Industrial Sector

• Siemens SIMATIC
  "SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10
• Siemens Ruggedcom Rox
  "Ruggedcom Rox before v2.17.1 contain multiple third-party vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-16
• Universal Robots Polyscope 5
  "Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute code."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-17
• Siemens Siemens ROS#
  "ROS# contains a ROS service file_server, that before version 2.2.2 contains a path traversal vulnerability which could allow an attacker to access, i.e. read and write, arbitrary files, which are accessible with the user rights of the user that runs the service, on the system that hosts service. Siemens has released a new version for ROS# and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-08
• Siemens Ruggedcom Rox
  "Ruggedcom Rox contains an input validation vulnerability in the Scheduler functionality that could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Siemens has released new versions for the affected products and recommends to update to the latest versions."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-12
• Siemens SENTRON 7KT PAC1261 Data Manager
  "The web server in SENTRON 7KT PAC1261 Data Manager Before V2.1.0 contains a request smuggling vulnerability in the Go Project's net/http package that could allow an attacker to retrieve authorization tokens that can be used to gain administrative control over the device. Siemens has released a new version for SENTRON 7KT PAC1261 Data Manager and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-14
• Siemens SIMATIC S7 PLC Web Server
  "SIMATIC S7 PLCs contain multiple vulnerabilities in the web server that could allow an attacker to perform cross-site scripting attacks. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-15
• Siemens gWAP
  "Siemens gPROMS Web Applications Publisher (gWAP) is affected by a remote code execution vulnerability introduced through a third-party component, namely the Axios HTTP client library. The vulnerability stems from a specific "Gadget" attack chain that allows prototype pollution in other third-party libraries, potentially allowing an attacker to execute arbitrary code. Siemens has released a new version for gWAP and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-01
• Siemens Ruggedcom Rox
  "Ruggedcom Rox contains an improper access control vulnerability that could allow an authenticated remote attacker to read arbitrary files with root privileges from the underlying operating system's filesystem. Siemens has released new versions for the affected products and recommends to update to the latest versions."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-02
• Siemens Solid Edge
  "Solid Edge SE2026 before Update 5 is affected by two file parsing vulnerabilities that could be triggered when the application reads specially crafted files in PAR format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has released a new version for Solid Edge SE2026 and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-03
• Siemens Teamcenter
  "Siemens Teamcenter is affected by multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released new versions for the affected products and recommends to update to the latest versions."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-04
• Siemens Simcenter Femap
  "Simcenter Femap is affected by heap based buffer overflow vulnerability in Datakit library that could be triggered when the application reads files in IPT format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released a new version for Simcenter Femap and recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-05
• Siemens Industrial Devices
  "Multiple industrial devices contain a vulnerability that could allow an attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-06
• Siemens SIMATIC
  "SIMATIC HMI Unified Comfort Panels before V21.0 are affected by a vulnerability that allows an unauthenticated attacker to access the web browser via the help link. This vulnerability allows an attacker to access the web browser through the Control Panel if it is not protected by the corresponding security mechanisms. This opens the possibility for the attacker to find backdoors, which might lead to unwanted misconfigurations. Siemens has released new versions for the affected products and recommends to update to the latest versions."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-07
• Siemens Opcenter RDnL
  "Opcenter RDnL is affected by missing authentication in critical function in ‘ActiveMQ Artemis’. An unauthenticated attacker within the adjacent network could use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in availability impacts or message injection into any queue via the rogue broker. Breaking the integrity of a message has a low impact due to missing auto refresh functionality and it does not contain any confidential information. ActiveMQ Artemis has released a new version and Siemens recommends to update to the latest version."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-09
• Siemens Ruggedcom Rox
  "Ruggedcom Rox contains an input validation vulnerability in the feature key installation process that could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying operating system. Siemens has released new versions for the affected products and recommends to update to the latest versions."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-11
• Siemens SIPROTEC 5
  "The SIPROTEC 5 devices do not use sufficiently random numbers to generate session identifiers. This could facilitate a brute-force attack against a valid session identifier which could allow an unauthenticated remote attacker to hijack a valid user session. The affected session identifiers are only used in a subset of the endpoints that are provided by the affected products. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet available."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-13

