
Loading summary
A
From the CISO series, it's Cybersecurity Headlines
B
these are the cybersecurity headlines for Monday, May 25, 2026. I'm Steve Prentiss. CISA adds Drupal Core flaw to Kev the CVE numbered flaw in Microsoft Exchange Server has a CVSS score of 9.8. As we reported on May 20th, Drupal issued a critical security patch for the SQL Injection vulnerability that allows unauthenticated attackers to compromise sites running PostgreSQL databases. This is in response to exploitation attempts that had started almost immediately, with thousands of attacks in the wild being tracked. According to Imperva, attacks are primarily targeting gaming and financial services sites. The KEV addition means federal agencies must fix the vulnerability by May 27th. Underminer hides malicious connections behind trusted domains. This is a vulnerability that exists in the shared content delivery infrastructure, spelled underming. It is a variant of a technique called domain fronting. It a now mitigated type of attack that enabled threat actors to place a legitimate allowed domain in the SNI and TLS certificate validation fields of an HTTPs request while embedding a different target domain in the TTLs tunnel's encrypted HTTP host header. This means that an HTTP request reached the hidden destination while traffic would appear to be going to a reputable front domain. According to Zero Trust company Adam Networks Networks, Underminer has been attacks mostly via TCP connections on Port 443, in which SNI exposes the intended TLS host name. Canadian man charged with running Kim Wolf DDoS botnet following up on a story we covered in December and January, Jacob Butler was arrested in Ottawa on Wednesday after the U.S. justice Department filed an extradition warrant tied to his operation of the Kim Wolf botnet, one of the largest and most damaging distributed denial of service plat in the world. The 23 year old was initially identified by Brian Krebs back in February, but denied being the online Persona known as Dort D O R T that ran Kim Wolf Butler has been charged with one count of aiding and abetting computer intrusion. He is facing up to 10 years in prison if convicted. Hackers attack German hospitals through third party provider German university hospitals are dealing with a large scale patient data breach after unknown hackers reportedly targeted an external billing service provider used by medical centers across the country. This according to statements from several affected medical institutions. The third party vendor, Unimed Unimed handles billing services for privately insured and self paying patients on behalf of numerous German hospitals. These hospitals, based in at least six German cities, said the breach did not compromise their own clinical infrastructure or disrupt patient treatment, but did affect the data and records of many thousands of patients from each of the hospitals. Huge thanks to our sponsor, guardsquare. Mobile app security isn't just a tech issue, it's a revenue issue. A recent global study found that 72% of organizations experienced a mobile app security incident last year. Even worse, 65% saw customer churn or uninstalls as a result. Protect your brand and your bottom line with layered mobile app protection. You can learn more@guardsquare.com that is the two words guard square.com creative hijacking of Laravel Lang packages deploys credential stealing malware According to security firms Step Security, Aikido Security and Socket, a supply chain attack targeting the Laravel Lang localization packages has exposed developers to a sophisticated credential stealing malware campaign after attackers abused GitHub version tags to distribute malicious code through composer packages. These Laravel Lang packages are third party localization packages and are not part of the official Laravel project. What made the attack unique is that the actual project's source code was not modified to include malicious code, but instead the attackers abused a GitHub feature that allows tags to point to commits in forks of the same repository. Italy disrupts Cinemagoal piracy app Italian authorities have dismantled a piracy ecosystem that provided access to various streaming platforms including Netflix, Disney and Spotify. The app, named Cinemagoal, is one that customers install on their devices and allow its operators to make millions from audio, visual piracy, unauthorized computer access and computer fraud. The system used virtual machines in Italy to capture valid authentication and decryption codes from legitimate subscriptions every three minutes and then redistribute them to customers. FBI warns about fast growing AI phishing kit targeting Microsoft 365 users this warning focuses on Kali365, I.e. k A L I365, a growing phishing as a service platform that retrieves Microsoft 365 access tokens. In a public service announcement on Thursday, the FBI described this as a toolkit that bypasses multi factor authentication and abuses oauth device code authorizations via phishing lures, impersonating common enterprise services and granting cybercriminal controlled applications access to Microsoft 365 accounts. According to researchers at Proofpoint, Kali365 is one of many rapidly emerging AI generated AI driven device code phishing tools which are gaining popularity as a more effective means for cybercriminals to circumvent security controls while abusing legitimate Microsoft Device Authorization Pages End quote Claude Mythosai finds 10,000 high severity flaws in widely used software in what will likely be an ongoing developing story, Anthropic on Friday disclosed that Project Glasswing has helped uncover more than 10,000 high or critical severity vulnerabilities across some of the most systematically important software across the world. This since the cybersecurity initiative went live last month. Just one of the identified weaknesses is a critical flaw in Wolf SSL, which has a CVE number and a CVS's score of 9.1 that could allow an attacker to forge certificates and masquerade as a legitimate service. Anthropic echoed a now common sentiment stating that the relative ease of finding vulnerabilities compared with the difficult of fixing them amounts to a major challenge for cybersecurity. Join us this Friday for Hacking Pen Testing in the age of agentic AI on Super Cyber Friday. It starts at 1pm Eastern and you can join our chat, play some games and learn how pen testing is evolving and even win some CISO Series swag. So go to the events page@cisoseries.com to register. And if you have some thoughts on the news from today or about this show in general, please be sure to reach out to us@feedbacksoseries.com we would love to hear from you. I'm Steve Prentiss reporting for the CISO Series.
