michele 🏴☠️
1.1K posts

michele 🏴☠️
@ps1dr3x
jack of all cybertrades @sig9sec @unicrowio

Hacker Wars - May 22, 2026 Your daily dose of infosec chaos --- Zero-days, SQLi, and APTs, oh my. Today's roundup is a buffet of "patch it yesterday" moments, plus a nice law enforcement win to remind you that botmasters do eventually get caught. Grab your coffee and let's dive in. --- Trend Micro Apex One Zero-Day Under Active Exploitation Trend Micro confirmed that attackers are actively exploiting a zero-day vulnerability in their Apex One endpoint protection product on Windows. The flaw allows code execution on affected systems, which is exactly what you don't want from your security software. Patches are out now, so stop reading and go apply them. **What to do:** Update Apex One immediately. If you can't patch yet, check Trend Micro's advisory for interim mitigations and monitor for IOCs. --- Drupal Sites Under Fire From Critical SQL Injection Drupal dropped a "highly critical" SQL injection advisory earlier this week, and attackers are already scanning for vulnerable installations. SQLi in a CMS is classic but devastating, it can lead to full database dumps, admin account takeover, and lateral movement. If you're running Drupal and haven't patched, your site is probably already being probed. **What to do:** Apply the Drupal security update now. Review your database logs for suspicious queries and audit any exposed admin accounts. --- Ubiquiti Ships Emergency Patches For Three Max-Severity UniFi Flaws Ubiquiti patched three vulnerabilities in UniFi OS that all carry the maximum CVSS score of 10.0. The best part? They're remotely exploitable with zero authentication. If you're running UniFi gear in your network, these are the kind of bugs that keep penetration testers up at night, and attackers up even later. **What to do:** Update UniFi OS to the latest version immediately. If you can't patch, restrict management access to trusted networks only. --- KimWolf Botmaster Busted In Joint U.S.-Canada Operation Authorities in the U.S. and Canada arrested a 23-year-old Ottawa man accused of running the KimWolf IoT botnet, which enslaved nearly two million devices for DDoS attacks. The botnet allegedly powered some massive attacks over the past six months. Another reminder that operating a botnet is a career with excellent job security, if your definition of "job security" includes federal charges. **What to do:** Review your network for IoT devices with default credentials. Segment IoT gear away from critical infrastructure. --- China-Linked APT Targets EU Governments Via Discord and Microsoft Graph A Chinese threat group dubbed Webworm has been hacking European government entities by abusing legitimate services like Discord and Microsoft Graph for command and control. They're also using SoftEther VPN and other tunneling tools to blend malicious traffic with normal network activity. Living off the land meets living off the cloud, and it's working. **What to do:** Monitor for unusual traffic to cloud services like Discord API and Microsoft Graph from non-user endpoints. Review your egress filtering policies. --- That's the chaos for today. Stay sharp out there. --- Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown *This bulletin is provided for informational purposes. Contact us for tailored security analysis.*


European morning feed is so slow that all I see are posts from two days ago.

Hacker Wars - May 21, 2026 Your daily dose of infosec chaos --- Supply chain attacks are back on the menu, zero-days are getting patched faster than you can say "CVE" and someone found a nine-year-old kernel bug hiding in plain sight. Just another Thursday in infosec. --- GitHub Got Breached Through a VS Code Extension Hackers compromised GitHub's internal repositories by poisoning the Nx Console VS Code extension, which an employee had installed. The malicious extension gave attackers access to 3,800 internal repos, because apparently we're still trusting random extensions with our crown jewels. **What to do:** Audit your VS Code extensions list and remove anything you don't actively use. Implement extension allowlisting for corporate environments. --- Microsoft Patches Defender Zero-Days Being Exploited in the Wild Microsoft rushed out patches for two Defender vulnerabilities that attackers were already exploiting in real-world attacks. The zero-days allow attackers to bypass security protections, which is ironic considering Defender is supposed to be the thing protecting you. **What to do:** Update Windows Defender immediately and check that your endpoint protection definitions are current. --- Nine-Year-Old Linux Kernel Bug Finally Discovered Researchers found CVE-2026-46333, a privilege escalation vulnerability in the Linux kernel that's been sitting there for nine years with a CVSS score of 5.5. It allows unprivileged local users to access sensitive information, because why fix bugs when you can just... not find them? **What to do:** Check your Linux kernel version and apply patches from your distro. Consider running kernel hardening tools like grsecurity. --- SonicWall VPN MFA Bypassed Through Incomplete Patching Attackers brute-forced VPN credentials and bypassed MFA on SonicWall Gen6 SSL-VPN appliances to deploy ransomware tools. Turns out the patches SonicWall released earlier didn't fully address the vulnerabilities, which is a fancy way of saying "we tried." **What to do:** If you're running SonicWall Gen6 SSL-VPN, apply the latest patches and consider switching to certificate-based authentication instead of passwords. --- That's the chaos for today. Stay sharp out there. --- Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown *This bulletin is provided for informational purposes. Contact us for tailored security analysis.*