Vulnerabilities

• 200,000 WordPress Sites At Risk From Critical Authentication Bypass Vulnerability In Burst Statistics Plugin
  "On May 8, 2026, PRISM, Wordfence Threat Intelligence’s autonomous vulnerability research platform, discovered a critical Authentication Bypass vulnerability in Burst Statistics, a WordPress plugin with more than 200,000 active installations. The vulnerability was introduced in the code on April 23, 2026, discovered just 15 days later, and patched 19 days later, highlighting the positive impact that AI can have on reducing the window for attackers to find and target new vulnerabilities in WordPress. This vulnerability allows unauthenticated attackers who know a valid administrator username to fully impersonate that administrator for the duration of any REST API request, including WordPress core endpoints such as /wp-json/wp/v2/users, by supplying any arbitrary and incorrect password in a Basic Authentication header. In a worst-case scenario, an attacker could exploit this flaw to create a new administrator-level account with no prior authentication whatsoever."
  https://www.wordfence.com/blog/2026/05/200000-wordpress-sites-at-risk-from-critical-authentication-bypass-vulnerability-in-burst-statistics-plugin/
  https://www.bleepingcomputer.com/news/security/hackers-exploit-auth-bypass-flaw-in-burst-statistics-wordpress-plugin/
• Ongoing Exploitation Of Cisco Catalyst SD-WAN Vulnerabilities
  "Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage. Successful exploitation of CVE-2026-20182 allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. The exploitation of CVE-2026-20182 appears to have been limited so far and Talos clusters this activity under UAT-8616 with high confidence."
  https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
  https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-critical-sd-wan-flaw-exploited-in-zero-day-attacks/
  https://www.darkreading.com/vulnerabilities-threats/maximum-severity-cisco-sd-wan-bug-exploited
  https://thehackernews.com/2026/05/cisco-catalyst-sd-wan-controller-auth.html
• NGINX Rift: Achieving NGINX Remote Code Execution Via An 18-Year-Old Vulnerability
  "We used depthfirst’s system to analyze the NGINX source code, and it autonomously discovered 4 remote memory corruption issues, including a critical heap buffer overflow introduced in 2008. We further investigated the exploitability of the issues, and developed a working proof of concept demonstrating RCE with ASLR off. If you use rewrite and set directives in your NGINX configuration, you’re at risk. In mid-April, I was chatting with a colleague about the most vulnerable spot in our infrastructure. Since most of our services live entirely inside a private network, our app platform is the only exposed surface. He joked that achieving remote code execution on our web service would mean hacking into depthfirst completely. Hacking the web service itself is not my usual focus. However, the idea of hacking the underlying web server intrigued me, which directed my attention to NGINX."
  https://depthfirst.com/research/nginx-rift-achieving-nginx-rce-via-an-18-year-old-vulnerability
  https://my.f5.com/manage/s/article/K000161019
  https://thehackernews.com/2026/05/18-year-old-nginx-rewrite-module-flaw.html
  https://www.bleepingcomputer.com/news/security/18-year-old-nginx-vulnerability-allows-dos-potential-rce/
  https://securityaffairs.com/192132/hacking/nginx-rift-an-18-year-old-flaw-in-the-worlds-most-deployed-web-server-just-came-to-light.html
• New Fragnesia Linux Flaw Lets Attackers Gain Root Privileges
  "Linux distros are rolling out patches for a new high-severity kernel privilege escalation vulnerability that allows attackers to run malicious code as root. Known as Fragnasia and tracked as CVE-2026-46300, this security flaw stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem that can enable unprivileged local attackers to gain root privileges by writing arbitrary bytes to the kernel page cache of read-only files. Zellic's head of assurance, William Bowling, who discovered this new universal local privilege escalation flaw, also shared a proof-of-concept (PoC) exploit that achieves a memory-write primitive in the kernel that is used to corrupt the page cache memory of the /usr/bin/su binary to get a shell with root privileges on vulnerable systems."
  https://www.bleepingcomputer.com/news/security/new-fragnesia-linux-flaw-lets-attackers-gain-root-privileges/
  https://github.com/v12-security/pocs/tree/main/fragnesia
  https://thehackernews.com/2026/05/new-fragnesia-linux-kernel-lpe-grants.html
  https://www.infosecurity-magazine.com/news/fragnesia-linux-kernel-lpe-root/
  https://www.securityweek.com/new-linux-kernel-vulnerability-fragnesia-allows-root-privilege-escalation/
  https://securityaffairs.com/192145/uncategorized/linux-kernel-bug-fragnesia-allows-local-root-access-attacks.html
  https://www.theregister.com/security/2026/05/14/dirty-frag-gets-a-sequel-as-fragnesia-hands-linux-attackers-root-level-access/5240270
• F5 Patches Over 50 Vulnerabilities
  "F5 on Wednesday announced fixes for over 19 high-severity and 32 medium-severity vulnerabilities impacting BIG-IP, BIG-IQ, and NGINX. Based on the CVSS score, the most severe of the resolved issues is CVE-2026-42945 (CVSS v4.0 score of 9.2), a denial-of-service (DoS) condition in NGINX’s ngx_http_rewrite_module module. The bug allows an unauthenticated attacker to send crafted HTTP requests that, combined with certain conditions beyond the attacker’s control, could trigger a heap buffer overflow and a restart. If Address Space Layout Randomization (ASLR) is disabled, the flaw can be exploited for code execution."
  https://www.securityweek.com/f5-patches-over-50-vulnerabilities/
• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/05/14/cisa-adds-one-known-exploited-vulnerability-catalog
  https://securityaffairs.com/192157/hacking/u-s-cisa-adds-a-flaw-in-cisco-catalyst-sd-wan-to-its-known-exploited-vulnerabilities-catalog.html
• CVE-2026-44338: PraisonAI Authentication Bypass In Under 4 Hours And The Growing Trend Of Rapid Exploitation
  "On May 11, 2026, GitHub published advisory GHSA-6rmh-7xcm-cpxj, tracked as CVE-2026-44338 for PraisonAI, an open-source multi-agent orchestration framework with ~7,100 GitHub stars. The legacy api_server.py entrypoint shipped with authentication disabled by default, exposing two endpoints, GET /agents and POST /chat, to any caller. Within three hours and 44 minutes of the advisory becoming public, a scanner identifying itself as CVE-Detector/1.0 was probing the exact vulnerable endpoint on internet-exposed instances. The advisory was published at 13:56 UTC. The first targeted request landed at 17:40 UTC the same day."
  https://www.sysdig.com/blog/cve-2026-44338-praisonai-authentication-bypass-in-under-4-hours-and-the-growing-trend-of-rapid-exploitation
  https://www.securityweek.com/hackers-targeted-praisonai-vulnerability-hours-after-disclosure/
• High-Severity Vulnerability Patched In VMware Fusion
  "Broadcom announced on Thursday that it has released a VMware Fusion update to patch a high-severity vulnerability. The flaw, tracked as CVE-2026-41702 and rated ‘important’ by the vendor, was reported by Mathieu Farrell. An advisory describes CVE-2026-41702 as a time-of-check time-of-use (TOCTOU) flaw that “occurs during an operation performed by a SETUID binary”. “A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed,” the advisory explains."
  https://www.securityweek.com/high-severity-vulnerability-patched-in-vmware-fusion/
  https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37454
  https://thehackernews.com/2026/05/praisonai-cve-2026-44338-auth-bypass.html
  https://securityaffairs.com/192136/security/broadcom-releases-vmware-fusion-security-update-for-root-access-bug.html

