> Security Affairs newsletter Round 577 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Attackers exploit Funnel Builder bug to inject e-skimmers into e-storesPwn2Own Berlin 2026, Day Three: DEVCORE Crowned Master of Pwn, $1.298 Million TotalU.S. CISA adds a flaw in Microsoft Exchange Server to its Known Exploited Vulnerabilities catalogRussian APT Turla builds long-term access tool with Kazuar Botnet evolutionOpenAI hit by supply chain attack linked to malicious TanStack packagesPwn2Own Berlin 2026, Day Two: $385,750 more, Microsoft Exchange falls, and the running total crosses $900KCVE-2026-42897: Microsoft confirms active exploitation of Exchange Server zero-dayGhostwriter group resumes attacks on Ukrainian Government targetsResearchers uncover YellowKey and GreenPlasma Windows Zero-DaysPwn2Own Berlin 2026, Day One: $523,000 paid out, AI products fallU.S. CISA adds a flaw in Cisco Catalyst SD-WAN  to its Known Exploited Vulnerabilities catalogLinux Kernel bug Fragnesia allows local root access attacksBroadcom releases VMware Fusion security update for root access bugNGINX Rift: an 18-year-old flaw in the world’s most deployed web server just came to lightFamousSparrow targets Azerbaijani energy sector in multi-wave espionage campaignNitrogen Ransomware claims massive data theft from FoxconnMicrosoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarmingOpenLoop Health confirms January 2026 Data breach affecting 716,000Quest KACE SMA flaw CVE-2025-32975: when one unpatched tool opens the door to 60 organizationsInstructure settles with hackers following massive student data theftCritical Fortinet vulnerabilities fixed in FortiSandbox and FortiAuthenticatorHackers accessed BWH Hotels reservation system for monthsThe world’s most “Dangerous” AI, Anthropic’s Mythos, found only one flaw in curlAttackers exploit cPanel CVE-2026-41940 to deploy Filemanager BackdoorWannaCry, the ransomware attack that changed the history of cybersecurityAndroid banking Trojan TrickMo evolves using TON network for C2Identity security firm SailPoint discloses GitHub repository breachGoogle warns artificial intelligence is accelerating cyberattacks and zero-day exploitsCrimenetwork returns after takedown, dismantled again by German authoritiesU.S. CISA adds a flaw in BerriAI LiteLLM to its Known Exploited Vulnerabilities catalogInstagram removed end-to-end encryption for DMs. What should users do?New cPanel vulnerabilities could allow file access and remote code executionOfficial JDownloader site served malware to Windows and Linux users between May 6 and May 7 International Press – Newsletter Cybercrime Healthcare Data Breach: Cybercriminals Attacked Health Insurance Agency in Ecuador German operator of “Crimenetwork” arrested in Spain New version of the criminal trading platform “Crimenetwork” shut down – law enforcement authorities secure      Foxconn confirms cyberattack impacting North American factories  Cops arrest man suspected of being Dream Market kingpin  TeamPCP’s Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages  Our response to the TanStack npm supply chain attack   Malware JDownloader site hacked to replace installers with Python RAT malware     New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps   Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment   This is what some the world’s largest banks of malware look like stacked as hard drives  Popular node-ipc npm Package Infected with Credential Stealer   Hacking AI Vulnerability Research and the Fuzzer Era Déjà Vu: Why the Numbers Are Only Half the Story   Behind the Scenes Hardening Firefox with Claude Mythos Preview   Mythos finds a curl vulnerability NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability   Microsoft Vibing — capturing screenshots and voice samples without governance       TrustFall: coding agent security flaw enables one-click RCE in Claude, Cursor, Gemini CLI and GitHub Copilot Pwn2Own 2026 Capacity Overflow, Hackers Drop 0-Days Solo       Mythos finds a curl vulnerability   CVE-2025-32975: The Open Directory Behind the KACE SMA Breach and 60+ Downstream Victims GhostLock — Lockout Without Encryption Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP   CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED) BitUnlocker Downgrade Attack Two more public disclosures, it will never stop Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild Pwn2Own Berlin 2026: Day Three Results and Master of Pwn               Intelligence and Information Warfare ‘Disposable spies’: Poland records unprecedented number of Russian espionage cases Revealed: Israeli Tech Exposes Users of Musk’s Starlink Satellite-based Internet       FamousSparrow APT Targets Azerbaijani Oil and Gas Industry     FrostyNeighbor: Fresh mischief and digital shenanigans Gamaredon’s infection chain: Spoofed emails, GammaDrop and GammaLoad  What BO Team is hiding: the ZeronetKit backdoor from the inside and connections to Head Mare Kazuar: Anatomy of a nation-state botnet Cybersecurity Meta can read your Instagram DMs starting Friday. One step could protect you   GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access   NHS to grant Palantir contractors ‘unlimited access’ to patient data The May 2026 Security Update Review  US govt seeks Instructure testimony on massive Canvas cyberattack Welcome to the vulnpocalypse, as vendors use AI to find bugs and patches multiply like rabbits Is the SOC Obsolete, and We Just Haven’t Admitted It Yet? MPs want social media treated more like unsafe toys than harmless apps   Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)