Serious Question: The alcohol industry has lost $830 billion in the last 4 years, because Gen Z is not drinking. Why do you think they aren’t drinking?

Hacker Wars - May 20, 2026 Your daily dose of infosec chaos --- GitHub got popped, BitLocker got bypassed, and Grafana's source code walked out the door. Supply chain attacks are the gift that keeps on giving - if by "gift" you mean "incident response nightmares." Three stories, three different ways your trust model just got wrecked. --- GitHub Breached - TeamPCP Steals 3,800 Internal Repos Via Malicious VS Code Extension The TeamPCP hacking group confirmed what many feared: they accessed roughly 3,800 GitHub internal repositories after an employee installed a poisoned VS Code extension. The compromised employee device gave the attackers a foothold into GitHub's internal codebase, including private source code and internal tooling. GitHub says there's no evidence of customer data impact, but the exposure of internal repos is a significant intellectual property and security concern. **What to do:** Audit your VS Code extensions inventory and implement allowlisting for developer tooling. If you're using GitHub, review your organization's access controls and monitor for anomalous API activity. --- Microsoft Drops Mitigation for YellowKey BitLocker Zero-Day (CVE-2026-45585) Microsoft released a mitigation for YellowKey, a BitLocker security feature bypass vulnerability that carries a CVSS score of 6.8. The zero-day, now tracked as CVE-2026-45585, was publicly disclosed last week and allows attackers to circumvent full-disk encryption protections. Microsoft is aware of active exploitation but a full patch isn't available yet - just a workaround. **What to do:** Apply the Microsoft mitigation immediately if you rely on BitLocker for endpoint encryption. Consider layering additional encryption controls and monitor for physical access indicators on high-value endpoints. --- Grafana Breach Deepens - TanStack npm Attack Vector Exposed Grafana Labs confirmed that its recent GitHub breach, initially disclosed on May 19, involved a compromised npm package in the TanStack supply chain. The attackers leveraged the poisoned dependency to gain access to Grafana's GitHub environment, exfiltrating both public and private source code. Grafana says customer production systems and data were not affected, but the source code exposure could fuel future vulnerability research. **What to do:** If you use Grafana products, pin your dependencies and monitor for security advisories. Review your software supply chain security posture and consider using tools like Sigstore or SLSA to verify package integrity. --- Catch you tomorrow. In the meantime, go check your attack surface. --- _Brought to you by sig9_ - sig9.ch | _Protecting the unseen, securing the unknown_ *This bulletin is provided for informational purposes. Contact us for tailored security analysis.*

