyeFl6WE1sS1N0X0JRYkJXQmxvQ1NpYVlSeWZGempNc2RXdlM2TU5pdkh5SDlOVXVLMGRPMXZzU2VIOUFwUFlSNkR2YVpxcEpZdEcxa3Y4TGgzdlk4cnpra1FCbHh4OWhJ0gFwQVVfeXFMT1owNlYwdDNmV0c5bWVlNlJHbDB6TnlNS28xWUZ1RWpsVHpyQTFxWmZzcG9lV3h3RTBTczM1TWJnaW13Qk10RHpfMi1JME9abzh3QnBRdWlWeVk2cHpVLXJxNHlieWhUZTFUR0swWF9rVw?oc=5

- Trend Micro warns of Apex One zero-day exploited in the wild (BleepingComputer) - https://www.bleepingcomputer.com/news/security/trend-micro-warns-of-apex-one-zero-day-exploited-in-attacks/

- CISA Admin Leaked AWS GovCloud Keys on Github (Krebs on Security) - https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/

- The Best Editor-Approved Memorial Day Deals on Garmin, Coros, and Shokz: Get Hundreds Off Popular Gear for Runners (Runner's World) - https://www.runnersworld.com/gear/a71292623/memorial-day-running-gear-deals-2026/

- Trump Mobile confirms it exposed customers’ personal data, including phone numbers and home addresses (TechCrunch) - https://techcrunch.com/2026/05/22/trump-mobile-confirms-it-exposed-customers-personal-data-including-phone-numbers-and-home-addresses/

This episode covers Microsoft shutting down a malware signing operation that weaponized their own trust systems, law enforcement dismantling a VPN service used by ransomware gangs, and a nine-year-old Linux kernel vulnerability that somehow stayed hidden in plain sight. Adrian also digs into GitHub's employee device compromise and what it means when the tools built to protect us become the very things attackers exploit.

Stories covered:

- Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks (The Hacker News) - https://thehackernews.com/2026/05/microsoft-takes-down-malware-signing.html

- Police seize “First VPN” service used in ransomware, data theft attacks (BleepingComputer) - https://www.bleepingcomputer.com/news/security/police-seize-first-vpn-service-used-in-ransomware-data-theft-attacks/

- 9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros (The Hacker News) - https://thehackernews.com/2026/05/9-year-old-linux-kernel-flaw-enables.html

- GitHub confirms 'hacking' attack; says: We detected and contained a compromise of an employee device invo - The Times of India (The Times of India) - https://news.google.com/rss/articles/CBMiqAJBVV95cUxPeWUwVngxRXo5NjZQWTlFMTAxMnpPLVVHYm5yVEtxZWdKVWMwd1ZVeGpUNEcwOVRxRUdBX2o5VjVlSnZ3LUVuLU9QNnc0NTNkUDBJWUVoblE1aGRlZWlWakQxMllzSWthNlVGV1hoWEQwb3pnMVM5NVdMd3J2NkE0bmFfN0FQamNidFdFNWVFWmw2OUhxU3ZXMTBEdWVlSjRxb3gtVjk2Qjl2aFJzS2JTWW81dEg1U1ZxbHVMcFZmMXozNWYybXpUb3lHcnVGT3o5bW9JQXRzN3Z4dGhTcm9RU1hlTWpCNjNZN09aTVpNSlN0YWhNZ2xzY3FwMVF4eVZ4UHNaRmNpSVdicXRVRG1mS0k4RmJXQzduMl83T2VqMGdtdDRGdXhCSNIBrgJBVV95cUxOcnhHTmJ3RXhwMUdyc1pYeFFtQ2t1c2s5anI4LVJkLVJoWnhVakdVWU1TVDRBQVNtVC1IOUN1OWFRcDJ5LTlCb0h6WFZCRlBndDRvbWgwOElXeE1aSF9ha3RNZ29fYm44MFJreVFMa250b0dPN25HWVJnUElkeFIxOVJDOGVnWTYtNmZ1aks2eHRCYTJsZWV0b3VFTjBkU3U2NFdoMmRBeGhETDc3Y2pGR1BQUzZ6NTdGNzV5Z29VdEhhUWc4b3lOWkRLSnMxWGFKNDItQlR0TW1GUE1xZmtBd1FVam8yMFBabjBJbzRBOTVlS0JhTmpIc2JSM0JVZ3hXRlBQVm1TdTRaWWlUWVozNWNTVEpyWmpPSktqOXd2WjVQdnJfS1lNMnZMd1dydw?oc=5

