- ## Öfugt samantekt Þjóðarhátturinn er áhrifamegið **aðgangsávöxtur á aðfangakeðju** sem áhrifir útviklara efnis og **vænilegar veikleikar í fyrirtækjastofnun** sem eru í virkri nýtingu. Npm vírus, GitHub CI/CD aðgangsávöxtur og Laravel-Lang aðgangsávöxtur sýna samþykkt aðgangsávöxt á útviklunarslóðum. Samtímabundin, vænilegar vandamál í **Cisco Secure Workload**, **Cisco SD-WAN**, **Drupal** og **Microsoft SharePoint** eru í virkri nýtingu, sem krefst áætlaðra uppfærslur. Þjóðarháttur á aðgangsávöxtum í 'First VPN' þjónustunni og Kimwolf botnet stjóra er mikil, en aðvöxtur á þessum takedowns á þjóðarháttarháttinum er enn að vera sýnd. ## ⚠️ Þörf fyrir augnablikar aðgerð
- *Cisco Secure Workload Site Admin Bypass** Vænileg auðkenningarframhjáhlaup (CVE-2026-20223) í Cisco Secure Workload leyfir óauðkenndum hætta að fá Site Admin réttindi með sérstökum API beðnum, sem leyfir fulla aðgang að gagnagrunni og breytingum á stillingum.
- *CVE:** CVE-2026-20223 (CVSS: 10.0)
- *Staða:** Í virkri nýtingu
- *Veikar útgáfur:** Útgáfur 3.10 upp í 4.0
- *Lagfært í:** Uppfærslur útgáfur útgefnar; skoðið Cisco tilkynningu
- *Tímabundin lausn:** Ekkert nefnt í heimildum
- *Heimild:** [SC Media](https://www.scworld.com/news/cisco-patches-critical-100-flaw-in-secure-workload-apis)
- *Cisco Catalyst SD-WAN Manager Auðkenningarframhjáhlaup** Fjölmörg vænilegar veikleikar í Cisco Catalyst SD-WAN Manager, þar á meðal CVE-2026-20127, eru í virkri nýtingu, sem leyfir óauðkenndum hætta að fá stjórnar réttindi.
- *CVE:** CVE-2026-20127 (CVSS: 10.0)
- *Staða:** Í virkri nýtingu
- *Veikar útgáfur:** Fjölmörg útgáfur; skoðið Cisco tilkynningu
- *Lagfært í:** Uppfærslur tiltæk; uppfærðu á meðferð
- *Tímabundin lausn:** Ekkert nefnt í heimildum
- *Heimild:** [Rapid7 Research](https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-05-22-2026)
- *Drupal Core SQL-innsetning (CVE-2026-9082)** Vænileg SQL-innsetning veikleikur í Drupal Core's gagnagrunnsafhendingar API fyrir PostgreSQL leyfir óauðkenndum hætta að keyra hvaða SQL sem er. Þetta CVE hefur verið bætt við CISA's KEV katalogi.
- *CVE:** CVE-2026-9082 (CVSS: 6.5)
- *Staða:** Í virkri nýtingu
- *Veikar útgáfur:** Drupal 10.x og 11.x áður en uppfærslur voru útgáfur
- *Lagfært í:** Uppfærslur tiltæk fyrir áhrifðar útgáfur
- *Tímabundin lausn:** Ekkert nefnt í heimildum
- *Heimild:** [The Hacker News](https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html)
- *Microsoft SharePoint Fjarkeyrsla kóða** Fjölmörg SharePoint veikleikar, þar á meðal CVE-2026-20963, eru í virkri nýtingu, sem leyfir fjarkeyrslu kóða.
- *CVE:** CVE-2026-20963 (CVSS: 8.8)
- *Staða:** Í virkri nýtingu
- *Veikar útgáfur:** SharePoint Server 2016, 2019 og Subscription Edition áður en áætlaðar uppfærslur
- *Lagfært í:** Uppfærslur útgefnar af Microsoft
- *Tímabundin lausn:** Ekkert nefnt í heimildum
- *Heimild:** [Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40357)
- *Linux kérna 'Dirty Frag' réttindaaukning** Vænileg Linux kérna réttindaaukning veikleikur leyfir óþýðandi notendur að fá rót aðgang með sérstökum sýnilegum skrúnum. Nýting er í virkri, og uppfærslur eru ekki tiltæk fyrir allar áhrifðar kérna útgáfur.
