Weekly Threat Briefing — 2026-05-25 to 2026-06-01
18 findings5 sections
- Critical findings
- 0
- High findings
- 0
- CISA KEV additions
- 0
- First seen in this period
- 1,096 CVEs5,760 IOCs
First seen in this period: CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.
Priority queue
Act on these first
Critical and high findings from this briefing and its live updates. Most severe first, then newest.
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: CVE
- Critical severityDeveloper Tool Supply Chain TargetingSection Tools & TechniquesSource: Manual
- High severitySection VulnerabilitiesSource: KEV
- High severitySection VulnerabilitiesSource: CVE
- High severitySection VulnerabilitiesSource: CVE
- High severitySection VulnerabilitiesSource: CVE
Executive summary · as of 07:01 UTC
The situation
This week's threat landscape is dominated by a surge in high-severity vulnerabilities affecting enterprise infrastructure and IoT devices, alongside sustained botnet malware distribution activity. Five critical CVEs were added to CISA's Known Exploited Vulnerabilities catalog, including authentication bypasses in Palo Alto Networks PAN-OS (CVE-2026-0257) and privilege escalation in LiteSpeed cPanel (CVE-2026-48172), alongside supply chain compromises affecting TanStack and Nx Console that distributed credential-stealing malware through trusted software repositories.
The NVD reported 30 new vulnerabilities, primarily targeting consumer networking equipment from vendors including Tenda, TRENDnet, and Edimax, with most rated HIGH or CRITICAL severity. Stack-based buffer overflow vulnerabilities dominate this dataset, presenting remote code execution opportunities for attackers targeting unpatched edge devices. These vulnerabilities are particularly concerning as many affect devices commonly deployed in small office/home office (SOHO) environments with limited security oversight.
Malware distribution activity remains heavily focused on Mozi and Mirai botnet variants, with abuse.ch reporting 50 malicious URLs actively distributing IoT-targeted payloads. The ClearFake malware campaign continues operating through compromised domains, while botnet operators maintain persistent infrastructure targeting ARM and MIPS architectures. The concentration of stack-based buffer overflow vulnerabilities combined with active botnet distribution suggests adversaries are positioning to exploit these newly disclosed weaknesses in IoT and edge networking devices.
Browse the full briefing
18 findings · 5 sections- 6 critical
- 11 high
- 1 medium
- Vulnerabilities5 findingsCritical Known Exploited Vulnerabilities4 critical · 1 high
- Vulnerabilities5 findingsIoT and Network Device Remote Code Execution Vulnerabilities1 critical · 4 high
- Vulnerabilities3 findingsSQL Injection and Authentication Bypass Vulnerabilities3 high
- Malware3 findingsMozi and Mirai Botnet Distribution Campaign2 high · 1 medium
- Tools & Techniques2 findingsSupply Chain Attack Techniques1 critical · 1 high
Critical Known Exploited Vulnerabilities
CISA added five critical vulnerabilities to the KEV catalog, including authentication bypasses, supply chain compromises, and privilege escalation flaws affecting enterprise infrastructure and development tools.
- Critical severityCVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass (opens the source in a new tab)
Authentication bypass vulnerability in PAN-OS allows attackers to establish unauthorized VPN connections, bypassing security restrictions on enterprise VPN infrastructure.
- Critical severityCVE-2026-48172: LiteSpeed cPanel Plugin Privilege Escalation (opens the source in a new tab)
Privilege escalation vulnerability in LiteSpeed cPanel Plugin allows any cPanel user account to execute arbitrary scripts with root privileges through the user-end plugin interface.
- Critical severityCVE-2026-48027: Nx Console Supply Chain Compromise (opens the source in a new tab)
Malicious version of Nx Console published to marketplace contained obfuscated payload that harvested credentials from disk and memory, representing a significant developer tool supply chain attack.
- Critical severityCVE-2026-45321: TanStack npm Registry Compromise (opens the source in a new tab)
Malicious versions of TanStack published to npm registry to distribute credential-stealing malware under a trusted identity, compromising the JavaScript ecosystem supply chain.
- High severityCVE-2026-8398: Daemon Tools Lite Embedded Malicious Code (opens the source in a new tab)
Daemon Tools contains embedded malicious code with high impact on confidentiality, integrity, and availability. Specific attack vectors remain under investigation.
IoT and Network Device Remote Code Execution Vulnerabilities
Thirty new vulnerabilities disclosed affecting consumer-grade networking equipment from Tenda, TRENDnet, Edimax, and others. Most vulnerabilities are stack-based buffer overflows enabling remote code execution.