Malware

• Help-Desk Lures Drop KongTuke's Evolved ModeloRAT
  "Threat actors are impersonating help-desk staff over external Microsoft Teams chats to trick victims into deploying "ModeloRAT" on their own machines. ReliaQuest attributes the activity to financially motivated initial access broker (IAB) "KongTuke" based on reuse of the group's custom Python loader. Previously, KongTuke has compromised WordPress sites to host "ClickFix" and "CrashFix" lures and paste-and-run prompts on fake CAPTCHA or browser-crash pages for access that has historically fed ransomware affiliates. This Teams activity, which appears to add to, rather than replace, that web-based approach, marks the first time we’ve seen KongTuke use a collaboration platform for initial access. In the incidents we investigated, a single external Teams chat moved the operator from cold outreach to a persistent foothold in under five minutes."
  https://reliaquest.com/blog/threat-spotlight-help-desk-lures-drop-kongtukes-evolved-modelorat
  https://www.bleepingcomputer.com/news/security/kongtuke-hackers-now-use-microsoft-teams-for-corporate-breaches/
• Chinese APT Campaign Targets Entities With Updated FDMTP Backdoor
  "Darktrace have identified activity consistent with Chinese-nexus operations, a Twill Typhoon-linked campaign targeting customer environments, primarily within the Asia-Pacific & Japan (APJ) region. Beginning in late September 2025, multiple affected hosts were observed making requests to domains impersonating content delivery networks (CDNs), including infrastructure masquerading as Yahoo- and Apple-affiliated services. Across these cases, Darktrace identified a consistent behavioral execution pattern: the retrieval of legitimate binaries alongside malicious Dynamic Link Libraries (DLLs), enabling sideloading and execution of a modular .NET-based Remote Access Trojan (RAT) framework."
  https://www.darktrace.com/blog/chinese-apt-campaign-targets-entities-with-updated-fdmtp-backdoor
  https://www.infosecurity-magazine.com/news/mustang-panda-fdmtp-backdoor-apj/
  https://www.bankinfosecurity.com/mustang-panda-linked-to-new-modular-fdmtp-backdoor-a-31696
  https://hackread.com/chinatwill-typhoon-fake-apple-yahoo-sites-espionage/
• FrostyNeighbor: Fresh Mischief And Digital Shenanigans
  "This blogpost covers newly discovered activities attributed to FrostyNeighbor, targeting governmental organizations in Ukraine. FrostyNeighbor has been running continual cyberoperations, changing and updating its toolset regularly, updating its compromise chain and methods to evade detection – targeting victims located in Eastern Europe, according to our telemetry."
  https://www.welivesecurity.com/en/eset-research/frostyneighbor-fresh-mischief-digital-shenanigans/
  https://thehackernews.com/2026/05/ghostwriter-targets-ukrainian.html
  https://www.darkreading.com/cyberattacks-data-breaches/frostyneighbor-apt-govt-orgs-poland-ukraine
• Instead Of a Job—stolen Data And Money. Trojan Stealer Targeting MacOS And Windows Users Conceals Itself In Fake Online Interview Apps
  "Doctor Web’s experts are warning users about the spread of JobStealer, a trojan app that steals confidential information from macOS and Windows computer users. It primarily aims to hijack data from crypto wallets. Fraudsters, under the pretext of conducting online interviews, lure potential victims to malicious websites and ask them to download a video conferencing app. In reality, this software is the JobStealer trojan."
  https://news.drweb.com/show/?i=15253&lng=en
  https://hackread.com/fake-job-interview-jobstealer-malware-windows-macos/
• OrBit (Re)turns: Tracking An Open-Source Linux Rootkit Across Four Years Of Forks And Deployments
  "In July 2022, we published the first analysis of OrBit, a then-undocumented Linux userland-rootkit that stood out for its comprehensive libc hooking, SSH backdoor access, and PAM-based credential harvesting. At the time, OrBit appeared as a single sample with a single operator fingerprint, and the codebase itself looked customized. It wasn’t. As we will show below, OrBit is a repackaged and selectively weaponized build of Medusa, an open-source LD_PRELOAD rootkit published on GitHub in December 2022. The story of OrBit’s four-year evolution is not one of novel development; it’s the story of how a publicly available rootkit was forked, configured, and redeployed."
