Cyber security developments for Thursday the 28th of May 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 18 articles to cover. All attribution is by the article authors. All article analysis is automated.
CISA have added LiteSpeed cPanel and WHM plugins to the Known Exploited Vulnerabilities catalogue. Authenticated cPanel users can escalate to root privileges through a flaw in the plugin's redisAble function, and it's being actively exploited against public-facing web hosting control panels. Update immediately if you're running affected versions.
Google Threat Intelligence Group have documented a sophisticated Chinese-language Phishing-as-a-Service ecosystem targeting non-Chinese entities globally. These platforms enable real-time MFA bypass through OTP interception, use encrypted delivery via RCS and iMessage, and can steal directly from digital wallets โ with services like Darcula using AI to clone legitimate websites on the fly.
The FBI have issued an alert on the Silent Ransom Group, also known as Luna Moth or Chatty Spider. They're impersonating IT personnel through voice phishing to gain access via legitimate remote admin tools like Zoho Assist or AnyDesk, then exfiltrating data with Rclone and cloud platforms before extorting victims. Since Spring 2023, they've consistently targeted US law firms along with insurance, finance, and healthcare sectors.
Gambit Security have attributed the 'Ababil of Minab' campaign to Iran-linked Black Shadow, which targets U.S., Israeli, Saudi, and Turkish critical infrastructure. Active since March or April this year, the campaign disguises itself as hacktivism whilst hitting transportation authorities โ including LA Metro and SFRTA โ along with commercial entities, specifically going after virtualisation, databases, and backup systems to maximise destructive impact.
Tencent have published an analysis of the YoroTrooper threat actor's campaigns targeting the Commonwealth of Independent States and surrounding regions. The article content wasn't accessible for detailed analysis, but it appears to be threat actor profiling focused on geopolitical targeting patterns.
An academic case study in ScienceDirect examines cyber-threat intelligence operations at a mature financial organisation and reveals something rather interesting. The organisation operates a bottom-up intelligence model, contrary to the top-down, requirements-driven approach prescribed for military and civilian CTI operations โ highlighting a fairly significant misalignment between intelligence theory and what actually happens in practice.
South Korea's Ministry of Science and ICT have launched the Incident Investigation Review Committee ahead of amended cybersecurity legislation coming into force in October. The committee will serve as an advisory body to stabilise public-private cooperation and manage major security incidents, primarily affecting information and communications service providers operating in South Korea.
The White House Office of Management and Budget have issued memorandum M-26-14 establishing requirements for federal agencies to implement effective logging and network visibility capabilities. The memorandum mandates improved security monitoring, log collection, and network traffic analysis to enhance detection and response across the federal enterprise.
CERT-In have released a strategic framework addressing AI-driven cyberattacks where threat actors use frontier AI systems to automate the entire attack lifecycle, from reconnaissance through to exploit generation. The blueprint mandates accelerated patch deployment windows between 12 hours and 5 days to counter the reduced time between vulnerability disclosure and weaponisation โ which is either optimistic or terrifying, depending on the size of your estate.
X41 D-Sec have disclosed a high-severity vulnerability in the Starlette web framework, versions 0.8.3 through 1.0.0, that fails to validate the Host HTTP header. Attackers can inject arbitrary paths into reconstructed URLs, potentially bypassing authentication, enabling server-side request forgery, or achieving remote code execution in vulnerable configurations. FastAPI applications are also affected as they're built on Starlette.
Researchers have documented a use-after-free vulnerability in the Linux kernel's epoll subsystem affecting versions 6.6 and later. Introduced by a 2023 performance optimisation that replaced global locking with per-instance refcounting, the race condition allows unprivileged processes to trigger memory corruption or potentially achieve arbitrary write primitives. The fix replaces kfree with kfree_rcu to respect RCU grace periods.
PromptArmor have found a file exfiltration vulnerability in Microsoft Copilot Cowork that exploits the agent's ability to automatically send emails and Teams messages without user approval. Attackers can use indirect prompt injection to exfiltrate pre-authenticated download links for sensitive files through external network requests triggered by malicious payloads.
GitHub Security Lab have disclosed a critical heap buffer overflow in 7-Zip's NTFS archive handler that allows arbitrary code execution through vtable hijacking. The flaw affects all versions up to 26.00 and stems from undefined behaviour in a 32-bit shift operation that causes severe under-allocation of the compressed stream buffer. A fix was released in version 26.01 on the 27th of April.
Cyble have identified the 'Jomangy' campaign targeting FreePBX systems for VoIP toll fraud. The operation deploys a sophisticated self-healing PHP webshell with six independent persistence mechanisms and 18 backdoor accounts, affecting systems across Latin America, Southeast Asia, and the Middle East โ which is rather more resilient than your average webshell.
The BBC are reporting that Anthropic's Claude Mythos AI model has identified 1,600 vulnerabilities across hundreds of software programmes, prompting restricted release to governments and security institutions. Elite ethical hackers like Valentina 'Chompie' Palmiotti are increasingly using AI tools to accelerate vulnerability research workflows, whilst evidence shows malicious actors are already leveraging AI for attacks and data breaches.
Elastic have documented Tycoon 2FA, a Phishing-as-a-Service platform using adversary-in-the-middle techniques to bypass MFA by intercepting session tokens in real-time from Microsoft 365, Entra ID, and Google Workspace users. The platform operates as a reverse proxy between victims and legitimate identity providers, capturing credentials and MFA codes, then maintaining persistent access through techniques like rogue device registration for Primary Refresh Tokens.
A security researcher has released Sylvia, an IDA Pro 9.x script that automates the identification and documentation of BSD syscalls in iOS and macOS AArch64 binaries. The tool scans for SVC instructions, resolves syscall numbers, and provides a graphical interface with descriptions for around 250 syscalls, supporting export to JSON โ one for reverse engineers and malware analysts working with binaries that employ anti-tamper mechanisms using syscalls.
And finally, an article on behaviour detection methodologies for AI agents, focusing on identifying and monitoring autonomous AI system activities. The piece explores detection approaches that could be applied to understand and track AI agent behaviour patterns in security contexts, though the content details weren't accessible at time of analysis.
That concludes today's briefing.