Latest CyberSec News by @thecyberpicker

A list of topics we covered in the week of May 25 to May 31 of 2026

Pentagon confirmed adversaries are using location data to track U.S. troops, exposing risks tied to smartphones and ad-tech networks

This week on the Lock and Code podcast, we speak with Rainey Reitman about financial censorship that boots customers off major payment apps.

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Hackers are targeting WordPress websites running a vulnerable version of the WP Maps Pro plugin, which allows creating rogue administrator accounts without authentication.

Dutch authorities dismantled a 17 million-device botnet backed by 200+ servers, disrupting infrastructure used for cybercrime.

Palo Alto Networks is warning that hackers are now exploiting a PAN-OS GlobalProtect authentication bypass flaw, tracked as CVE-2026-0257, in attacks attempting to breach corporate networks.

Notepad++ 8.9.6 - Arbitrary Code Execution. CVE-2026-48778 . remote exploit for Windows platform

YAMCS yamcs-core 5.12.7 - User Enumeration. CVE-2026-44595 . webapps exploit for Multiple platform

YAMCS yamcs-core 5.12.7 - No Rate Limiting. CVE-2026-44596 . webapps exploit for Multiple platform

A newly discovered local privilege escalation vulnerability dubbed 'CIFSwitch' in the Linux kernel could allow attackers to forge CIFS authentication key descriptions, abuse the kernel's key request mechanism, and gain root privileges.

YAMCS yamcs-core 5.12.7 - LDAP Injection. CVE-2026-42568 . webapps exploit for Multiple platform

Hackers are texting Signal users posing as Support, asking for backup recovery keys. Once obtained, they can decrypt the message history.

Posts about macOS malware, exploits, and tools

Dutch authorities have seized 200 servers running a 17-million-device botnet linked to proxy service Asocks.

Revolut a récemment montré de nouvelles cartes sur lesquelles il manque quelque chose d'essentiel : les numéros. C'est justement cette absence qui est censée tenir les fraudeurs à distance. Sortir sa carte bancaire en terrasse, à une caisse ou dans les transports, exposant sans y penser ses seize chiffres, sa date

Posts about macOS malware, exploits, and tools

CVE-2026-0257 is being actively exploited on PAN-OS devices since May 17, 2026, enabling unauthorized VPN access and network exposure.

GREYVIBE targeted Ukraine since August 2025 using AI-assisted malware campaigns, increasing espionage capabilities and attribution challenges.

Microsoft Security’s latest updates extend visibility, control, and protection across expanding ecosystems as organizations accelerate AI adoption.

A multi-stage attack on Linux devices began with an exposed F5 BIG-IP edge appliance and pivoted to an internal Confluence server for credential theft and identity compromise. Learn how the threat actor attempted Kerberos relay and lateral movement, and how Microsoft Defender detected, blocked, and unraveled the attack.

A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and detection opportunities to help organizations identify and disrupt related activity.

Someone named “Squid” seems to be a “West Country legend.” As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

ChatGPhish exploits ChatGPT Markdown rendering to deliver phishing content from summarized web pages, increasing AI attack surfaces.

Zachary Sweeney allegedly traveled to New York, Indiana, Missouri and Georgia to meet and harm numerous victims in person. The FBI began investigating him in 2023.