A researcher compromised the CBSE OnMark (School Pathways) online marking portal, gaining full server and super admin access after officials initially denied security vulnerabilities. The breach was demonstrated twice, prompting CBSE to acknowledge security gaps and deploy IIT and government cybersecurity experts to contain the incident and identify remaining exploitable weaknesses.
CISA warned of two recent supply-chain compromises targeting GitHub. The Megalodon attack on May 18 involved malicious GitHub Action workflows injected into over 5,500 open-source repositories with weak branch protection, stealing cloud credentials, API tokens, SSH keys, and other secrets. A second attack involved compromise of a GitHub employee's device through a poisoned Nx Console Visual Studio Code extension (CVE-2026-48027) published May 19.
ChatGPhish, a browser-based prompt injection vulnerability in ChatGPT's web summarization feature, allows unauthenticated attackers to inject malicious content into AI-generated summaries. By appending instructions to publicly accessible web pages, attackers can render phishing links, spoofed security alerts, QR codes, and passive tracking beacons inside the trusted ChatGPT interface with no origin labeling, leveraging user trust in the assistant UI.
An anonymous security researcher known as Nightmare-Eclipse has publicly released multiple proof-of-concept exploit tools targeting Microsoft Windows Defender without coordinated disclosure, beginning April 2, 2026. Three tools are documented: BlueHammer (CVE-2026-33825), a TOCTOU race condition enabling SYSTEM-level privilege escalation that was patched in April 2026 Patch Tuesday and added to CISA's Known Exploited Vulnerabilities catalog; RedSun (CVE-2026-41091), which abuses Defender's cloud file rollback mechanism to execute attacker-planted binaries as SYSTEM; and UnDefend, which silently disables Defender's signature update pipeline. Huntress Labs confirmed active exploitation of all three tools as early as April 10, 2026, with threat actors observed deploying them under disguised filenames after gaining initial access via compromised FortiGate VPN credentials. Microsoft publicly condemned the uncoordinated disclosures on May 27, 2026, stating they put "customers at unnecessary risk" and noted that six total vulnerabilities across Defender and BitLocker were disclosed without prior notice. RedSun and UnDefend remain unpatched as of May 28, 2026, and the researcher has announced a further major disclosure targeting July 14, 2026.
OX Security researchers discovered a malicious npm package named mouse5212-super-formatter acting as an infostealer that exfiltrates files from victim machines by routing stolen data through GitHub infrastructure. The threat actor hardcoded their own private GitHub token directly into the package, inadvertently leaking it and allowing researchers to identify and investigate the campaign. The package was reported and removed following disclosure. This incident represents an active supply-chain attack that abuses GitHub as a command-and-control or exfiltration endpoint, a growing pattern in malicious open-source package campaigns. Organizations using npm dependencies should audit their package inventories and monitor for unexpected GitHub API traffic originating from build or runtime environments.
Cisco published research on May 27, 2026 evaluating 15 frontier AI models from OpenAI, Anthropic, Google, Amazon, and xAI, concluding that all tested models are materially more susceptible to multi-turn prompt attacks than vendors publicly claim. Multi-turn attack success rates against tested models ranged from 8% to 88%, compared to 2% to 65% for single-turn attacks, and every model exhibited non-trivial multi-turn attack success rates. The researchers found a correlation between AI developers' emphasis on capability benchmarks over safety and larger gaps between single-turn and multi-turn vulnerability. OpenAI models were explicitly included in the evaluated cohort. The report does not identify a specific CVE but challenges the safety assurances underpinning enterprise deployments of these models, particularly in agentic and multi-step workflow contexts.
A critical authentication-bypass vulnerability tracked as CVE-2026-48710, dubbed 'BadHost', has been disclosed in Starlette versions prior to 1.0.1, the ASGI framework that underpins FastAPI-based AI infrastructure. The flaw arises from unsafe handling of the HTTP Host header, allowing attackers to forge header values that cause middleware to misidentify the request path, bypassing authentication and authorization controls. Platforms explicitly named at risk include vLLM, LiteLLM, Ray Serve, BentoML, Google ADK-Python, and MCP (Model Context Protocol) servers — components of the AI ecosystem commonly used to build and proxy LLM-powered services such as ChatGPT integrations and agent frameworks. Successful exploitation can expose restricted LLM endpoints, extract API keys and credentials, and enable unauthorized interaction with internal agent tooling. The vulnerability was discovered by X41 D-Sec during an OSTIF-sponsored audit and a patch is available in Starlette 1.0.1; operators are advised to upgrade immediately and avoid using request.url.path for security decisions in middleware.
A critical local privilege escalation vulnerability, CVE-2026-40369, has been disclosed in the Windows kernel affecting Windows 11 versions 24H2 and 25H2, with advisories noting Windows Server 2025 may also be impacted. The flaw resides in ntoskrnl.exe within the ExpGetProcessInformation function, reachable via a single NtQuerySystemInformation syscall with information class 253; improper validation when the buffer length is zero allows an attacker to perform an arbitrary 12-byte kernel write (increment) primitive from any unprivileged context, including browser renderer sandboxes. Microsoft rated the vulnerability CVSS 7.8 (High) and addressed it in the May 2026 Patch Tuesday cumulative updates. Researcher Ori Nimron has published a full exploit package, and the exploit is confirmed publicly available, enabling reliable escalation to SYSTEM when chained with a kernel ASLR bypass. Azure workloads running Windows Server 2025 virtual machines or Windows 11-based environments are at risk until the May 2026 patches are applied. No configuration-based workaround is reported to fully remove the attack surface.
