← Cybersecurity Headlines
Cybersecurity Headlines
Grafan GitHub extortion, Microsoft rejects Azure report, Funnel Builder flaw
00:07:51
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Monday, May 18, 2026. I'm Steve Prentiss. Grafana GitHub token breach leads to extortion attempt Grafana Labs has disclosed that an attacker gained unauthorized access to part of the company's GitHub environment after obtaining a compromised GitHub token. According to the company, the intruder downloaded portions of Grafana's source code and later attempted to extort the company. Grafana emphasized that the breach did not impact customers systems, hosted services, or personal data, and that the stolen code did not contain production secrets. The company quickly revoked the exposed token, rotated credentials, and launched an internal investigation. The incident highlights the ongoing risk posed by leaked developer credentials and the growing focus cybercriminals are placing on software supply chain environments and source code repositories. Microsoft rejects Azure vulnerability report and researcher disputes the decision A security researcher is accusing Microsoft of quietly fixing a serious Azure Backup for Kubernetes vulnerability after initially rejecting the report and declining to issue a CVE identifier. The researcher claimed the flaw could have allowed users with low level backup permissions to gain broader access within Azure Kubernetes service environments. Microsoft reportedly maintained that the behavior was expected and not a security vulnerability, despite evidence that changes were later made to the platform. The situation has sparked criticism from parts of the security community who argue that inconsistent disclosure and classification practices can make it harder for organizations to properly assess risk and prioritize defensive measures in cloud environments. Funnel Builder flaw actively exploited to steal payment data Researchers are warning that a critical Vulnerability in the WordPress Funnel Builder plugin is being actively exploited to inject malicious payment skimming code into WooCommerce checkout pages. The flaw affects more than 40,000 websites using the plugin and allows attackers to insert fake Google Tag manager scripts that steal customer credit card information during checkout. Security experts say attackers are moving quickly to exploit unpatched systems, making immediate updates essential. Developers have released version 3.15.0.3 to address the issue, and administrators are being urged to inspect checkout pages for unauthorized scripts. CISA orders federal agencies to patch Cisco SD WAN bug immediately CISA has ordered all US Federal civilian agencies to immediately patch the critical Cisco Catalyst SD1 vulnerability that is already being actively exploited. The flaw allows unauthenticated remote attackers to gain elevated access to affected systems and has been added to the kev. Cisco has released patches and has warned that the vulnerability represents a serious risk to organizations relying on SD WAN infrastructure Federal agencies were given a tight remediation deadline under an emergency directive, reflecting concern that attackers could use the flaw to gain persistent access into government networks. Huge thanks to our sponsor ThreatLocker. ThreatLocker is extending zero trust beyond endpoint control with their recent release of zero trust network access and Zero Trust Cloud access. Access isn't based on credentials alone. It requires the right user, the right device and the right conditions because, as we've seen in recent large scale CRM breaches, stolen credentials and misconfigurations can expose massive amounts of data. With ThreatLocker, nothing is exposed and access is limited to exactly what's needed. Learn more and start your free trial today@threatlocker.com CISO Microsoft warns of Exchange server zero day under active attack Microsoft is warning organizations to immediately apply mitigations for a newly disclosed Exchange Server Zero day that is already being exploited in the wild. The CVE numbered flaw affects Exchange Server Subscription Edition along with exchange 2016 and 2019. Researchers say the spoofing and cross site scripting issue could allow attackers to compromise enterprise email environments. The vulnerability surfaced only days after Microsoft's May patch Tuesday updates, which notably contained no reported zero days at release time. PWN to own Berlin hackers exploit Windows 11 and Edge at the opening day of the PWN to Own Berlin 2026 competition, security researchers earned more than $523,000 after successfully demonstrating 24 unique zero day exploits against widely used technologies including Windows 11 and Microsoft Edge. The event showcased how rapidly attackers and researchers alike are discovering vulnerabilities in modern operating systems and browsers. Several exploits targeted privilege escalation and sandbox escapes, while others demonstrated remote code execution. Researchers discover 18 year old NGINX vulnerability the researchers made the discovery in the popular open source web server nginx that can lead to denial of service attacks and under certain conditions, possible remote code execution. The flaw was reportedly identified using an autonomous AI driven scanning system capable of analyzing legacy code for hidden weaknesses. Researchers say the discovery demonstrates how older, widely trusted infrastructure software may still contain exploitable bugs that had escaped earlier scrutiny. Nginx remains one of the world's most commonly deployed web servers, meaning any serious vulnerability has potentially massive downstream impact across cloud services, websites and enterprise applications. CISA urges critical infrastructure to prepare for long term isolation the agency is advising infrastructure operators to prepare for the possibility of operating independently from IT systems and third party vendors for weeks or even months during a major cyber conflict. The guidance is driven largely by concern over persistent threats from Chinese state linked groups such as Salt Typhoon and Vault Typhoon. CISA plans to conduct targeted resilience assessments focused on ensuring utilities and infrastructure operators can continue delivering essential services even if disconnected from external networks. The agency says organizations should strengthen operational technology resilience and rehearse manual recovery procedures, reflecting growing fears that future cyber conflicts may deliberately target interconnected infrastructure dependencies. If you have some thoughts on the news from today or about this show in general, please be sure to reach out to us@feedbackisoseries.com we would love to hear from you. I'm Steve Prentiss reporting for the CISO series.
- [07:36]
A
Cybersecurity headlines are available every weekday. Head to CISoseries.com for the full stories behind the headlines.