- Critical severityCVE-2026-10187: Totolink N300RH Critical Stack Overflow (CVSS 9.8) (opens the source in a new tab)
Critical stack-based buffer overflow in setWiFiBasicConfig function of wireless.so component, exploitable remotely through web management interface without authentication.
- High severityMultiple Tenda W12 Stack Overflow Vulnerabilities (CVEs 2026-10188 through 10192) (opens the source in a new tab)
Five distinct stack-based buffer overflow vulnerabilities in Tenda W12 firmware affecting time configuration, MAC filtering, and station management functions. All rated CVSS 8.8 with public exploits available.
- High severityMultiple TRENDnet TEW-432BRP Remote Exploitation Flaws (opens the source in a new tab)
Series of stack-based buffer overflow vulnerabilities affecting password management, system logging, port forwarding, URL filtering, protocol filtering, and domain filtering functions. All exploitable remotely with public exploits available.
- High severityMultiple Edimax BR-6478AC Buffer Overflow Vulnerabilities (opens the source in a new tab)
Buffer overflow vulnerabilities in USB folder management, USB account handling, QoS configuration, and PPPoE setup functions. All exploitable remotely through POST request handlers.
- High severityCVE-2026-10124: Shibby Tomato ripd Remote Buffer Overflow (opens the source in a new tab)
Stack-based buffer overflow in rip_zebra_read_ipv4 function of ripd daemon, exploitable remotely through Zserv protocol handler.
SQL Injection and Authentication Bypass Vulnerabilities
Multiple SQL injection vulnerabilities discovered in web applications and a critical authentication bypass in Open5GS telecom infrastructure.
- High severityOpenCATS SQL Injection Vulnerabilities (CVE-2026-49490, CVE-2026-49489) (opens the source in a new tab)
SQL injection in DataGrid filter handling allows authenticated attackers to bypass column restrictions and extract database contents through crafted filters and sortDirection parameters. CVSS scores 8.1 and 8.5.
- High severityCVE-2026-10157: Open5GS NGAP Authentication Bypass (opens the source in a new tab)
Improper authentication in NGAP PathSwitchRequest message handler allows remote attackers to bypass authentication in 5G core network infrastructure.
- High severityMultiple Healthcare and School Management System SQL Injections (opens the source in a new tab)
SQL injection vulnerabilities in Online Hospital Management System, Hospitals Patient Records Management System, and School Student Management System affecting patient records, user management, and authentication functions.
Mozi and Mirai Botnet Distribution Campaign
Sustained malware distribution activity targeting IoT devices with Mozi and Mirai variants. 50 malicious URLs identified distributing botnet payloads for ARM and MIPS architectures.
- High severityMozi Botnet Infrastructure Targeting Asian ISP Networks (opens the source in a new tab)
Active Mozi botnet distribution from IP addresses primarily in Asian ISP ranges (110.x, 123.x, 222.x networks). Payloads compiled for ARM and MIPS architectures, targeting vulnerable routers and IoT devices with publicly disclosed buffer overflow exploits.
- High severityMirai Variant Distribution via 176.65.139.153 and 31.56.209.220 (opens the source in a new tab)
Multiple Mirai variant payloads (rebirth.arm7, rebirth.mpsl, etc.) distributed from European infrastructure targeting ARM5, ARM7, MIPS, and MIPSEL architectures. User-agent indicates wget-based automated exploitation.
- Medium severityClearFake Malware Campaign via Compromised Domains (opens the source in a new tab)
ClearFake malware distributed through compromised legitimate-appearing domains (yutongdrying.com, destek1.com, daqotransformers.com, etc.) using HTTPS to evade detection. Campaign targets users through social engineering.
Supply Chain Attack Techniques
Multiple supply chain compromises demonstrate adversary focus on trusted software distribution channels including npm registry and IDE marketplace.
- Critical severityDeveloper Tool Supply Chain Targeting
Attackers successfully compromised TanStack npm packages and Nx Console IDE extension to distribute credential-stealing malware. Obfuscated payloads harvested credentials from both disk and memory, targeting developer environments with elevated access to source code and infrastructure.
- High severityIoT Botnet Exploitation Pattern
Botnet operators continue exploiting stack-based buffer overflow vulnerabilities in consumer networking devices. Attack pattern includes automated scanning, wget-based payload delivery, and multi-architecture compilation (ARM, MIPS) to maximize infection rates across diverse IoT hardware.
Sources & Attribution
These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.
CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.