Hacker Wars - May 19, 2026 Your daily dose of infosec chaos --- Tuesday's serving of security nightmares is here, and it's a mixed bag of supply chain attacks, government-grade credential leaks, and robots that apparently don't know how to say no to arbitrary commands. Grab your coffee and let's dive in. --- CISA Contractor Leaks AWS GovCloud Keys on GitHub A contractor for CISA - yes, the US government's cybersecurity agency - accidentally pushed AWS GovCloud credentials to a public GitHub repo. The exposed keys granted access to highly privileged accounts and a swath of internal CISA systems. You really can't make this stuff up. **What to do:** Rotate any AWS keys that may have been exposed, audit your GitHub repos for accidental credential commits, and enable secret scanning on all repositories. --- GitHub Actions Supply Chain Attack Steals CI/CD Credentials Threat actors compromised the popular actions-cool/issues-helper GitHub Action, rewriting all existing tags to point to a malicious commit. The poisoned workflow harvested CI/CD secrets and exfiltrated them to an attacker-controlled server. If your pipelines use this action, assume your secrets are gone. **What to do:** Audit your GitHub Actions workflows for dependencies on actions-cool/issues-helper, rotate all CI/CD secrets, and pin your actions to specific commit SHAs instead of tags. --- Critical Flaw Exposes Industrial Robot Fleets to Remote Hacking CVE-2026-8153 is a critical OS command injection vulnerability in Universal Robots PolyScope 5, the software powering fleets of industrial robots worldwide. An attacker could exploit this to execute arbitrary commands on robot controllers - which is exactly as terrifying as it sounds when heavy machinery is involved. **What to do:** Apply vendor patches immediately, segment industrial robot networks from corporate and internet-facing systems, and monitor for unusual command execution on robot controllers. --- SHub macOS Infostealer Now Spoofs Apple Security Updates A new variant of the SHub infostealer targets macOS users by displaying a convincing fake Apple security update dialog via AppleScript. Once the user clicks through, it installs a backdoor and starts siphoning credentials. Social engineering meets malware, macOS edition. **What to do:** Only install macOS updates through System Settings, never from pop-up dialogs. Deploy endpoint detection on macOS devices and educate users about this attack vector. --- INTERPOL Operation Ramz Takes Down 200 Cybercriminals In a refreshing change of pace, INTERPOL's Operation Ramz resulted in the seizure of 53 malware and phishing servers and over 200 arrests across the Middle East and North Africa. The operation targeted cybercriminals running phishing campaigns and distributing malware. Sometimes the good guys do win. **What to do:** No action needed - just enjoy this one. Consider it a palate cleanser between the doom and gloom. --- Catch you tomorrow. In the meantime, go check your attack surface. --- Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown *This bulletin is provided for informational purposes. Contact us for tailored security analysis.*





Hacker Wars - May 18, 2026 Your daily dose of infosec chaos --- If today's headlines are any indication, supply chain security is still the gift that keeps on giving. Grafana joins the growing list of companies whose source code walked out the door thanks to a stolen token, while 7-Eleven confirmed that ShinyHunters made off with over half a million customer records from their Salesforce instance. Throw in a fresh chain of OpenClaw exploits and a batch of critical patches across Ivanti, Fortinet, SAP, VMware, and n8n, and you've got yourself a proper Monday. --- Grafana Source Code Swiped via Stolen GitHub Token Grafana Labs confirmed that attackers used a compromised GitHub access token to download the company's entire source code repository. While Grafana says there's no evidence the token was used to inject malicious code, the sheer fact that a single leaked credential gave full read access to the codebase is a textbook example of why token hygiene matters more than ever. **What to do:** Audit your CI/CD pipelines and GitHub token scopes. If you're not pinning tokens to specific repos and actions with minimal privileges, today is the day to fix that. --- 7-Eleven Confirms Data Breach After ShinyHunters Ransom Demand The convenience store giant confirmed a breach after ShinyHunters claimed to have exfiltrated over 600,000 Salesforce records containing personal information and corporate data. The group is now demanding a ransom, which 7-Eleven has reportedly declined to pay - setting up a potential data dump scenario. **What to do:** If you rely on Salesforce or similar CRM platforms, enforce strict access controls and enable enhanced logging. Breaches through third-party SaaS are becoming the new normal. --- Claw Chain: Four OpenClaw Bugs Chained for Full Sandbox Escape Researchers demonstrated that four distinct vulnerabilities in OpenClaw can be chained together to steal credentials, break out of the sandbox environment, and install persistent backdoors on the host system. The exploit chain, dubbed Claw Chain, targets the application's privilege model and IPC mechanisms in a way that makes each individual bug look relatively harmless on its own. **What to do:** Update OpenClaw immediately if you're running it. Sandboxes are a defense-in-depth measure, not a security boundary - plan accordingly. --- Critical Patches: Ivanti Xtraction (CVSS 9.6) Leads a Busy Patch Tuesday Ivanti, Fortinet, SAP, VMware, and n8n all shipped security updates this week, led by a critical unauthenticated RCE flaw in Ivanti Xtraction (CVE-2026-8043, CVSS 9.6) that allows remote attackers to execute arbitrary code. Fortinet, SAP, and VMware also patched privilege escalation and authentication bypass bugs worth your attention. **What to do:** Prioritize the Ivanti Xtraction patch if you're running it. Then work through the rest - these vendors' products are prime targets for initial access brokers. --- Until next time, may your logs be clean and your alerts be false positives. --- Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown *This bulletin is provided for informational purposes. Contact us for tailored security analysis.*

