Plain-English cybersecurity news. Daily breakdowns of CVEs, threats, and the patches you actually need to apply. Built for tired engineers everywhere.
Joined November 2015
- Tweets 371
- Following 1
- Followers 35
- Likes 9
31 Photos and videos
StealC is an infostealer: it lifts saved browser passwords, cookies, and crypto wallet keys. The tell here is the "download here" .zip — real projects give you source to clone and build, not a binary behind a button. A fork pushing a zip is the red flag.
May 31
Yesterday I got a funny DM. @s00pcan said some AI slop is automatically forking his Linux open-source projects and adding goofy ass ReadMe files to look all fancy. The primary difference though is the ReadMe includes a "download here" link which delivers a .zip file.
The .zip file contains cool and badass malware. The malware is also free. Yay
This is a campaign which has been identified by various AV vendors since April, 2026. It is attributed to StealC.
In this particular instance though it is very, very silly. The exact mechanic in which this StealC group is using to automagically fork projects on GitHub, insert bogus ReadMe files, etc. is unknown. Clearly it is AI generated. However, this group failed to account for all edge cases because ... this is malware developed for Windows ... but it is from a Linux audio driver fork.
This yet again however a use case of AI in malware campaigns. StealC has been around forever and clearly isn't AI slop. However, Threat Actors are using AI to generate fancy schmancy ReadMe files. Very cool. Thank you, Mr. Smart GPU-thingy.
The following GitHub I'll be linking is giving FREE malware. Visiting the page won't give you the free malware. At the top of the ReadMe is a "Download" section with a hyperlink to "pcie_dante_snd_v1.4".
If you care what this payload does:
Inside this .zip file is "Application.cmd", "dir-dot-cc", "lua51.dll", and "loader.exe".
Application.cmd is a command line file, it launches loader.exe. Loader.exe is responsible for loading the "dir" file. Loader.exe is dependent on lua51.dll because the "dir" file is a GIANT obfuscated Lua file.
I hate Lua and I hate dealing with obfuscated Lua, I refuse to be a victim of Lua, so instead of trying to bonk it with a stick I emulated it. Unsurprisingly, the malicious Lua file tries to harvest credentials from Chrome and exfiltrate them to a remote host.
Free malware: github-dot-com/mbyington67-prog/snd-dante-pcie/tree/master
tl;dr ai slopping and forking github, delivers malware that uses obfuscated lua, i like cats a lot
164
If you still sandbox untrusted JS with vm2 (npm), stop. Four new CVSS-10 sandbox escapes dropped this week — code inside the sandbox runs commands on your host. vm2 was deprecated in 2023; migrate to isolated-vm. github.com/advisories/GHSA-m…
7
"17M infected devices" undersells it — this is a residential proxy network. The phones aren't attacking anyone; they're rented as home IPs so someone else's fraud blends into normal traffic. Same as PROXYLIB (2024): seize the servers, the SDK stays on the phones.
May 31
Dutch authorities have dismantled a botnet comprising at least 17 million infected devices, including computers, smartphones, tablets, and IoT devices.
More than 200 servers in the Netherlands supported the operation. Police seized a subset of the infrastructure, and the hosting provider subsequently took the network offline.
Read: thehackernews.com/2026/05/du…
11
PAN-OS decrypts GlobalProtect auth-override cookies but never checks the signature. Reuse one cert for HTTPS this feature and an attacker forges a login cookie from the public key—no creds. Patch, or just give the feature its own cert. CVE-2026-0257, now in KEV.
May 30
Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
57
CISA added a Palo Alto PAN-OS authentication bypass to KEV this week (CVE-2026-0257) — already exploited. "Auth bypass" sounds like jargon but means exactly what it says. Worth understanding why it is the bug class that makes a security team cancel its evening.
1
65
And the targets are always the same shape: VPNs, firewalls, management consoles. The boxes that sit at the network edge by design. An auth bypass on your firewall hands an attacker the exact thing the firewall was there to protect.
1
4
If you remember one thing: when an advisory says "authentication bypass" on an internet-facing device, treat it like the building is already on fire. Patch tonight, then read your logs — exploited-in-the-wild means someone may already be inside.
nvd.nist.gov/vuln/detail/CVE…
36
Translation: you name a git branch so Gogs runs it as a shell command. Create an account, push the branch, and you're RCE as the Gogs service. Same class of argument-injection bug that bit them in 2024 — exposed instances should expect mass scanning fast.
May 30
Self-hosted #Gogs instances with public registration enabled are at highest risk right now.
Attackers can create their own accounts and fully compromise the server in minutes using the malicious branch name exploit.
A ready-to-use #Metasploit module makes this even more dangerous for exposed instances.
Disable public sign-ups and repository creation immediately until Gogs ships a patch.
5
Today (Fri, May 29): 1 new KEV add, 43 critical CVEs.
The 3 that matter:
- PAN-OS auth bypass (CVE-2026-0257) — new KEV, exploited. Unauth VPN access.
- Dokploy (self-hosted PaaS): 8 criticals, one CVSS 10.
- Plesk XPath injection, CVSS 9.9.
cisa.gov/known-exploited-vul…
107
The throughline: state-aligned crews are now prioritizing AI/robotics R&D and the nuclear sector, not just the usual gov/defense targets. Their targeting tracks where the strategic IP is moving. If you build in those spaces, this report is about you.
May 28
#ESETresearch released its latest APT Activity Report (Oct 2025–Mar 2026): 🇨🇳China-aligned groups focused on Venezuela, Gulf states, and AI & robotics industry in 🇰🇷South Korea, while 🇰🇵North Korea-aligned APTs targeted the nuclear sector. Full report: web-assets.esetstatic.com/wl…
7
Microsoft fixed a CVSS-10 Entra ID bug server-side last week. Origin-validation error let an unauth network attacker elevate privileges. Entra ID fronts most Microsoft tenants -- worth a look at sign-in logs.
nvd.nist.gov/vuln/detail/CVE…
17
Nx Console = the VSCode extension for the Nx monorepo build tool. Trojanize a dev's editor and you land straight on credentials, source repos, and the registries those devs publish to. If anyone on your team uses it, audit today.
May 28
🚨 Supply chain compromises are impacting developer environments, targeting GitHub & Nx Console. See our Alert for detection and remediation recommendations & our KEV Catalog for info on Nx Console embedded malicious code vulnerability CVE-2026-48027. 🔗 go.dhs.gov/559
21
Ubiquiti patched three CVSS-10 bugs in UniFi OS a week ago. Three separate ones. None of them does much on its own. The interesting part — and the reason this is a story — is the way they fit together. That pattern has a name: an exploit chain.
1
47
This is why 'CVSS 10' on its own isn't the right unit. A standalone CVSS-10 RCE is bad. A CVSS-10 CVSS-10 CVSS-10 stack that compose into one path is worse — and faster to weaponize, because each piece is small and well-understood already.
1
19
If you remember one thing: patch counts are misleading when bugs in the same product compose. Three small bugs in the same surface area often beat one big bug. Ubiquiti's fixes are out; patch your UniFi gear.
bleepingcomputer.com/news/se…
13