- *CVE:** CVE-2026-43284 (CVSS: Ekki tilgreint)
- *Staða:** Í virkri nýtingu
- *Veikar útgáfur:** Kérna útgáfur 4.11 til 6.7
- *Lagfært í:** Ekki tilgreint í heimildum — skoðið útgefanda tilkynningu
- *Tímabundin lausn:** Ekkert nefnt í heimildum
- *Heimild:** [SC Media](https://www.scworld.com/news/new-linux-privilege-escalation-flaw-fragnesia-disclosed-poc-available) ## 🔍 Þjóðarháttar aðgerð
- *Aðfangakeðju vírus hækkar npm efnis:** Þetta sjálfgerða vírus hækkar npm efnis (t.d. `@automagik/genie`, `pgserve`), sækir útviklara auðkenni og API lykla, og endurútgefir hækkrað efnis til að breytast meira. Þetta sýnir alvarlega, sjálfgerða hættu á útviklunarslóðum.
- *GitHub CI/CD aðgangsávöxtur ('Megalodon'):** Stórt aðgangsávöxtur hækkar aðgangsávöxtur í yfir 5.500 GitHub kerfum, sækir skyggingu auðkenni og SSH lykla frá útgáfum 2.18.6 til 2.18.12.
- *Laravel-Lang PHP efnis hækkar:** Hækkar á vinsælum Laravel-Lang PHP efnis með endurrituðum git merkingum, innsetningu kóða sem sækir auðkenni á hverju PHP beði með Composer.
- *Stjórnarstjórnður telkunartækja áhrif:** APT grúpa Calypso/Red Lamassu, með tengslum við Kína, áhrifir heimsvísir tæknisjóða með nýjum Linux (`Showboat/kworker`) og Windows (`JFMBackdoor`) hugbúnaði til að sækja gögn og halda sig á netinu.
- *Webworm APT notar skjóttu C2:** Webworm APT grúpa notar nú nýja bært ( `EchoCreep`, `GraphWorm`) sem notar Discord og Microsoft Graph API fyrir stjórn- og boðmiðlun, sem merkir breytingu á meðal skjóttu tengimyndum. ## 📋 Uppfærslur og uppfærslur
- *Microsoft Defender núll-daga veikleikar uppfærð:** Microsoft hefur útgefið uppfærslur fyrir tvo vinnuþýða núll-daga veikleikar (CVE-2026-41091, CVE-2026-45498) í Microsoft Defender sem leyfir réttindaaukning og þjónustuneitun. Uppfærðu Malware Protection Engine á meðferð.
- *Exim tölvuþjónn vinnuþýða vandamál:** Vinnuþýða vandamál í Exim tölvuþjónn (útgáfur 4.97 til 4.99.2) sem leyfir fjarkeyrslu kóða voru uppfærðar í Exim 4.99.3 og nýrra.
- *Google Chrome núll-daga uppfærð:** Google hefur útgefið Chrome útgáfu 145 til að uppfæra vinnuþýða núll-daga (CVE-2026-2441) sem leyfir fjarkeyrslu kóða. Tryggðu að sjálfgefin uppfærslur séu virk.
- *Fjölmörg Rsync vandamál:** Hávænileg vandamál í Rsync (<3.4.3) sem leyfir réttindaaukning og upplýsingar útgefningu voru uppfærðar af stórum Linux útgefendur (Red Hat, Debian, Ubuntu). Uppfærðu Rsync efnis.
