⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos
2026-05-26T01:24:10Z•a115fcc994da96e2160ebfcaaff827790e7fb77b7f8a9cade2b4e47e284654ff
active-exploitationcredential-theftgithub-compromiselinux-malwaremalicious-ci-cdnation-statephishingprivilege-escalationremote-code-executionsql-injectionsupply-chainweb-application
What happened
Week-in-review: a surge of active exploitation and coordinated supply-chain attacks. Multiple high- and maximum-severity flaws are being weaponized in the wild (notably Ghost CMS CVE-2026-26980, LiteSpeed cPanel CVE-2026-48172, Cisco Secure Workload CVE-2026-20223 and Drupal CVE-2026-9082 added to CISA KEV), alongside actively exploited Microsoft Defender issues (CVE-2026-41091). Cross-ecosystem supply-chain campaigns (TrapDoor targeting npm/PyPI/Crates.io, Packagist and compromised Laravel-Lang packages) and malicious CI/CD/GitHub activity (Megalodon, poisoned VS Code extension causing GitHub
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- a115fcc994da96e2160ebfcaaff827790e7fb77b7f8a9cade2b4e47e284654ff
- Enrichment time
- 2026-05-26T01:24:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.