  https://intezer.com/blog/orbit-returns/
• Device Code Phishing Is An Evolution In Identity Takeover
  "Credential phishing remains an effective technique enabling everything from account takeover and fraud to ransomware and espionage. However, as organizations become better at defending against common phishing techniques such as multifactor authentication (MFA) phishing, cyber threat actors have expanded their capabilities to techniques like device code and OAuth phishing. When combined with LLM-generated tools and social engineering, criminals can use such techniques to target more people with new social engineering tricks at scale."
  https://www.proofpoint.com/us/blog/threat-insight/device-code-phishing-evolution-identity-takeover
• Kimsuky Targets Organizations With PebbleDash-Based Tools
  "Over the past few months, we have conducted an in-depth analysis of specific activity clusters of Kimsuky (aka APT43, Ruby Sleet, Black Banshee, Sparkling Pisces, Velvet Chollima, and Springtail), a prolific Korean-speaking threat actor. Our research revealed notable tactical shifts throughout multiple phases of the group’s latest campaigns. Kimsuky has continuously introduced new malware variants based on the PebbleDash platform, a tool historically leveraged by the Lazarus Group but appropriated by Kimsuky since at least 2021. Our monitoring indicates various strategic updates to the group’s arsenal, including the use of VSCode Tunneling, Cloudflare Quick Tunnels, DWAgent, large language models (LLMs), and the Rust programming language. This expanding set of tools underscores the group’s ongoing adaptation and evolution."
  https://securelist.com/kimsuky-appleseed-pebbledash-campaigns/119785/
• Popular Node-Ipc Npm Package Infected With Credential Stealer
  "Socket’s threat feed has detected malicious activity in newly published versions of node-ipc, a long-running npm package previously associated with one of the most widely discussed supply chain incidents in the JavaScript ecosystem."
  https://socket.dev/blog/node-ipc-package-compromised
  https://www.stepsecurity.io/blog/node-ipc-npm-supply-chain-attack
  https://thehackernews.com/2026/05/stealer-backdoor-found-in-3-node-ipc.html
  Operation SilentCanvas : JPEG Based Multistage Powershell Intrusion
  "At CYFIRMA, we identified a highly sophisticated multi-stage intrusion campaign leveraging a weaponized PowerShell payload disguised as a legitimate JPEG image file to deploy a trojanized instance of ConnectWise ScreenConnect for covert and persistent remote access. The intrusion likely originated through social engineering techniques such as phishing emails, malicious attachments, deceptive file-sharing interactions, or fake update lures involving a malicious file named sysupdate.jpeg. The payload was specifically crafted to exploit user trust and bypass conventional file-extension validation mechanisms while blending malicious activity with legitimate enterprise software."
  https://www.cyfirma.com/research/operation-silentcanvas-jpeg-based-multistage-powershell-intrusion/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

Financial Sector

• Financial Stability Risks Mount As Artificial Intelligence Fuels Cyberattacks
  "Artificial intelligence is transforming how the financial system copes with vulnerabilities and reacts to incidents. Yet it is also amplifying cyber threats that can undermine financial stability when the offensive capabilities of intruders outpace defenses. IMF analysis suggests that extreme cyber‑incident losses could trigger funding strains, raise solvency concerns, and disrupt broader markets. The financial system relies on shared digital infrastructure that’s highly interconnected, including software, cloud services, and networks for payments and other data. Advanced AI models can dramatically reduce the time and cost needed to identify and exploit vulnerabilities, raising the likelihood of simultaneously discovering and targeting weaknesses in widely used systems. As a result, cyber risk is increasingly about correlated failures that could disrupt financial intermediation, payments, and confidence at the systemic level."
  https://www.imf.org/en/blogs/articles/2026/05/07/financial-stability-risks-mount-as-artificial-intelligence-fuels-cyberattacks
  https://www.bankinfosecurity.com/imf-warns-ai-has-made-cyber-risk-financial-stability-threat-a-31679