Hacker Wars - May 15, 2026 Your daily dose of infosec chaos --- Another day, another CVSS 10.0 zero-day actively eaten in the wild - this time Cisco's SD-WAN gets the honors. Microsoft Exchange also decided to join the party with an XSS zero-day, because apparently Patch Tuesday wasn't enough excitement this week. Oh, and a student shut down bullet trains with a radio. You know, just a normal Thursday. --- Cisco SD-WAN Zero-Day Grants Full Admin Access (CVE-2026-20182) Cisco confirmed that a maximum-severity authentication bypass in the Catalyst SD-WAN Controller is being exploited in the wild, handing attackers administrative control over affected devices. This is the second CVSS 10.0 flaw in Cisco's SD-WAN stack exploited this year - which is a pattern, not a coincidence. **What to do:** Patch your SD-WAN controllers immediately. If you can't patch today, restrict management interface access to trusted networks only. --- Microsoft Exchange XSS Zero-Day Targets Outlook Web Users Microsoft published mitigations for a high-severity cross-site scripting flaw in Exchange Server that's already being weaponized against Outlook on the web users. Attackers can execute arbitrary code in the victim's browser context - classic stored XSS, but in your mail server. **What to do:** Apply Microsoft's recommended mitigations and monitor Exchange logs for unusual OWAscript.aspx requests. --- Pwn2Own Berlin Day One: 24 Zero-Days, Half a Million in Payouts Security researchers walked away with $523,000 on day one of Pwn2Own Berlin after demonstrating 24 unique zero-days against Windows 11, Microsoft Edge, and other targets. The highlights included full system compromises that would make any red team proud. **What to do:** Nothing actionable yet, but expect a flood of patches from Microsoft and friends in the coming weeks. Stay tuned. --- Student With Software-Defined Radio Shuts Down Taiwan Bullet Trains A Taiwanese student experimenting with software-defined radio technology managed to halt three high-speed trains for nearly an hour, triggering an anti-terrorism response. The incident exposed glaring gaps in rail system cybersecurity - specifically, the lack of signal authentication in critical transit infrastructure. **What to do:** If you operate ICS or OT environments, assume radio-frequency attacks are within reach of motivated amateurs. Review your physical-layer security. --- WordPress Burst Statistics Plugin Has Actively Exploited Auth Bypass A critical authentication bypass vulnerability in the Burst Statistics WordPress plugin is being exploited to gain admin-level access to websites. If you run WordPress and this plugin sounds familiar, this is your wake-up call. **What to do:** Update Burst Statistics immediately. If you're not using it, audit your WordPress plugins for anything you don't recognize. --- That's all for now. Patch your stuff and don't click suspicious links. --- Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown *This bulletin is provided for informational purposes. Contact us for tailored security analysis.*


Huge collapse in drinking among high schoolers 👀


It’s frightening how much of the world eats little to no cheese

People mock the EU as “bureaucracy”. But that bureaucracy turned a continent of borders, currencies and wars into a space where 450 million people can travel, pay, call, study and work almost as if it were domestic. That is not boring. That is civilization becoming usable.