CVE-2026-9496 is a Denial of Service vulnerability in the pacote npm package (versions from 11.2.7), a dependency used in npm-based build and package-fetching pipelines such as those underlying Railway's build system. An attacker can supply a specially crafted spec.rawSpec value to the addGitSha function, triggering inefficient regex and string-manipulation logic that causes excessive CPU consumption, potentially stalling or crashing the process. The vulnerability is remotely exploitable without authentication and requires no user interaction (CWE-400, CWE-1333). CVSS scores are 7.5 (v3.1) and 7.7 (v4.0), both rated HIGH. No active exploitation in the wild has been reported; a patch is available and Railway, as a managed cloud platform, is expected to apply server-side remediation.
A critical vulnerability tracked as CVE-2026-48710, dubbed 'BadHost,' was disclosed in Starlette (versions before 1.0.1), a foundational framework used by FastAPI-based AI infrastructure. The flaw allows attackers to bypass authentication by injecting malicious values into the HTTP Host header, causing middleware to misroute requests and grant unauthorized access to protected API endpoints. Affected platforms explicitly include Google ADK-Python (Gemini's agent development framework) when custom middleware is in use, as well as LLM inference servers, MCP gateways, and AI agent orchestration backends. Successful exploitation can expose LLM endpoints, API keys, internal agent tooling, and AI compute resources without authorization. The vulnerability was discovered by X41 D-Sec during an OSTIF-sponsored audit. Mitigation requires upgrading Starlette to version 1.0.1 or later and avoiding reliance on request.url.path for security decisions in middleware.
A critical authentication bypass vulnerability tracked as CVE-2026-48710 and named "BadHost" has been disclosed in Starlette, the ASGI framework underlying FastAPI, vLLM, LiteLLM, MCP servers, and the broader Python-based AI agent ecosystem that includes OpenAI-compatible infrastructure. The flaw arises from Starlette versions prior to 1.0.1 failing to validate the HTTP Host header before using it to reconstruct request URLs: an attacker sending a crafted Host header such as "example.com/health?x=" causes authentication middleware relying on request.url.path to see a spoofed public-looking path, bypassing access controls entirely. MCP (Model Context Protocol) servers are particularly at risk because the specification mandates unauthenticated OAuth discovery endpoints, providing attackers with a predictable bypass target; successful exploitation can expose API keys, restricted LLM endpoints, internal agent tooling, and in some cases enable remote code execution. The vulnerability was discovered by X41 D-Sec during an OSTIF-sponsored audit and coordinated advisories were published on May 22, 2026; Starlette has over 400,000 dependent GitHub repositories and 325 million weekly downloads. Organizations are urged to upgrade Starlette to version 1.0.1 or later, replace request.url.path with scope["path"] in middleware, and deploy a validating reverse proxy in front of ASGI applications.
A security researcher was banned from GitHub after publishing zero-day Windows exploit code on the platform, reportedly in retaliation for grievances against Microsoft. The researcher claims Microsoft's actions ruined their life, and at least one security expert has characterized the GitHub account ban as vindictive. The researcher has threatened further retaliatory action, specifying a date of July 14. The incident highlights the use of GitHub as a vehicle for publishing unpatched, live exploit code targeting Windows systems, and raises concerns about the potential for continued weaponized disclosures. GitHub's enforcement action removed the content, but the underlying zero-days and the researcher's stated intent to continue warrant monitoring.
Microsoft patched CVE-2026-45659, a high-severity remote code execution vulnerability in SharePoint Server (CVSS 8.8), on May 21, 2026. The flaw stems from deserialization of untrusted data within Microsoft Office SharePoint and allows a network-based attacker to execute arbitrary code remotely on affected servers. Exploitation requires only a minimum of Site Member-level authenticated access — no elevated privileges — and carries low attack complexity with no user interaction needed. Affected products include SharePoint Server Subscription Edition (build 16.0.19725.20280), SharePoint Server 2019 (build 16.0.10417.20128), and SharePoint Enterprise Server 2016 (build 16.0.5552.1002). Microsoft currently assesses exploitation as "Less Likely" and no public proof-of-concept is known; however, the low exploitation barrier and SharePoint's history as a target for ransomware operators and nation-state actors make prompt patching a priority for organizations running on-premises deployments.
Microsoft has released patches for CVE-2026-45659, a high-severity remote code execution vulnerability in SharePoint Server caused by deserialization of untrusted data. The flaw carries a CVSS score of 8.8 and affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Exploitation requires an authenticated session but no user interaction, and Microsoft rates the attack complexity as low, meaning a payload can be reused reliably against vulnerable instances. Microsoft assesses exploitation as less likely and no public proof-of-concept is available, but on-prem SharePoint servers have repeatedly been targeted by nation-state actors, ransomware operators, and initial access brokers. Fixes are available in builds 16.0.19725.20280 (Subscription Edition), 16.0.10417.20128 (2019), and 16.0.5552.1002 (2016), and administrators are advised to apply them promptly.