Industrial Sector

• ABB AC500 V3 Stack Buffer Overflow In Cryptographic Message Syntax
  "ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves publicly reported vulnerability. An attacker who successfully exploited these vulnerabilities could cause a crash, denial-of-service (DoS), or potentially remote code execution."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-05
• ABB AC500 V3 Multiple Vulnerabilities
  "ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. An update is available that resolves these vulnerabilities. An attacker who successfully exploited these vulnerabilities could bypass the user management and read visualization files (CVE-2025-2595), read and write certificates and keys (CVE-2025-41659) or cause a denial-of-service (DoS) (CVE-2025-41691)."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-03
• ABB WebPro SNMP Card PowerValue Multiple Vulnerabilities
  "ABB became aware of multiple internally discovered vulnerabilities in the WebPro SNMP card PowerValue for the product versions listed as affected in the advisory. Depending upon the vulnerability, an attacker with access to local network who successfully exploited this vulnerability could have - Unauthorized access - Insufficient Session Expiration leading to resource unavailability - Uncontrolled Resource Consumption leading to DOS attack ABB strongly advises customers to update the latest firmware of affected products."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-06
• Fuji Electric Tellus
  "Successful exploitation of this vulnerability could allow an attacker to elevate privileges from user to system, which may then enable the attacker to cause a temporary denial of service, open files, or delete files."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-01
• Subnet Solutions PowerSYSTEM Center
  "Successful exploitation of these vulnerabilities could allow an authenticated attacker to expose sensitive information or cause a CRLF injection."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-02
• ABB Automation Builder Gateway For Windows
  "ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. The Windows gateway is accessible remotely by default. Unauthenticated attackers can therefore search for PLCs, but the user management of the PLCs prevents the actual access to the PLCs – unless it is disabled"
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-04
• ICS Patch Tuesday: New Security Advisories From Siemens, Schneider, CISA
  "Only Siemens, Schneider Electric, CISA, and CERT@VDE have published new ICS security advisories for the May 2026 Patch Tuesday. Siemens has published 18 new security advisories, and several of them describe critical vulnerabilities. The company has addressed critical issues in Sentron 7KT PAC1261 Data Manager (device takeover), Simatic S7 PLC web server (XSS), Ruggedcom Rox (command execution as root, old vulnerabilities in third-party components), ROS# (arbitrary file access), Simatic CN4100 (over 300 third-party component flaws), and Opcenter RDnL (missing authentication)."
  https://www.securityweek.com/ics-patch-tuesday-new-security-advisories-from-siemens-schneider-cisa/

