Breaking News – Cyber Threats – 2026-05-23 03:00 PDT

Breaking News – Cyber Threats (last 6h)

Generated: 2026-05-23 03:00 PDT

• LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root
  The Hacker News • 2026-05-23 00:35 • thehackernews.com
  A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild.

  The flaw, tracked as CVE-2026-48172 (CVSS score: 10.0), relates to an instance of incorrect privilege assignment that an attacker could abuse to run arbitrary scripts with elevated permissions.

  “Any cPanel user (including an attacker or a compromised account) may
  https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html

• Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
  The Hacker News • 2026-05-23 00:23 • thehackernews.com
  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw impacting Drupal Core to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.

  The vulnerability in question is CVE-2026-9082 (CVSS score: 6.5), an SQL injection vulnerability affecting all supported versions of Drupal Core.

  “Drupal Core
  https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html

• An Example of Stack String in High Level Language, (Sat, May 23rd)
  SANS ISC Diary (full) • 2026-05-22 22:49 • isc.sans.edu

  This week, I&#x27m attending the SEC670[1] training (“Red Teaming Tools – Developing Windows Implants, Shellcode, Command and Control”). From my point of view, this training fits perfectly with FOR610 or FOR710 (malware analysis) because it addresses malware from the opposite: Instead of performing reverse engineering, you write malicious code! Always interesting to have another point of view.

  
  https://isc.sans.edu/diary/rss/33008

Sources: BleepingComputer, The Hacker News, KrebsOnSecurity, SANS ISC, CISA.