Latest CyberSec News by @thecyberpicker

Posts about macOS malware, exploits, and tools

Posts about macOS malware, exploits, and tools

Article about the bigfin squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

Peters was sentenced to nine years for stealing voting data and has been publicly unrepentant. But Colorado Governor Jared Polis has been hinting at the decision for months.

Day two of Pwn2Own Berlin 2026 saw $385,750 earned for 15 zero-days, bringing the total to $908,750 and 39 vulnerabilities over two days.

The commission will dole out  hefty fines and promises investigations for Take It Down Act violators. Experts say questions remain around the agency’s resources and priorities.

Secure the protocol layer of AI systems with the CIS MCP Companion Guide, covering authorization, tool access, and execution controls.

A critical vulnerability in the Funnel Builder plugin for WordPress is being actively exploited to inject malicious JavaScript snippets into WooCommerce checkout pages.

Rome, Italy, 15th May 2026, CyberNewswire

​During the second day of Pwn2Own Berlin 2026, competitors collected $385,750 in cash awards after exploiting 15 unique zero-day vulnerabilities in multiple products, including Windows 11, Microsoft Exchange, and Red Hat Enterprise Linux for Workstations.

UNC6671 leverages vishing combined with victim-branded credential harvesting sites to compromise SSO accounts and capture MFA.

Hackers have injected credential-stealing malware into newly published versions of node-ipc, a popular inter-process communication package, in a new supply chain attack targeting npm.

Turla turns Kazuar into a 3-module P2P botnet, enabling stealthy C2, resilient tasking, and persistent access.

Two vulnerabilities in the Avada Builder plugin for WordPress, with an estimated one million active installations, allow hackers to read arbitrary files and extract sensitive information from the database.

Researchers discovered the authentication bypass vulnerability while investigating a prior issue in the same service.

Claw Chain flaws in OpenClaw 2026.4.22 enable data theft, privilege escalation, and persistence when chained.

Entry points haven’t changed but the speed and scale of attacks have intensified, the security vendor found.

The threat group behind the attacks is also linked to a series of recently disclosed vulnerabilities in the vendor’s firewalls and SD-WAN systems.

Windows Snipping Tool - NTLMv2 Hash Hijack. CVE-2026-33829 . local exploit for Windows platform

Microsoft is updating the Edge web browser to ensure it no longer loads saved passwords into process memory in clear text at startup.

Stolen browser sessions and authentication tokens are becoming more valuable than stolen passwords. Flare explains how the REMUS infostealer evolved around session theft and operational scalability.

Microsoft warned that attackers are exploiting a new Exchange Server zero-day vulnerability, tracked as CVE-2026-42897, in the wild.

Explores identity spoofing vs identity abuse, clarifying how Zero Trust requires distinct controls and context-based access decisions.

The JDownloader website was compromised and installer download links served malware for several days.

Mini Shai-Hulud hit 2 OpenAI devices via TanStack, exposing limited credentials and forcing macOS certificate updates by June 12, 2026.

Trusted-tool abuse hit 84% of 700,000 incidents, driving 45-day assessments that reduce attack surface by 30%+.

Some AI-based video age-verification checks can be fooled with a fake mustache.

ESET uncovered new Ghostwriter (aka FrostyNeighbor) activity targeting Ukrainian govt organizations in a campaign active since March 2026.