- The Adidas Ultraboost 5X Is Over 50% Off—and Still One of Our Favorite Running Shoes (Runner's World) - https://www.runnersworld.com/gear/a71365136/adidas-ultraboost-5x-sale-may-2026/

- Golden Trail World Series is now in Canada; here’s what you need to know (Canadian Running) - https://runningmagazine.ca/trail-running/golden-trail-world-series-is-now-in-canada-heres-what-you-need-to-know/

This episode covers GitHub's massive breach, CISA's accidental exposure of government cloud credentials, and Microsoft's new open-source AI security tools. We dig into what happens when the infrastructure holding our infrastructure gets compromised, plus a quick detour into gray zone training and why most runners are doing it wrong.

Stories covered:

- GitHub Confirms Breach, 4K Internal Repos Stolen (Dark Reading) - https://www.darkreading.com/application-security/github-confirms-breach-4k-internal-repos-stolen

- CISA Admin Leaked AWS GovCloud Keys on Github (Krebs on Security) - https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/

- Microsoft Open-Sources RAMPART and Clarity to Secure AI Agents During Development (The Hacker News) - https://thehackernews.com/2026/05/microsoft-open-sources-rampart-and.html

- What to Know About Gray Zone Training and How It Can Help—or Harm—Your Running (Runner's World) - https://www.runnersworld.com/training/a71353931/gray-zone-training/

- What Are Peptides, And Why Is Every Middle-Aged Runner Suddenly Talking About BPC-157? (Marathon Handbook) - https://marathonhandbook.com/what-are-peptides-and-why-is-every-middle-aged-runner-suddenly-talking-about-bpc-157/

- Google Declaring War on the Web (Hacker News) - https://tante.cc/2026/05/20/on-google-declaring-war-on-the-web/

On today's Signal Check, Adrian North digs into over six hundred malicious npm packages flooding the registry, a CISA contractor's exposed AWS credentials left on GitHub, and a newly public Linux kernel exploit called DirtyDecrypt. The episode wraps with a quick detour into reframing personal narratives and how the stories we tell ourselves shape what we think is possible.

Stories covered:

- New Shai-Hulud malware wave compromises 600 npm packages (BleepingComputer) - https://www.bleepingcomputer.com/news/security/new-shai-hulud-malware-wave-compromises-600-npm-packages/

- CISA Admin Leaked AWS GovCloud Keys on Github (Krebs on Security) - https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/

- DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability (The Hacker News) - https://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html

- This Training Plan Transformed Her View on Running. It Could Change Your Mindset, Too. (Runner's World) - https://www.runnersworld.com/beginner/a71350276/couch-to-5k-training-plan/

- ‘Women Can Do This’: She Started Racing Postpartum in Her 30s. Now She’s an Ultrarunning Champion (Runner's World) - https://www.runnersworld.com/news/a71309956/careth-arnold-ultrarunning-postpartum/

- Microsoft Exchange Zero-Day Under Attack, No Patch Available (Dark Reading) - https://www.darkreading.com/vulnerabilities-threats/microsoft-exchange-zero-day-no-patch

This episode covers a critical NGINX vulnerability already being exploited in the wild, a Windows zero-day giving attackers full system control, and a jaw-dropping security lapse where CISA's own contractor leaked AWS GovCloud credentials on GitHub. We also dig into a massive NYC Health + Hospitals breach exposing biometric data from nearly two million people—the kind of information you can never change once it's stolen.

Stories covered:

- NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE (The Hacker News) - https://thehackernews.com/2026/05/nginx-cve-2026-42945-exploited-in-wild.html

- New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released (BleepingComputer) - https://www.bleepingcomputer.com/news/microsoft/new-windows-miniplasma-zero-day-exploit-gives-system-access-poc-released/

- CISA Admin Leaked AWS GovCloud Keys on Github (Krebs on Security) - https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/

- NYC Health + Hospitals says hackers stole medical data and fingerprints during breach affecting at least 1.8 million people (TechCrunch) - https://techcrunch.com/2026/05/18/nyc-health-and-hospitals-says-hackers-stole-medical-data-and-fingerprints-during-breach-affecting-at-least-1-8-million-people/

