Cyber security developments for Friday the 22nd of May 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 7 articles to cover. All attribution is by the article authors. All article analysis is automated.
The Center for Strategic and International Studies has published an assessment arguing that China has reached peer status with the United States in cyberspace. They point to groups like Salt Typhoon and Volt Typhoon achieving persistent access to critical infrastructure and government systems, with operations now incorporating AI for large-scale targeting. Worth reading if you're interested in the strategic picture beyond individual campaign reporting.
GitHub disclosed on the 19th that they'd detected and contained compromise of an employee device through a poisoned VS Code extension. Following on from the story we covered earlier this week, unauthorised access to internal repositories occurred, though they state there's no evidence of customer data impact outside those internal systems. The attack vector itself is the interesting bit β supply chain compromise via malicious IDE extensions targeting employees directly.
FalkorDB Browser version 1.9.3 has an unauthenticated path traversal flaw in its file upload API that allows remote attackers to write arbitrary files to the server, leading to potential remote code execution. If you're running the affected version, update immediately.
Researchers have demonstrated a memory reading technique that abuses the Windows thread creation API and depth list query functions to read arbitrary memory from remote processes without touching ReadProcessMemory. Creates remote threads that return two bytes of memory via the exit code, which means it evades hooks monitoring the usual memory access functions. One for offensive tool developers and defenders tracking evasion trends.
And another exploit writeup β this time for NGINX Rift, the heap buffer overflow vulnerability in the rewrite module that allows unauthenticated remote code execution. A private lab and exploit chain have been published demonstrating how a length calculation discrepancy during URI escaping can be leveraged to corrupt memory structures. This one includes heap feng shui techniques and demo recordings if you're interested in the mechanics.
Bishop Fox released AIMap, an open-source tool for discovering and assessing exposed AI and machine learning endpoints across the internet. It identifies insecure deployments of services like MCP servers and Ollama instances, many of which lack authentication entirely. Automates the process from discovery through to protocol-specific exploitation testing.
And finally, a Linux persistence detection tool called persisthunt. It's an open-source bash script that automates detection of common persistence mechanisms β active shells, eBPF-based rootkits like BPFdoor, malicious systemd services, hidden processes, and so on. Categorises findings by severity and assists with artifact collection during incident response.
That concludes today's briefing.