DFIRLab
All Briefings
weeklyMay 5, 2026 — May 11, 2026Published 07:00 UTC

Weekly Threat Briefing — 2026-05-05 to 2026-05-11

34 findings8 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
665 CVEs8,210 IOCs

First seen in this period: CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 34
Browse all 34 findings

Executive summary · as of 07:00 UTC

The situation

During the period of May 5-11, 2026, the threat landscape was dominated by critical vulnerabilities affecting enterprise infrastructure and widespread malware distribution activity. Three high-severity vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog, including a critical out-of-bounds write vulnerability in Palo Alto Networks PAN-OS firewalls (CVE-2026-0300) and SQL injection in BerriAI LiteLLM (CVE-2026-42208), both enabling unauthorized access and potential remote code execution. The NVD disclosed 29 additional vulnerabilities, with five rated CRITICAL, primarily affecting CMS platforms, WordPress plugins, and authentication systems.

Browse the full briefing

34 findings · 8 sections
Findings by severity
  • 9 critical
  • 25 high
Vulnerabilities2 critical · 1 high

Critical CISA KEV Vulnerabilities Requiring Immediate Action

Three critical vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog this week require immediate patching due to active exploitation risks.

Vulnerabilities7 critical

Critical Unauthenticated RCE and Authentication Bypass Vulnerabilities

Five CRITICAL-severity vulnerabilities disclosed in NVD enable unauthenticated remote code execution and privilege escalation across multiple platforms.

Vulnerabilities7 high

High-Severity Authentication and Code Execution Vulnerabilities

Multiple HIGH-severity vulnerabilities affecting CMS platforms, enterprise applications, and infrastructure components enable authenticated remote code execution and privilege escalation.

Malware1 high

Active ua-wget Malware Distribution Infrastructure

Concentrated malware distribution campaign identified with 50 unique URLs on single IP address distributing ua-wget malware, indicating active botnet or IoT targeting infrastructure.

Vulnerabilities3 high

SQL Injection Vulnerabilities in Web Applications

Multiple SQL injection vulnerabilities identified in CMS platforms and web applications enabling database extraction and manipulation.

Vulnerabilities5 high

Additional Authenticated Remote Code Execution Vulnerabilities

Multiple CMS platforms contain authenticated remote code execution vulnerabilities requiring valid user credentials but enabling system-level compromise.

Vulnerabilities3 high

Supply Chain and Build Tool Vulnerabilities

Critical vulnerabilities in software supply chain tools and package managers pose risks to development and deployment pipelines.

Vulnerabilities5 high

Additional Notable Vulnerabilities

Other significant vulnerabilities affecting various systems including privilege escalation, denial of service, and authentication issues.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.