- *Windows BitLocker framhjáhlaup ('YellowKey'):** Microsoft hefur útgefið vörnargátt, en ekki uppfærslu, fyrir CVE-2026-45585, sem leyfir fysiskum hættum að framhjá BitLocker kóðun á Windows 11 24H2/25H2/26H1 og Server 2025 með Windows Recovery Environment. ## Daglegar árangur 1. **Uppfærðu vinnuþýða stofnun:** Uppfærðu á meðferð fyrir **Cisco Secure Workload**, **Cisco SD-WAN Manager**, **Drupal Core** og **Microsoft SharePoint**. Athugaðu að kerfi séu uppfærð með tilgreindu uppfærslu útgáfum. 2. **Athugaðu útviklunarslóðir:** Athugaðu innri og þriðja hluta kóða efnis fyrir hækkraða npm (`@automagik/genie`, `pgserve`), Laravel-Lang og GitHub CI/CD aðgangsávöxtur efnis. Skiptu út hvaða auðkenni sem eru sýnd. 3. **Uppfærðu endapunktsöryggi:** Tryggðu að **Microsoft Defender** Malware Protection Engine og **Google Chrome** séu uppfærðir í nýjasta uppfærslu útgáfum til að minnka á vinnuþýða núll-daga. 4. **Athugaðu Linux kerfisöryggi:** Athugaðu Linux kerfi fyrir kérna útgáfur sem eru veikar fyrir 'Dirty Frag' réttindaaukning (4.11-6.7) og skráðu uppfærslur sem eru tiltæk. Mælið með óþarfa réttindaaukning ávöxtum. ## 🔗 Heimildir - [The Hacker News: Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Token](https://thehackernews.com/2026/04/self-propagating-supply-chain-worm.html) - [The Hacker News: Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows](https://thehackernews.com/2026/05/megalodon-github-attack-targets-5561.html) - [SC Media: Cisco patches critical 10.0 flaw in Secure Workload APIs](https://www.scworld.com/news/cisco-patches-critical-100-flaw-in-secure-workload-apis) - [The Hacker News: Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV](https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html) - [Help Net Security: Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-20](https://www.helpnetsecurity.com/?p=371504)
## Executive Summary The threat landscape is dominated by **highly active supply chain attacks** targeting developer ecosystems and **critical vulnerabilities in enterprise infrastructure** under active exploitation. The npm worm, GitHub CI/CD compromise, and Laravel-Lang attack represent a coordinated assault on software development pipelines. Concurrently, critical flaws in **Cisco Secure Workload**, **Cisco SD-WAN**, **Drupal**, and **Microsoft SharePoint** are being actively exploited, demanding immediate patching. Law enforcement actions against the 'First VPN' service and the Kimwolf botnet operator are significant, but the operational impact of these takedowns on the threat landscape remains to be seen.
## ⚠️ Immediate Action Required * **Cisco Secure Workload Site Admin Bypass** A critical authentication bypass flaw (CVE-2026-20223) in Cisco Secure Workload allows unauthenticated attackers to gain Site Admin privileges via crafted API requests, enabling full tenant data access and configuration changes. * **CVE:** CVE-2026-20223 (CVSS: 10.0) * **Status:** Active exploitation detected * **Vulnerable:** Versions 3.10 up to 4.0 * **Fixed:** Patched versions released; check Cisco advisory * **Workaround:** None mentioned in source * **Reference:** [SC Media](https://www.scworld.com/news/cisco-patches-critical-100-flaw-in-secure-workload-apis)
* **Cisco Catalyst SD-WAN Manager Authentication Bypass** Multiple critical vulnerabilities in Cisco Catalyst SD-WAN Manager, including CVE-2026-20127, are under active exploitation, allowing unauthenticated attackers administrative access. * **CVE:** CVE-2026-20127 (CVSS: 10.0) * **Status:** Active exploitation detected * **Vulnerable:** Various versions; check Cisco advisory * **Fixed:** Patches available; update immediately * **Workaround:** None mentioned in source * **Reference:** [Rapid7 Research](https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-05-22-2026)
* **Drupal Core SQL Injection (CVE-2026-9082)** A critical SQL injection vulnerability in Drupal Core's database abstraction API for PostgreSQL allows unauthenticated attackers to execute arbitrary SQL. This CVE has been added to CISA's KEV catalog. * **CVE:** CVE-2026-9082 (CVSS: 6.5) * **Status:** Active exploitation detected * **Vulnerable:** Drupal 10.x and 11.x prior to patched releases * **Fixed:** Patches available for impacted versions * **Workaround:** None mentioned in source * **Reference:** [The Hacker News](https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html)
* **Microsoft SharePoint Remote Code Execution** Multiple SharePoint vulnerabilities, including CVE-2026-20963, are being actively exploited, allowing remote code execution. * **CVE:** CVE-2026-20963 (CVSS: 8.8) * **Status:** Active exploitation detected * **Vulnerable:** SharePoint Server 2016, 2019, and Subscription Edition prior to specific updates * **Fixed:** Updates released by Microsoft * **Workaround:** None mentioned in source * **Reference:** [Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40357)
