Windows Zero-Days Expose Systems, Critical NGINX Flaw Under Active Attack, and State-Sponsored Ransomware Targets OT

Unpatched 'MiniPlasma' Windows Vulnerability Grants SYSTEM Privileges by Reviving CVE-2020-17103

A security researcher has released a proof-of-concept exploit for 'MiniPlasma,' an unpatched zero-day vulnerability affecting modern Windows 11 systems. The flaw, a regression of a bug Microsoft supposedly fixed in 2020, allows a local attacker to escalate privileges to SYSTEM, gaining complete control over the machine. The vulnerability exists in the Windows Cloud Files Mini Filter Driver (`cldflt.sys`) and highlights potential gaps in Microsoft's patching process, as the original exploit for CVE-2020-17103 now works again on fully updated systems.

zero-dayprivilege escalationWindows 11cldflt.syspatch regression +1 more

6 min read

New 'MiniPlasma' Windows Zero-Day Resurrects Patched Flaw for Full System Control

Verus-Ethereum Bridge Loses $11.5M in Logical Exploit; Attacker Forges Value-less Transaction

Logical Flaw in Verus-Ethereum Bridge Smart Contract Leads to $11.5 Million Theft

The Verus-Ethereum cross-chain bridge has been exploited for approximately $11.58 million in digital assets. The attacker leveraged a critical logical flaw in the bridge's smart contract, not a cryptographic weakness. By submitting a validly signed proof for a transaction that had no economic value on the source chain, the attacker tricked the Ethereum-based contract into releasing millions from its reserves. The incident highlights the persistent risk of logic bombs in DeFi protocols, where cryptographic security alone is insufficient.

DeFiblockchainsmart contractexploitcryptocurrency +1 more

Verus-Ethereum Bridge Loses $11.5M in Logical Exploit; Attacker Forges Value-less Transaction

Critical 18-Year-Old 'NGINX Rift' Vulnerability (CVE-2026-42945) Under Active Attack

Active Exploitation of Critical 'NGINX Rift' Vulnerability (CVE-2026-42945) Threatens Web Servers with RCE

A critical vulnerability in the NGINX web server, dubbed 'NGINX Rift' and tracked as CVE-2026-42945, is being actively exploited in the wild. The flaw, a heap buffer overflow that has existed in the codebase for 18 years, can be triggered by a remote attacker to cause a denial-of-service (DoS) and potentially achieve remote code execution (RCE). Given NGINX's widespread use, millions of internet-facing applications are at risk, and administrators are urged to patch immediately.

NGINXCVE-2026-42945RCEDoSweb server +1 more

Critical 18-Year-Old 'NGINX Rift' Vulnerability (CVE-2026-42945) Under Active Attack

State-Sponsored Ransomware Blurs Lines, Increasingly Deployed as Proxy Weapon Against Critical Infrastructure

Iran-Aligned Threat Actors Weaponize Ransomware to Target OT and Critical Infrastructure

The line between nation-state espionage and financially motivated cybercrime is dissolving as state-sponsored actors, particularly from Iran, increasingly use ransomware as a proxy weapon. Security analysts report that groups like MuddyWater and APT33 are leveraging criminal ransomware gangs to attack critical infrastructure and operational technology (OT) sectors. This hybrid approach allows nations to cause physical disruption and exert geopolitical pressure while maintaining plausible deniability, shifting ransomware from a tool of extortion to one of strategic sabotage.

RansomwareAPTIranOT SecurityICS +1 more

State-Sponsored Ransomware Blurs Lines, Increasingly Deployed as Proxy Weapon Against Critical Infrastructure

Pwn2Own Berlin 2026 Concludes with $1.3M Awarded for 47 Zero-Days in Enterprise Software

INFORMATIONAL

DEVCORE Crowned 'Master of Pwn' at Pwn2Own Berlin 2026; Researchers Disclose 47 Zero-Days

The Pwn2Own Berlin 2026 ethical hacking competition has concluded, with researchers earning nearly $1.3 million for disclosing 47 unique zero-day vulnerabilities in a range of major enterprise software products. The Taiwanese team DEVCORE won the coveted 'Master of Pwn' title, demonstrating high-impact exploits against Microsoft Exchange and SharePoint. The event highlighted critical security weaknesses in widely used technologies, including virtualization platforms, browsers, and AI systems, reinforcing the value of coordinated vulnerability disclosure.

Pwn2Ownzero-dayvulnerabilityhacking contestDEVCORE +1 more

4 min read

Pwn2Own Berlin 2026 Concludes with $1.3M Awarded for 47 Zero-Days in Enterprise Software

Updated Articles (7)

Instructure Pays Off ShinyHunters to Delete Data of 275M Canvas Users

Instructure Reaches Deal with ShinyHunters After Massive Canvas Breach Affects 9,000 Schools

Instructure has officially confirmed paying an undisclosed ransom to the ShinyHunters hacking group following the massive Canvas data breach. This decision, made to secure the return and destruction of 3.65 TB of stolen data affecting 275 million users, has drawn significant criticism for setting a dangerous precedent. The U.S. House Homeland Security Committee has launched an investigation into Instructure's actions, raising concerns about validating cybercriminal business models and the unverifiable nature of data destruction claims. This development escalates the incident's impact, adding regulatory scrutiny and long-term implications for the ed-tech sector.