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines. It.
Host: Steve Prentiss
Main Theme:
A rapid-fire update on critical cybersecurity developments including the latest KEV vulnerability in Drupal, resurgence of domain fronting attacks (Underminer), a major botnet operator arrest in Canada, hospital data breaches in Germany, an inventive supply chain attack on Laravel’s ecosystem, Italian crackdown on piracy, a fast-growing AI-based Microsoft 365 phishing kit, and Anthropic's sweeping disclosure of high-severity software flaws.
[00:08 – 01:15]
"Exploitation attempts started almost immediately, with thousands of attacks in the wild…attacks are primarily targeting gaming and financial services sites."
– Steve Prentiss [00:22]
[01:16 – 02:33]
"Underminer is a variant of a technique called domain fronting...enabled threat actors to place a legitimate allowed domain in the SNI and TLS certificate validation fields...while embedding a different target domain in the TTL's tunnel's encrypted HTTP host header."
– Steve Prentiss [01:40]
[02:34 – 03:21]
"Jacob Butler was arrested...after the U.S. Justice Department filed an extradition warrant tied to his operation of the KimWolf botnet, one of the largest and most damaging distributed denial of service platforms in the world."
– Steve Prentiss [02:36]
[03:22 – 04:02]
"The breach did not compromise their own clinical infrastructure or disrupt patient treatment, but did affect the data and records of many thousands of patients…"
– Steve Prentiss [03:48]
[05:04 – 05:48]
"Attackers abused a GitHub feature that allows tags to point to commits in forks of the same repository."
– Steve Prentiss [05:33]
[05:49 – 06:31]
"The system used virtual machines in Italy to capture valid authentication and decryption codes...and then redistribute them to customers."
– Steve Prentiss [06:24]
[06:32 – 07:16]
"Kali365 is one of many rapidly emerging AI generated, AI driven device code phishing tools…a more effective means for cyber criminals to circumvent security controls."
– Steve Prentiss [07:05]
[07:17 – 08:00]
"The relative ease of finding vulnerabilities compared with the difficulty of fixing them amounts to a major challenge for cybersecurity."
– Steve Prentiss [07:54]
| Segment | Timestamp | |--------------------------------------------------------------|------------| | Drupal Core flaw & KEV update | 00:08-01:15| | Underminer/Domain fronting attack | 01:16-02:33| | KimWolf Botnet Operator Arrest | 02:34-03:21| | German Hospital Data Breach via Unimed | 03:22-04:02| | Supply Chain Attack: Laravel Lang packages | 05:04-05:48| | Italian Piracy: Cinemagoal app takedown | 05:49-06:31| | FBI Warns: Kali365 AI phishing kit | 06:32-07:16| | Anthropic: 10,000 high-severity software vulnerabilities | 07:17-08:00|
Steve Prentiss delivers today’s headlines with urgency and directness, noting:
Listeners are left with a vivid picture of an escalating, fast-moving threat landscape, demanding swift action and continued vigilance.