Vulnerabilities

• CVE-2025-32975: The Open Directory Behind The KACE SMA Breach And 60+ Downstream Victims
  "Quest KACE Systems Management Appliance (SMA) is a widely deployed on-premises platform that enterprises use for endpoint management, handling software deployment, patch distribution, inventory, and scripted administrative control across managed devices. That privileged position makes it an exceptionally high-value target for an attacker who controls a KACE SMA appliance, which, in many environments, can reach every managed endpoint from a single trusted management plane. CVE-2025-32975 is a critical authentication bypass vulnerability in KACE SMA's SSO authentication handling mechanism with a CVSS score of 10.0. The flaw allows an unauthenticated, network-reachable attacker to impersonate legitimate users, including administrators, without supplying any credentials."
  https://hunt.io/blog/cve-2025-32975-quest-kace-sma-open-directory-60-victims
  https://securityaffairs.com/192067/security/quest-kace-sma-flaw-cve-2025-32975-when-one-unpatched-tool-opens-the-door-to-60-organizations.html
• Fortinet, Ivanti Patch Critical Vulnerabilities
  "Fortinet and Ivanti on Tuesday announced patches for 18 vulnerabilities across their product portfolios, including three critical-severity bugs. Fortinet published 11 advisories describing as many bugs, including two dealing with critical-severity code execution security defects. Tracked as CVE-2026-44277 (CVSS score of 9.1), the first of them is an improper access control issue in FortiAuthenticator that could be exploited remotely, without authentication, via crafted requests. “FortiAuthenticator Cloud is not impacted by the issue, and hence customers do not need to perform any action,” the company says."
  https://www.securityweek.com/fortinet-ivanti-patch-critical-vulnerabilities/
• Chipmaker Patch Tuesday: Intel And AMD Patch 70 Vulnerabilities
  "Intel and AMD have released over two dozen advisories on May 2026 Patch Tuesday, addressing 70 vulnerabilities across their product portfolios. Intel published 13 advisories describing 24 security defects, including one critical and eight high-severity flaws. The critical bug, tracked as CVE-2026-20794 (CVSS score of 9.3), is described as a buffer overflow issue in the Data Center Graphics Driver for VMware ESXi software that could be exploited for privilege escalation and potentially for code execution. Intel’s update for the product also resolves two high-severity out-of-bounds write and read weaknesses that could lead to denial-of-service (DoS) conditions and potentially to data corruption or disclosure."
  https://www.securityweek.com/chipmaker-patch-tuesday-intel-and-amd-patch-70-vulnerabilities/
• Windows BitLocker Zero-Day Gives Access To Protected Drives, PoC Released
  "A cybersecurity researcher has published proof-of-concept (PoC) exploits for two unpatched Microsoft Windows vulnerabilities named YellowKey and GreenPlasma, which are a BitLocker bypass and a privilege-escalation flaw. Known as Chaotic Eclipse or Nightmare Eclipse, the researcher describes the BitLocker bypass issue as functioning like a backdoor because the vulnerable component is present only in the Windows Recovery Environment (WinRE), which is used to repair boot-related issues in Windows."
  https://www.bleepingcomputer.com/news/security/windows-bitlocker-zero-day-gives-access-to-protected-drives-poc-released/
  https://www.theregister.com/security/2026/05/13/disgruntled-researcher-releases-two-more-microsoft-zero-days/5239758
• 1,000,000 WordPress Sites Affected By Arbitrary File Read And SQL Injection Vulnerabilities In Avada Builder WordPress Plugin
  "On March 21st, 2026, we received a submission for an Arbitrary File Read and an SQL Injection vulnerability in Avada Builder, a WordPress plugin with an estimated 1,000,000 active installations. The arbitrary file read vulnerability can be used by authenticated attackers, with subscriber-level access and above, to read arbitrary files on the server, which may contain sensitive information. The SQL injection vulnerability can be used by unauthenticated attackers to extract sensitive data from the database, such as password hashes. Props to Rafie Muhammad who discovered and responsibly reported these vulnerabilities through the Wordfence Bug Bounty Program. This researcher earned bounties of $3,386.00 and $1,067.00 for these discoveries."
  https://www.wordfence.com/blog/2026/05/1000000-wordpress-sites-affected-by-arbitrary-file-read-and-sql-injection-vulnerabilities-in-avada-builder-wordpress-plugin/
  https://www.infosecurity-magazine.com/news/avada-builder-flaws-one-million/
• Microsoft, Palo Alto Networks Find Many Vulnerabilities By Using AI On Their Own Code
  "Microsoft and Palo Alto Networks have separately reported this week that they have seen significant results after turning AI on their own code to find vulnerabilities. Advanced AI models such as Claude Mythos have sparked debate in the cybersecurity industry about what the vulnerability discovery landscape will look like going forward. While some organizations have confirmed that these AI models are a game-changer, others are skeptical of their actual performance. Microsoft said on Tuesday that more than a dozen of the 137 vulnerabilities fixed with its latest Patch Tuesday updates were found by a new AI system called MDASH (multi-model agentic scanning harness) built by its Autonomous Code Security team."
  https://www.securityweek.com/microsoft-palo-alto-networks-find-many-vulnerabilities-by-using-ai-on-their-own-code/
  https://www.theregister.com/patches/2026/05/14/welcome-to-the-vulnpocalypse-as-vendors-use-ai-to-find-bugs-and-patches-multiply-like-rabbits/5240027
  https://thehackernews.com/2026/05/microsofts-mdash-ai-system-finds-16.html
• One Is a Fluke, 3 Is a Pattern: MCP Back-End Vulnerabilities
  "Model Context Protocol (MCP) servers entered our lives recently but drastically improved the capabilities of AI models. (For an examination of the inner works of MCP, read our previous blog post.) If you've been paying attention, you know the security issues involved with giving AI models access to external applications. MCP servers sit at the center of that approach, and researchers quickly found ways to exploit those servers: tool description poisoning, cross-server context injection, and supply chain attacks on platforms that host them."
  https://www.akamai.com/blog/security-research/one-fluke-3-pattern-mcp-back-end-vulnerabilities
  https://www.theregister.com/security/2026/05/13/bug-hunter-tracks-down-three-serious-mcp-database-flaws-one-left-unpatched/5238916

Malware
Seedworm: Iran-Linked Hackers Breached Korean Electronics Maker In Global Spying Campaign
"Iran-linked attackers spent a week inside the network of a major South Korean electronics manufacturer in February 2026, as part of a sprawling early-year espionage campaign affecting at least nine organizations across four continents. Other targets included government agencies and an international airport in the Middle East, Southeast Asian industrial manufacturers, a Latin American financial-services provider, and educational institutions in multiple countries."
https://www.security.com/threat-intelligence/iran-seedworm-electronics
https://www.bleepingcomputer.com/news/security/iranian-hackers-targeted-major-south-korean-electronics-maker/