- What to Do When You Don’t Get Into Your Goal Race (Runner's World) - https://www.runnersworld.com/races-places/a71318334/world-marathon-major-race-alternatives/

- Everything You Need to Know About the 2026 Cape Town Marathon (Marathon Handbook) - https://marathonhandbook.com/everything-you-need-to-know-about-the-2026-cape-town-marathon/

On today's Signal Check, Adrian covers a dangerous new Windows zero-day giving attackers full system access, an actively exploited NGINX vulnerability hitting millions of sites, and why your summer running pace feels impossibly hard. Plus, Olympic marathoner Molly Seidel's shift from the road to ultrarunning reminds us that even elite athletes need to find what's fun again.

Stories covered:

- New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released (BleepingComputer) - https://www.bleepingcomputer.com/news/microsoft/new-windows-miniplasma-zero-day-exploit-gives-system-access-poc-released/

- NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE (The Hacker News) - https://thehackernews.com/2026/05/nginx-cve-2026-42945-exploited-in-wild.html

- Why Your Usual Running Pace Feels Harder in the Heat—and What to Do About It (Runner's World) - https://www.runnersworld.com/training/a71318220/running-intensity-in-heat/

- ‘It Just Wasn’t Fun Anymore’: Why Molly Seidel Stepped Away from Marathoning—and Is Thriving on the Trails (Runner's World) - https://www.runnersworld.com/news/a71166284/molly-seidel-ultra-trail-running/

- Victory! End-to-End Encrypted RCS Comes to Apple and Android Chats (EFF) - https://www.eff.org/deeplinks/2026/05/victory-end-end-encrypted-rcs-comes-apple-and-android-chats

- Ebola outbreak with uncommon strain erupts in Congo and Uganda; 65 deaths (Ars Technica) - https://arstechnica.com/health/2026/05/ebola-outbreak-confirmed-in-congo-and-uganda-246-suspected-cases-65-deaths/

This episode covers a critical Microsoft Exchange vulnerability being actively exploited in the wild, the story of Fisker EV owners who reverse-engineered their abandoned cars into an open-source movement, and a deep dive into the "sweet spot" training zone that could unlock faster running without the burnout. We also touch on prize money still owed to marathon runners six months after crossing the finish line.

Stories covered:

- Microsoft warns of Exchange zero-day flaw exploited in attacks (BleepingComputer) - https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-exchange-zero-day-flaw-exploited-in-attacks/

- On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email (The Hacker News) - https://thehackernews.com/2026/05/on-prem-microsoft-exchange-server-cve.html

- Fisker went bankrupt and owners built an open source car company from the ashes (Hacker News) - https://electrek.co/2026/05/16/fisker-ocean-open-source-ev-story-after-bankruptcy/

- This Type of Training Could Be the Secret to Running Faster Without Burning Out—and It Can Lead to a PR in Any Distance (Runner's World) - https://www.runnersworld.com/training/a71310980/critical-velocity-workouts/

- 6 Months After This Marathon, the Top Finishers Still Haven’t Been Paid Prize Money—and They Want Answers (Runner's World) - https://www.runnersworld.com/news/a71318097/soweto-marathon-prize-money-controversy/

- Three's a party: US, China, and now Russia are on the prowl in GEO (Ars Technica) - https://arstechnica.com/space/2026/05/threes-a-party-us-china-and-now-russia-are-on-the-prowl-in-geo/

This episode covers active exploitation of critical vulnerabilities in Microsoft Exchange and Cisco SD-WAN, a supply chain breach that hit OpenAI developers, and why patching timelines matter when attackers are already inside the door. Adrian pulls weekend signals on threats that don't take days off—from zero-days to compromised signing certificates. It's a sobering look at how fast the window closes between disclosure and exploitation.

