Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

May 15, 2026, 11:52 AM EDT · Supply Chain · Supply Chain5 minMini Shai-Hulud Worm Exposes Limits of Trusted Publishing After 170+ npm and PyPI Packages Hit

The Mini Shai-Hulud campaign compromised more than 170 reported npm and PyPI packages, exposing how trusted publishing and provenance can still be abused when CI/CD environments are compromised.

May 15, 2026, 11:37 AM EDT · Exploits · Web Server Security4 minNGINX “Rift” Rewrite Module Flaw Confirmed as CVE-2026-42945

CVE-2026-42945 is now tracked as a heap-based buffer overflow in NGINX's rewrite module, affecting NGINX Open Source and NGINX Plus under specific rewrite-rule conditions.

May 15, 2026, 11:09 AM EDT · Exploits · Microsoft Exchange4 minMicrosoft Confirms Exploited Exchange OWA Vulnerability as CVE-2026-42897

Microsoft has disclosed CVE-2026-42897, a high-severity Exchange Server Outlook Web Access vulnerability affecting on-premises deployments, with mitigation available while a permanent fix is pending.

May 15, 2026, 10:25 AM EDT · Exploits · Network Security5 minCisco Patches Critical SD-WAN Zero-Day Exploited by Sophisticated Threat Actor

Cisco patched CVE-2026-20182, a critical Catalyst SD-WAN Controller and Manager zero-day that can let remote attackers bypass authentication and manipulate SD-WAN fabric configuration.