← SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS Stormcast Wednesday, May 13th, 2026: Microsoft Patch Tuesday; Large npm/pypi Compromise; Rubygems Attack
00:07:53
SANS Stormcast Wednesday, May 13th, 2026: Microsoft Patch Tuesday; Large npm/pypi Compromise; Rubygems Attack
Loading summary
Transcript1 lines
- [00:05]
A
Hello and welcome to the Wednesday, May 13, 2026 edition of the SANS Internet Storm Summers Stormcast. My name is Johannes Ulrich, recording today from San Diego, California and this episode is brought to you by the Sans Edu Graduate Certificate Program in Cybersecurity Leadership. Well, today Microsoft Patch Tuesday. So let's start with a quick summary here. We got a total of 137 vulnerabilities being addressed by Microsoft. Now this is quite a large number, but in addition to this we actually also got 127 chromium vulnerabilities being addressed in Microsoft Edge. Now, when it comes to the Microsoft vulnerability, so the 137, you had 30, 30 critical ones here, that's a fairly large number compared to what we saw in the past. But 14 of these 30, so pretty much half of them do not require any customer action because these vulnerabilities are vulnerabilities in Microsoft cloud systems and as such of course there's nothing you have to do. Microsoft already took care of these for you. Now, among the remaining critical vulnerabilities, there are a couple stuff that caught my eye. One actually that I haven't listed in the diary is one in Outlook. That's a remote code execution vulnerability that could be triggered by just previewing an email, so no attachment that you need to open. There is also a vulnerability in the Microsoft single sign on plugin for Jira and Confluence. Given all the news we had about supply chain issues and such, that's certainly something to watch out for. The other one that I thought was kind of interesting was remote code execution vulnerability in Netlogon. Now the Netlogon service has always been sort of a big target. Definitely something where as I post a diary, it's worth to spend some AI tokens for to come up with a good exploit, at least from an attacker's point of view. So definitely get them patched. On sort of the good news side here, none of the vulnerabilities that were patched this round already being exploited or disclosed. So essentially no zero days this month. Well usually on Patch Tuesday we heavily focus on patches from various vendors and well the urgencies here always patch, patch quickly. Today's podcast is a little bit different because well, supply chain attacks appear to be escalating. Socket.dev has a blog post with the latest series of what they call Minishai Hulut, sort of part of that team PC. So these attacks have extremely escalated over the last couple days across both npm and pypi. So both JavaScript and python are affected here. Initially there were 84 compromised packages of Tanstack. Tanstack has millions of downloads, so it's one of the very popular NPM packages. But sadly, well, it didn't stay with Tanstack. We then immediately got additional packages being affected here and I'm just scrolling through some of them misterally. And OpenSearch. OpenSearch is one of the real big ones here that got affected, particularly when it comes to NPM guardrails. AI another big packages. A lot of squawk packages got affected by this latest set of attacks. So we literally have dozens and dozens of packages being compromised and, and more being added all the time because, well, what the compromise does then is it does actually exfiltrate more credentials from more GitHub repositories, more GitHub accounts are being compromised and well, with that the attack is just spreading. Apparently the initial entry point here when it comes to tanstack was a GitHub action where a malicious actor submitted a pull request and then the GitHub action basically sort of ran through the usual checks of the pull request, which also included running the code. And in doing so some of the credentials here were compromised and that then led to the compromise of tanstaq. There are also some versions of these supply chain compromised in the last few days where the attacker exfiltrated or assigned themselves malicious tokens and with these credentials then will basically spread more malicious code. But they also then put a little time bomb into the developer systems that basically wipes the system if the developer does attempt to actually revoke those tokens. So be careful if you're affected by any of this. And I have seen some reputable sources recommend not to patch any in particular NPM packages for the next couple days. Maybe should be extended to pypi. Personally I'm always a little bit ambivalent about this, but you definitely have to be careful and well, basically read particularly socket.dev blog post which has a lot of hints on first of all how to secure yourself better and how to detect if you're affected by this most recent compromise. But sadly, well, it's not just NPM and Python that is affected by these types of attacks. There's also a separate wave of attacks apparently hitting Ruby. RubyGems announced that they are currently pausing signups for new accounts because they're flooded as posts on Xstate by hundreds of malicious packages. Some attacks against regens, but also some just containing outright malicious codes and exploits. So that's why they basically just paused submissions, paused new signups for now in order to deal with filtering and basically defending against these attacks they're currently seeing. So in short, well that's why you should be careful for at least the next couple days, but probably going forward with updating software components. And for now now, if there's no urgent vulnerability that you need to address, you should probably just stick with the version that you have right now. Again, this affects at least npm and pypi, but as we see with RubyGems, there are other languages also being affected by these types of attacks. And it's not just Team PCP and the Minishat Hulut kind of attacks, but there's a variety of different attacks going on. Those are just the big ones that sort of make the news. Well, this is it for today, so thanks for listening, thanks for liking, thanks for subscribing and thanks for any feedback about the content that I've sort of received over the time for this podcast. Always really helpful and very much appreciated. So thanks and talk to you again tomorrow. Bye.