Cyber security developments for Saturday the 23rd of May 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 11 articles to cover. All attribution is by the article authors. All article analysis is automated.
CISA have added a Drupal SQL injection to the Known Exploited Vulnerabilities catalogue. The flaw affects versions 8.9 through 11.2.11 and allows unauthenticated attackers to execute arbitrary SQL commands, potentially achieving remote code execution on PostgreSQL installations. Active exploitation is confirmed in the wild, so if you're running Drupal, patch immediately.
Censys have written up ongoing breaches of automatic tank gauges at US petrol stations, with Iran-linked operators suspected. The gauges lack authentication and can be accessed over the public internet with a single unauthenticated command, allowing attackers to pull sensitive data and manipulate fuel readings on display. Over 6,000 exposed hosts identified, 70% of them in the US across major brands.
Cisco Talos have tracked a commodity malware ecosystem called BadIIS, operating as Malware-as-a-Service since at least 2021. It targets IIS servers and is distributed among Chinese-speaking threat actors, with dedicated builder tools and rapid iteration to evade detection. Worth a look if you're tracking Chinese tooling or defending web server infrastructure.
Quick Heal have documented Operation Dragon Whistle, a spear-phishing campaign by threat actor UNG0002 targeting Chinese academic institutions. The campaign uses weaponised shortcuts disguised as documents about fitness testing requirements, delivering Cobalt Strike via DLL side-loading whilst rotating command and control infrastructure between Chinese cloud providers.
ESET have analysed a shift in targeting by the China-aligned group Webworm, who've moved from Asian organisations to Europe and South Africa in 2025. The research covers their new operational patterns and geographic expansion, which represents a notable change in strategic focus.
Grafana Labs and Nrwl have both published incident reports following the TanStack supply chain attack we covered earlier this week. Grafana detected unauthorised access to internal repositories on May 11th, linked to the Mini Shai-Hulud campaign that compromised 84 packages. Separately, Nrwl disclosed that a malicious version of the Nx Console extension was published for up to 36 minutes after a developer's GitHub credentials were stolen in the same campaign, harvesting vault tokens, cloud credentials, and attempting persistence via sudoers injection. Around 6,000 users are believed affected by the extension compromise.
Security researcher Matt Suiche has audited the leaked Windows 2000 source code and found that critical vulnerabilities from the 1999 codebase persisted in later Windows versions for 6 to 25 years before being patched. The analysis covered 75 megabytes of source against 25 years of vulnerability research, identifying 11 confirmed high-confidence bugs. Turns out Windows kernel bugs have a decades-long half-life.
Kaspersky have disclosed a command injection vulnerability in ExifTool affecting macOS systems. The flaw allows attackers to execute arbitrary shell commands by embedding malicious instructions in image file metadata, specifically through unsanitised input in a function that handles file creation dates. One for macOS defenders, particularly if you process user-uploaded images.
Qualys have published details of a critical Linux kernel privilege escalation flaw present since 2016. The vulnerability exploits a race condition in credential handling, allowing unprivileged local users to escalate to root or steal sensitive credentials on widely-used distributions including Ubuntu, Debian, and Fedora. Patch immediately, or set a specific kernel parameter to 2 as interim mitigation.
And Searchlight Cyber have disclosed a pre-authentication path traversal in cPanel's CalDAV daemon that allows unauthenticated attackers to read arbitrary files with root privileges. The flaw combines a regex bypass via URL encoding with improper privilege dropping in Perl's implementation. Exploitation requires knowledge of a valid email address on the target instance but enables full system compromise through unrestricted file access.
That concludes today's briefing.