* **Linux Kernel 'Dirty Frag' Local Privilege Escalation** A critical Linux kernel LPE vulnerability allows unprivileged users to gain root access by exploiting page-cache write flaws. Exploitation is active, and patches are not available for all affected kernel versions. * **CVE:** CVE-2026-43284 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** Kernel versions 4.11 to 6.7 * **Fixed:** Not specified in source — check vendor advisory * **Workaround:** None mentioned in source * **Reference:** [SC Media](https://www.scworld.com/news/new-linux-privilege-escalation-flaw-fragnesia-disclosed-poc-available)
## 🔍 Threat Activity * **Supply Chain Worm Infects npm Ecosystem:** A self-propagating worm is compromising npm packages (e.g., `@automagik/genie`, `pgserve`), stealing developer credentials and API keys, and republishing infected packages to propagate further. This represents a severe, automated threat to software development pipelines. * **GitHub CI/CD Attack ('Megalodon'):** A large-scale supply chain attack injected malicious CI/CD workflows into over 5,500 GitHub repositories, stealing cloud credentials and SSH keys from versions 2.18.6 through 2.18.12. * **Laravel-Lang PHP Packages Compromised:** Attackers compromised popular Laravel-Lang PHP packages via rewritten git tags, injecting code that steals credentials on every PHP request via Composer. * **State-Sponsored Telco Targeting:** The China-aligned APT group Calypso/Red Lamassu is targeting global telecom providers with new Linux (`Showboat/kworker`) and Windows (`JFMBackdoor`) malware for data exfiltration and network persistence. * **Webworm APT Adopts Stealthy C2:** The Webworm APT group is now using new backdoors (`EchoCreep`, `GraphWorm`) that leverage Discord and the Microsoft Graph API for command and control, marking a shift towards more covert proxy tools.
## 📋 Patches & Updates * **Microsoft Defender Zero-Days Patched:** Microsoft has released patches for two actively exploited zero-day vulnerabilities (CVE-2026-41091, CVE-2026-45498) in Microsoft Defender allowing local privilege escalation and denial of service. Update the Malware Protection Engine immediately. * **Exim Mail Server Critical Flaws:** Critical vulnerabilities in Exim mail servers (versions 4.97 through 4.99.2) allowing remote code execution have been patched in Exim 4.99.3 and later. * **Google Chrome Zero-Day Patched:** Google has released Chrome version 145 to patch an actively exploited zero-day (CVE-2026-2441) allowing remote code execution. Ensure automatic updates are applied. * **Multiple Rsync Vulnerabilities:** High-severity flaws in Rsync (<3.4.3) allowing privilege escalation and information disclosure have been patched by major Linux distributions (Red Hat, Debian, Ubuntu). Update rsync packages. * **Windows BitLocker Bypass ('YellowKey'):** Microsoft has released mitigation guidance, but not a patch, for CVE-2026-45585, which allows physical attackers to bypass BitLocker encryption on Windows 11 24H2/25H2/26H1 and Server 2025 via the Windows Recovery Environment.
## Today's Priorities 1. **Patch Critical Infrastructure:** Immediately apply patches for **Cisco Secure Workload**, **Cisco SD-WAN Manager**, **Drupal Core**, and **Microsoft SharePoint**. Verify systems are updated to the specified fixed versions. 2. **Audit Development Pipelines:** Review internal and third-party code dependencies for the compromised npm (`@automagik/genie`, `pgserve`), Laravel-Lang, and GitHub CI/CD workflow packages. Rotate any exposed credentials. 3. **Update Endpoint Security:** Ensure **Microsoft Defender** Malware Protection Engine and **Google Chrome** are updated to their latest patched versions to mitigate exploited zero-days. 4. **Review Linux Server Security:** Assess Linux servers for kernel versions vulnerable to the 'Dirty Frag' LPE (4.11-6.7) and apply vendor patches where available. Monitor for anomalous privilege escalation attempts.
## 🔗 References
- [The Hacker News: Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Token](https://thehackernews.com/2026/04/self-propagating-supply-chain-worm.html)
- [The Hacker News: Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows](https://thehackernews.com/2026/05/megalodon-github-attack-targets-5561.html)
- [SC Media: Cisco patches critical 10.0 flaw in Secure Workload APIs](https://www.scworld.com/news/cisco-patches-critical-100-flaw-in-secure-workload-apis)
- [The Hacker News: Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV](https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html)
- [Help Net Security: Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-20](https://www.helpnetsecurity.com/?p=371504)