Stories covered:

- On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email (The Hacker News) - https://thehackernews.com/2026/05/on-prem-microsoft-exchange-server-cve.html

- Cisco warns of new critical SD-WAN flaw exploited in zero-day attacks (BleepingComputer) - https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-critical-sd-wan-flaw-exploited-in-zero-day-attacks/

- OpenAI confirms security breach in TanStack supply chain attack (BleepingComputer) - https://www.bleepingcomputer.com/news/security/openai-confirms-security-breach-in-tanstack-supply-chain-attack/

- 6 Months After This Marathon, the Top Finishers Still Haven’t Been Paid Prize Money—and They Want Answers (Runner's World) - https://www.runnersworld.com/news/a71318097/soweto-marathon-prize-money-controversy/

- ‘I Don’t Know How I Did This’: He Ran 1,000 Miles. Around a Single Track. For 18 Days. (Runner's World) - https://www.runnersworld.com/news/a71317409/1000-mile-track-ultrarunner-charity/

- Tesla Reveals New Details About Robotaxi Crashes—and the Humans Involved (Wired) - https://www.wired.com/story/tesla-reveals-new-details-about-robotaxi-crashes-and-the-humans-involved/

This episode covers the fallout from Pwn2Own Berlin, where researchers exposed 24 zero-day exploits in one day, plus urgent warnings about a Cisco SD-WAN authentication bypass being actively exploited in the wild. We also dig into a new Linux privilege escalation flaw called Fragnesia and what it means when similar bugs start clustering together.

Stories covered:

- Windows 11 and Microsoft Edge hacked at Pwn2Own Berlin 2026 (BleepingComputer) - https://www.bleepingcomputer.com/news/security/windows-11-and-microsoft-edge-hacked-on-first-day-of-pwn2own-berlin-2026/

- Cisco warns of new critical SD-WAN flaw exploited in zero-day attacks (BleepingComputer) - https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-critical-sd-wan-flaw-exploited-in-zero-day-attacks/

- New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption (The Hacker News) - https://thehackernews.com/2026/05/new-fragnesia-linux-kernel-lpe-grants.html

- Training for Another Half Marathon? Avoid the Common Mistakes I Made So You Run a Faster Race. (Runner's World) - https://www.runnersworld.com/training/a71285796/second-half-marathon-training-tips/

- Not Just Cruise Ships: What to Know About Hantavirus in the Backcountry (ExplorersWeb) - https://explorersweb.com/not-just-cruise-ships-what-to-know-about-hantavirus-in-the-backcountry/

- An Engineer’s Post Protesting Laptop Surveillance Is Going Viral Inside Meta (Wired) - https://www.wired.com/story/meta-employee-protest-mouse-tracking-surveillance-ai-training/

This episode covers two unpatched Windows zero-days that bypass BitLocker and escalate privileges, a self-replicating worm spreading through npm packages in the TanStack ecosystem, and a critical remote code execution flaw in the Exim mail server. Adrian breaks down how disclosure tensions, supply chain infections, and legacy infrastructure vulnerabilities are colliding all at once. It's a packed signal day that shows just how fast things can unravel.

Stories covered:

- Windows BitLocker zero-day gives access to protected drives, PoC released (BleepingComputer) - https://www.bleepingcomputer.com/news/security/windows-bitlocker-zero-day-gives-access-to-protected-drives-poc-released/

- Microsoft Windows Alert—Angry Hacker Drops 2 New Zero-Day Exploits - Forbes (Forbes) - https://news.google.com/rss/articles/CBMiuwFBVV95cUxQS1J1OUpHM1RWdDF6LXdqLThRTUFHMFFmVWk5ZGphU2ZWVnR4NWQxeTZFWmpWQmFCSldobzFvVUZKdVVXNG14Y1Y1YTdWczhnUWNGX0JtSkJ2dGpxQl9vTUlSQkdpYzdvV3A5VWNqWG4xMTZwSVN0bE8yQVNVNnN2TURTSG1pSElaR0hmTUVHNmMzSDd1MTlwNUVSWkVobjlaWFhiblZ2VzczV21YcVR3WmxHNm45MHF2TU5V?oc=5

- Worm Redux: Fresh Mini Shai-Hulud Infections Bite Supply Chain (Dark Reading) - https://www.darkreading.com/application-security/worm-redux-fresh-mini-shai-hulud-infections-bite-supply-chain

- New critical Exim mailer flaw allows remote code execution (BleepingComputer) - https://www.bleepingcomputer.com/news/security/new-critical-exim-mailer-flaw-allows-remote-code-execution/

- ‘Strava Brain’ Is Making Your Long, Hot Runs Harder Than They Need to Be (Runner's World) - https://www.runnersworld.com/news/a71273015/elapsed-time-strava-summer-runs/

- Want to Start Trail Running Like Rachel Entrekin? Begin With These Top 10 Essentials (Runner's World) - https://www.runnersworld.com/trail-running/a71293507/trail-running-gear-for-beginners/