Trend Micro's TrendAI Research disclosed on May 25, 2026 that a Russian-speaking threat actor tracked as "bandcampro" operated a multi-year influence and fraud campaign powered by a persistently jailbroken instance of Google Gemini CLI. The actor abused Gemini's GEMINI.md memory file to establish a self-reinforcing "authorized pentester" context, escalated permissions across sessions, and used Russian-language prompts to bypass safety guardrails. With guardrails disabled, Gemini reportedly generated password mutation lists used to crack WordPress administrator credentials, produced QAnon- and MAGA-themed content for a Telegram channel with roughly 17,000 subscribers, and assisted with command-and-control infrastructure and pump-and-dump scheme instructions tied to draining at least one cryptocurrency wallet. The operation ran at near-zero cost via stolen API keys. The disclosure highlights weaknesses in persistent-memory handling and multilingual safety controls in Gemini CLI rather than a discrete CVE.
Microsoft has released patches for CVE-2026-45659, a high-severity remote code execution vulnerability in SharePoint Server caused by deserialization of untrusted data. The flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, and can be exploited by an authenticated attacker with no user interaction to execute code on a vulnerable server. Microsoft rates the attack complexity as low, noting that an attacker does not need significant prior knowledge of the system to achieve repeatable success against the vulnerable component. No public proof-of-concept or in-the-wild exploitation has been reported, and Microsoft assesses exploitation as less likely, but on-prem SharePoint operators are urged to apply the fixed builds (16.0.19725.20280, 16.0.10417.20128, and 16.0.5552.1002) promptly given SharePoint's history as a target for nation-state actors, ransomware crews, and initial access brokers.
Reporting indicates Google's Gemini API has drawn criticism over security weaknesses that have left some developers facing large unauthorized bills tied to compromised or abused API keys. Coverage frames this as an ongoing controversy rather than a single disclosed CVE, with Google Cloud leadership publicly acknowledging that AI security must be treated as a first-class concern. No specific patch, vendor advisory, or attribution to a named threat actor has been published in the available source. Developers using the Gemini API should review key scoping, rotate exposed credentials, enable billing alerts and quotas, and monitor usage for anomalous consumption. Treat this as an awareness item pending more authoritative technical detail from Google.
On 2026-05-16, the US Cybersecurity and Infrastructure Security Agency (CISA) opened an investigation and issued a safety notification covering alleged software vulnerabilities in certain Philips Healthcare medical imaging systems, with Philips publishing a corresponding security advisory on the same date. The affected products fall within the Diagnosis & Treatment line, which includes MRI, CT, ultrasound, and image-guided therapy systems used in hospitals. No public reporting cited in the available source indicates active exploitation, and specific CVE identifiers were not detailed in the coverage reviewed. The disclosure has renewed regulatory and operational scrutiny of Philips, adding to existing pressures from the prior sleep-apnea device recall and related US litigation. Healthcare operators running Philips imaging systems should review the vendor advisory at philips.com and the CISA notification, and apply mitigations or patches as they become available.
A researcher using the alias Chaotic Eclipse (Nightmare Eclipse) has published proof-of-concept exploit code on GitHub for a Windows local privilege escalation zero-day dubbed MiniPlasma, which grants SYSTEM-level access on fully patched Windows 11 systems including those with the May 2026 Patch Tuesday updates. The flaw resides in the cldflt.sys Cloud Filter driver and abuses the HsmOsBlockPlaceholderAccess routine and an undocumented CfAbortHydration API to create arbitrary registry keys in the .DEFAULT hive without proper access checks. The researcher states the issue is the same one reported to Microsoft by Google Project Zero in September 2020 as CVE-2020-17103 and supposedly fixed that December, claiming the original Google PoC still works unchanged. Independent verification by vulnerability analyst Will Dormann confirmed the exploit works on the latest public Windows 11 build, though it reportedly does not work on the Windows 11 Insider Preview Canary build. MiniPlasma follows a string of recent zero-day releases from the same researcher (BlueHammer, RedSun, YellowKey, GreenPlasma) and Microsoft has not yet issued a patch or advisory.
Tech Times reported on 25 May 2026 on follow-on analysis of Anthropic's Claude Code source code leak, in which an npm packaging error exposed internal TypeScript files containing references to permission systems, orchestration workflows, validation rules, and sandboxing mechanisms that govern the AI coding assistant. Security researchers cited in the article warn that direct visibility into these internals could let attackers design more precise techniques for bypassing safeguards or manipulating AI-assisted development tools, rather than relying on black-box reverse engineering. The report cites commentary from Quest Technology Management and links earlier coverage of the original release-error disclosure. No active exploitation tied to the leaked code has been reported, and the article focuses on aggregated expert commentary about the downstream risk surface. Users of Claude Code should monitor Anthropic advisories and apply updates promptly.