Emma Davis

News · May 23, 2026

Laravel-Lang Composer Packages Hijacked to Drop Credential Stealer

Laravel-Lang Composer packages were hijacked through rewritten GitHub tags to load a credential stealer. Check composer.lock, src/helpers.php, autoload.files, and rotate exposed CI secrets.

News · May 22, 2026

Drupal Core CVE-2026-9082 SQL Injection Is Being Exploited

Drupal Core CVE-2026-9082 is a PostgreSQL-only SQL injection flaw now listed in CISA KEV. Patch affected Drupal branches and check logs for exploit attempts.

News · May 21, 2026

Microsoft Defender CVE-2026-41091 and CVE-2026-45498 Exploited in Attacks

Microsoft Defender CVE-2026-41091 and CVE-2026-45498 are exploited in attacks. Check Engine 1.1.26040.8, Platform 4.18.26040.7, and update endpoints before the CISA KEV deadline.

News · May 20, 2026

SonicWall Gen6 CVE-2024-12802 MFA Bypass Still Enables VPN Attacks

Attackers are bypassing MFA on SonicWall Gen6 SSL-VPN devices where CVE-2024-12802 remediation was incomplete. Disable LDAP UPN login, check VPN logs, and replace unsupported...

News · May 19, 2026

ChromaDB CVE-2026-45829: Pre-Auth RCE Risk in Python Server

ChromaDB CVE-2026-45829, dubbed ChromaToast, can let an unauthenticated attacker execute code through malicious embedding model loading before authentication checks run.

News · May 18, 2026

SHub Reaper macOS Infostealer Spoofs Apple Security Updates

SHub Reaper is a macOS infostealer campaign that abuses AppleScript, fake security updates, and GoogleUpdate-like LaunchAgents to steal browser data, wallets, files, and sessions.

News · May 17, 2026

NGINX CVE-2026-42945 Rewrite Module Flaw Is Being Exploited

NGINX CVE-2026-42945 is now being exploited in the wild, according to VulnCheck activity reported by The Hacker News. Patch exposed NGINX servers and review...

News · May 16, 2026

Funnel Builder WooCommerce Flaw Exploited to Steal Card Data

Attackers are exploiting Funnel Builder by FunnelKit before version 3.15.0.3 to inject fake analytics scripts into WooCommerce checkout pages and steal payment details.

News · May 15, 2026

Microsoft Exchange CVE-2026-42897 OWA XSS Is Being Exploited

Microsoft says CVE-2026-42897 is being exploited against on-premises Exchange Server. Admins should verify EEMS or EOMT mitigation, check OWA exposure, and review suspicious webmail...

News · May 14, 2026

Cisco SD-WAN CVE-2026-20182: Exploited Auth Bypass Gets CVSS 10

Cisco says CVE-2026-20182 is being exploited against Catalyst SD-WAN Controller and Manager. The CVSS 10 flaw can let a remote attacker gain high-privileged access...

News · May 13, 2026

Exim CVE-2026-45185: Patch Critical STARTTLS and CHUNKING RCE Flaw

Exim 4.99.3 fixes CVE-2026-45185, a critical remote code execution flaw tied to GnuTLS, STARTTLS, and CHUNKING. Mail admins should patch quickly or temporarily disable...

News · May 12, 2026

Mini Shai-Hulud Worm Hits npm and PyPI Packages Across TanStack, Mistral AI

A Mini Shai-Hulud supply-chain wave hit npm and PyPI packages tied to TanStack, Mistral AI, Guardrails, OpenSearch, and UiPath. Teams should freeze installs, inspect...