DFIRLab
All Briefings
weeklyMay 18, 2026 — May 25, 2026Published 07:01 UTC

Weekly Threat Briefing — 2026-05-18 to 2026-05-25

33 findings11 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
377 CVEs5,123 IOCs

First seen in this period: CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 29
Browse all 33 findings

Executive summary · as of 07:01 UTC

The situation

This week's threat landscape reveals critical vulnerabilities requiring immediate attention, particularly affecting enterprise infrastructure and widely-deployed software. Multiple CRITICAL-severity vulnerabilities (CVSS 9.8-10.0) have been identified in UniFi OS devices, PyFory deserialization, and WordPress plugins, enabling remote code execution and unauthorized system access. CISA has added 10 vulnerabilities to the Known Exploited Vulnerabilities catalog, including critical flaws in Drupal Core, Trend Micro Apex One, and Microsoft Defender, with several legacy Microsoft products from 2008-2010 seeing renewed exploitation activity.

Browse the full briefing

33 findings · 11 sections
Findings by severity
  • 8 critical
  • 21 high
  • 3 medium
  • 1 info
Vulnerabilities7 critical · 1 high

Critical Infrastructure Vulnerabilities

Multiple CRITICAL-severity vulnerabilities discovered in UniFi OS, PyFory, and enterprise applications enabling remote code execution and complete system compromise

Vulnerabilities2 high

SQL Injection Vulnerability Cluster

Widespread SQL injection vulnerabilities identified across multiple platforms including Open ISES Tickets, WordPress plugins, and enterprise applications

Vulnerabilities1 critical · 3 high

Legacy Microsoft Product Exploits (CISA KEV)

CISA adds multiple 2008-2010 era Microsoft vulnerabilities to KEV catalog, indicating renewed exploitation of legacy systems

Vulnerabilities5 high

Privilege Escalation and Authorization Bypass

Multiple vulnerabilities enabling privilege escalation in security products, development tools, and WordPress plugins

Malware3 high

Mirai Botnet Infrastructure Campaign

Active Mirai botnet distribution infrastructure identified across multiple IP addresses in the 176.65.139.x range, targeting IoT devices with multi-architecture payloads

Malware1 medium

Mozi Botnet Activity

Continued Mozi botnet propagation targeting MIPS-based IoT devices across multiple geographic regions

Malware2 high · 1 medium

ClearFake Campaign and ConnectWise Weaponization

Browser-based ClearFake malware distribution and abuse of legitimate ConnectWise infrastructure for malware delivery

Tools & Techniques1 high · 1 medium

Command Injection and Remote Code Execution Techniques

Multiple attack vectors identified leveraging command injection, code execution, and exploitation of vulnerable media parsers

Vulnerabilities2 high

Configuration and Credential Management Vulnerabilities

Critical hardcoded credentials and weak cryptographic implementations discovered in multiple applications

Vulnerabilities2 high

WordPress Plugin Vulnerabilities

Multiple high-severity vulnerabilities affecting popular WordPress plugins requiring immediate updates

DFIR Lab1 info

IOC Enrichment and Analysis Resources

New research on indicator of compromise enrichment strategies for security operations teams

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.