• Sandworm Activity In Industrial Environments: What The Data Reveals
  "“Without rapid containment, Sandworm does not disengage. It accelerates.” Recent geopolitical events involving publicly disclosed attacks against national critical infrastructure across Europe and the U.S., have once again drawn attention to a highly disruptive threat actor known as Sandworm, the Russian state-sponsored group also tracked as APT44, Seashell Blizzard, and Voodoo Bear. By studying environments where Sandworm activity has been positively identified, we can extract lessons that help future victims detect intrusions earlier, recover more effectively, and — most importantly — prevent Sandworm-related incidents altogether."
  https://www.nozominetworks.com/blog/sandworm-activity-in-industrial-environments-what-the-data-reveals
  https://www.bankinfosecurity.com/russian-attacks-on-polish-water-utilities-use-fear-as-weapon-a-31681
• FamousSparrow APT Targets Azerbaijani Oil And Gas Industry
  "Bitdefender Labs tracked a multi-wave intrusion targeting an Azerbaijani oil and gas company from late December 2025 through late February 2026. This research documents expansion of Chinese APT activity against South Caucasus energy infrastructure, attributed with moderate-to-high confidence to FamousSparrow (overlapping with the Earth Estries threat ecosystem). The operation demonstrates several notable technical and strategic characteristics, most notably an evolved DLL sideloading technique. Unlike standard DLL sideloading that relies on simple file replacement, this method overrides two specific exported functions within the malicious library. This creates a two-stage trigger that gates the Deed RAT loader’s execution through the host application’s natural control flow, further evolving the defense evasion capabilities of traditional DLL sideloading."
  https://businessinsights.bitdefender.com/famoussparrow-apt-targets-azerbaijani-oil-gas-industry
  https://thehackernews.com/2026/05/azerbaijani-energy-firm-hit-by-repeated.html
  https://www.darkreading.com/cyberattacks-data-breaches/china-famoussparrow-apt-south-caucasus-energy-firm
• The French 2-Step: Exposing a Multi-Stage Scam Targeting The National Railway Company In France
  "While online scams are becoming more advanced, this particular multi-stage scam stands out for its advanced social engineering. These days, it’s not uncommon to receive fake phishing emails. Generally, they are easy to spot because of the ridiculous way they try to make us believe in offers that are too good to be true. However Group-IB’s current research indicates that fraudsters can be very persuasive and meticulous both in the way they carry out their scam and their choice of victims. This blog focuses on one highly-targeted scheme to deceive customers of the French national railway company (SNCF), which is used on a daily basis by 5 millions of travelers through 15 thousand trains."
  https://www.group-ib.com/blog/french-railway-two-step-scam/
• Sinkholing CountLoader: Insights Into Its Recent Campaign
  "McAfee Labs has recently uncovered a large scale CountLoader campaign that uses multiple layers of obfuscation and staged payload delivery to evade detection and maintain persistence in infected systems. The infection process relies on several layers of loaders, including PowerShell scripts, obfuscated JavaScript executed through mshta.exe, and in memory shellcode injection, each stage decrypting and launching the next. The attackers employ a custom encrypted communication protocol to interact with their C2 servers. By registering a backup domain used by the malware, we were able to sinkhole the traffic and observe thousands of infected machines connecting to the C2 infrastructure. Final payload deployed in this campaign is a cryptocurrency clipper, which monitors clipboard activity and replaces copied wallet addresses with attacker controlled ones to redirect cryptocurrency transactions."
  https://www.mcafee.com/blogs/other-blogs/mcafee-labs/sinkholing-countloader-insights-into-its-recent-campaign/
• GemStuffer Campaign Abuses RubyGems As Exfiltration Channel Targeting UK Local Government
  "Socket's threat research team is tracking a suspicious RubyGems campaign we’re calling GemStuffer, involving more than 100 gems that appear to use the RubyGems registry as a data transport mechanism rather than a conventional malware distribution channel. The packages do not appear designed for mass developer compromise. Many have little or no download activity, and the payloads are repetitive, noisy, and unusually self-contained. Instead, the scripts fetch pages from UK local government democratic services portals, package the collected responses into valid .gem archives, and publish those gems back to RubyGems using hardcoded API keys. In some samples, the payload creates a temporary RubyGems credential environment under /tmp, overrides HOME, builds a gem locally, and pushes it to rubygems.org. Other variants skip the gem CLI entirely and POST the archive directly to the RubyGems API."
  https://socket.dev/blog/gemstuffer
  https://thehackernews.com/2026/05/gemstuffer-abuses-150-rubygems-to.html
• Shai-Hulud Goes Open Source: Malware Creators Leak Their Own Code To GitHub
  "Breaking News: TeamPCP has gone open source — and the copycats are already here. The group behind Shai-Hulud has leaked their own malware code to GitHub, and independent threat actors have already begun modifying it and expanding its reach. OX Security is actively tracking this as it unfolds. TeamPCP has escalated. The group behind Shai-Hulud is now spreading not just their malware, but their own source code, using what appear to be compromised GitHub accounts. Currently 2 repositories are active, but that number is growing as infections spread. New repositories can be monitored in real time using this link. Search GitHub for “A Gift From TeamPCP.”"
  https://www.ox.security/blog/shai-hulud-open-source-malware-github/
  https://www.theregister.com/security/2026/05/13/malware-crew-teampcp-open-sources-its-shai-hulud-worm-on-github/5239319
• Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS And Elementary-Data In CI/CD Credential Theft
  "TeamPCP has been identified as running a coordinated campaign from March 19 through April 24, with at least seven distinct waves identified. It finds trusted artifacts in developer tool chains, poisons the distribution channel using that project’s own infrastructure, and harvests credentials before the project’s maintainers or security monitoring catches the substitution. The targets span five programming ecosystems and three registry types. What distinguishes the two most recent operations is how the actor reached the same outcome, despite using different methods to get there. The KICS attack was operationally complex, with simultaneous poisoning across three distribution channels, an obfuscated payload executed via a downloaded runtime, and a downstream npm hijack executed within 24 hours using stolen credentials."
  https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html
• Undermining The Trust Boundary: Investigating a Stealthy Intrusion Through Third-Party Compromise
  "In recent years, many sophisticated intrusions have increasingly avoided using noisy exploits, obvious malware, or custom tooling, instead leveraging systems that organizations already trust within their environments. By operating through legitimate and trusted administrative mechanisms, threat actors could more easily blend seamlessly into routine operations and remain undetected. Microsoft Incident Response investigated an intrusion that followed this pattern. What initially appeared as routine administrative activity was instead found to be a coordinated campaign abusing trusted operational relationships and authentication processes to establish durable access. The threat actor in this incident leveraged a compromised third-party IT services provider and legitimate IT management tools to conduct a stealthy campaign focusing on long-term access, credential theft, and establishing a persistent foothold."
  https://www.microsoft.com/en-us/security/blog/2026/05/12/undermining-the-trust-boundary-investigating-a-stealthy-intrusion-through-third-party-compromise/

