Latest cybersecurity dispatches

Fresh reporting on active vulnerabilities, security patches, incident response, and threat research for defenders.

May 15, 2026, 3:00 PM EDT · Exploits · CPU Security5 minIntel Branch Privilege Injection Flaw Undermines Six Years of Spectre v2 Hardware Defenses

Intel issued microcode mitigations for CVE-2024-45332, a Branch Privilege Injection flaw that can bypass Spectre v2 hardware defenses and leak privileged memory from affected systems.

May 15, 2026, 1:34 PM EDT · Exploits · Enterprise Apps5 minSAP Patches Second Critical NetWeaver Flaw After Researchers Link It to Chained Zero-Day Attacks

SAP patched CVE-2025-42999, a critical NetWeaver Visual Composer deserialization flaw linked to chained attacks that followed exploitation of CVE-2025-31324.

May 15, 2026, 11:52 AM EDT · Supply Chain · Supply Chain5 minMini Shai-Hulud Worm Exposes Limits of Trusted Publishing After 170+ npm and PyPI Packages Hit

The Mini Shai-Hulud campaign compromised more than 170 reported npm and PyPI packages, exposing how trusted publishing and provenance can still be abused when CI/CD environments are compromised.

May 15, 2026, 11:37 AM EDT · Exploits · Web Server Security4 minNGINX “Rift” Rewrite Module Flaw Confirmed as CVE-2026-42945

CVE-2026-42945 is now tracked as a heap-based buffer overflow in NGINX's rewrite module, affecting NGINX Open Source and NGINX Plus under specific rewrite-rule conditions.

May 15, 2026, 11:09 AM EDT · Exploits · Microsoft Exchange4 minMicrosoft Confirms Exploited Exchange OWA Vulnerability as CVE-2026-42897

Microsoft has disclosed CVE-2026-42897, a high-severity Exchange Server Outlook Web Access vulnerability affecting on-premises deployments, with mitigation available while a permanent fix is pending.

May 15, 2026, 10:25 AM EDT · Exploits · Network Security5 minCisco Patches Critical SD-WAN Zero-Day Exploited by Sophisticated Threat Actor

Cisco patched CVE-2026-20182, a critical Catalyst SD-WAN Controller and Manager zero-day that can let remote attackers bypass authentication and manipulate SD-WAN fabric configuration.