May 13, 2026

ed-techLMSstudent dataransom negotiationcyber extortion

Instructure Pays Off ShinyHunters to Delete Data of 275M Canvas Users

Researcher Drops Two Windows Zero-Days, 'YellowKey' and 'GreenPlasma,' Exposing BitLocker and Escalating Privileges

Researcher Drops Two Unpatched Windows Zero-Day Exploits, "YellowKey" & "GreenPlasma"

Further analysis of the YellowKey BitLocker bypass reveals that Windows 10 is not affected, clarifying the scope of the vulnerability. The attack specifically involves holding the CTRL key during the Windows Recovery Environment (WinRE) boot process to trigger the flaw, as reproduced by researcher Will Dormann. There is also speculation regarding the possibility of an intentional backdoor. Additional mitigation strategies now include setting strong BIOS/UEFI passwords and considering file-level encryption for sensitive data, beyond just BitLocker with a PIN.

May 15, 2026

Zero-DayWindowsBitLockerPrivilege EscalationYellowKey +3 more

Researcher Drops Two Windows Zero-Days, 'YellowKey' and 'GreenPlasma,' Exposing BitLocker and Escalating Privileges

Microsoft Exchange Zero-Day CVE-2026-42897 Under Active Exploitation, Mitigation Urged

Active Exploitation of Exchange Server Zero-Day CVE-2026-42897 Prompts Urgent Mitigation Guidance from Microsoft

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the actively exploited Microsoft Exchange zero-day, CVE-2026-42897, to its Known Exploited Vulnerabilities (KEV) catalog. This inclusion mandates federal agencies to apply mitigations by May 29, 2026, underscoring the critical nature of the flaw. The vulnerability, rated CVSS 8.1, is an XSS issue allowing attackers to execute arbitrary JavaScript by sending a specially crafted email that, when opened in Outlook Web Access (OWA), can lead to credential theft. New detection methods include deploying Web Application Firewalls (WAFs) and enhanced IIS log analysis for XSS payloads. Organizations are urged to apply Microsoft's provided mitigations immediately.

Zero-DayMicrosoft ExchangeCVE-2026-42897XSSSpoofing +2 more

Microsoft Exchange Zero-Day CVE-2026-42897 Under Active Exploitation, Mitigation Urged

Russian APT Turla Evolves Kazuar Backdoor into Stealthy P2P Botnet

Turla APT Re-engineers Kazuar Backdoor into Modular Peer-to-Peer Botnet for Enhanced Stealth and Persistence

The updated analysis of Turla's Kazuar P2P botnet reveals a sophisticated leader election process where only one node communicates externally, significantly boosting stealth. The malware's modular framework now includes Kernel, Bridge, and Worker components, allowing for flexible task execution. Additionally, new defense evasion capabilities, such as AMSI and ETW bypasses, and over 150 configuration options, highlight the botnet's advanced design for long-term, stealthy espionage, with a continued focus on targets like Ukraine.

TurlaKazuarAPTRussiaP2P Botnet +3 more

Russian APT Turla Evolves Kazuar Backdoor into Stealthy P2P Botnet

NIST Finalizes SP 800-172r3, Toughening Security Rules for Controlled Unclassified Information (CUI)

INFORMATIONAL

NIST Releases Final Version of SP 800-172r3, Adding 80 New Controls for Protecting High-Value CUI

The updated guidance for NIST SP 800-172 Revision 3 now explicitly includes its assessment companion, SP 800-172A Revision 3. The primary focus is on bolstering defenses against Advanced Persistent Threats (APTs) by promoting cyber resiliency and defense-in-depth strategies, including zero-trust architectures and micro-segmentation. The controls are now available in machine-readable formats like JSON and YAML, facilitating automation. The scope of affected organizations is clarified to include aerospace and critical infrastructure sectors, beyond just DIB and research institutions.

NISTCUISP 800-172r3ComplianceRegulatory +2 more

4 min read

NIST Finalizes SP 800-172r3, Toughening Security Rules for Controlled Unclassified Information (CUI)

Japan Forms Public-Private Task Force to Counter AI-Driven Cyber Threats like 'Mythos'

MEDIUM

In 'Race Against Time,' Japan Launches Public-Private Group to Defend Against AI Threats, Citing Anthropic's 'Mythos' Model

Anthropic is set to brief the Financial Stability Board (FSB), a global financial regulator, on its 'Mythos' AI model. This follows a request from the Bank of England's governor, reflecting growing international concern over Mythos's ability to autonomously discover novel software vulnerabilities. Regulators are grappling with the 'dual-use' nature of such AI, which could pose a systemic risk to the global financial system if weaponized. A select group of companies, including JPMorgan Chase and Microsoft, currently have limited access to Mythos for defensive purposes, raising questions about equitable access to security intelligence and future regulatory frameworks.

Artificial IntelligenceAICybersecurityJapanAnthropic +3 more

4 min read

Japan Forms Public-Private Task Force to Counter AI-Driven Cyber Threats like 'Mythos'

OpenAI Hit by "Shai-Hulud" Supply Chain Attack on TanStack NPM Library

Widespread "Shai-Hulud" Supply Chain Attack on TanStack Compromises OpenAI

Security researchers at Wiz have provided further details on the TeamPCP supply chain attack. The report confirms the worm-like propagation mechanism, where attackers stole developer credentials and API tokens to publish malicious versions of popular open-source packages, including Tanstack. This led to the compromise of two OpenAI employee devices. The incident highlights the critical risk of developer account takeovers and the cascading impact on the software supply chain, reinforcing the need for robust MFA and dependency vetting.

May 17, 2026