Breaches/Hacks/Leaks

• When The Ransomware Gang Gets Hacked: What The Gentlemen Leak Reveals About Modern Ransomware Risk
  "On May 4, 2026, The Gentlemen’s administrator acknowledged on underground forums that their internal backend database had been compromised and leaked, likely connected to a breach of 4VPS, a hosting provider the group used to run their infrastructure. Check Point Research obtained a portion of that data before it was removed: internal chat logs, organizational rosters, ransom negotiation transcripts, and tooling discussions. It is the kind of inside view of a ransomware operation that almost never becomes available to defenders. This blog distills what CPR found, building on our initial analysis published in April 2026. For the full technical breakdown, read the complete CPR research report."
  https://blog.checkpoint.com/research/when-the-ransomware-gang-gets-hacked-what-the-gentlemen-leak-reveals-about-modern-ransomware-risk/
  https://research.checkpoint.com/2026/thus-spoke-the-gentlemen/
  https://www.darkreading.com/threat-intelligence/gentlemen-raas-gang-data-leak
• 716,000 Impacted By OpenLoop Health Data Breach
  "Hackers stole the personal information of 716,000 individuals during a January 2026 intrusion at telehealth platform OpenLoop Health. The incident was initially disclosed to the relevant authorities in March, but the number of impacted individuals was added to the US Department of Health and Human Services’ breach portal only this week. According to notification letters OpenLoop Health filed with the Attorney General’s Offices in California and Texas, the intrusion was discovered on January 7. “An unauthorized third party had gained access to certain OpenLoop systems and removed certain information,” the notification reads."
  https://www.securityweek.com/716000-impacted-by-openloop-health-data-breach/
  https://securityaffairs.com/192066/uncategorized/openloop-health-confirms-january-2026-data-breach-affecting-716000.html
• TeamPCP Claims Sale Of Mistral AI Repositories Amid Mini Shai-Hulud Attack
  "Only days after the Mini Shai-Hulud supply chain attack targeted npm and PyPI packages associated with French artificial intelligence company Mistral AI, a threat actor using the TeamPCP identity is now claiming to sell what appear to be internal company repositories and source code on a hacking forum. The forum post, published a few hours ago under the TeamPCP name, advertises roughly 5GB of alleged internal repositories connected to both “mistralai” and “mistral-solutions.” The actor claims the archive contains around 450 repositories covering training systems, fine-tuning projects, benchmarking tools, dashboards, inference infrastructure, experiments, and future AI projects."
  https://hackread.com/teampcp-mistral-ai-repositories-mini-shai-hulud-attack/

General News

• April 2026 Phishing Email Trends Report
  "in April 2026, the most common threat in phishing email attachments was Trojan (47%). this type was distributed by disguising itself with a double extension or a legitimate file name to trick the user into executing it and installing malware on the system. they continued to spread through multiple variants and social engineering techniques."
  https://asec.ahnlab.com/en/93706/
• Checkbox Assessments Aren't Fit To Measure To Risk
  "A rapidly evolving threat landscape with highly adaptable and increasingly sophisticated threat actors is no place for checkbox compliance assessments that merely audit organizations' security postures once a year. That's why security professionals and industry experts are calling for compliance models that take a more continuous approach, and more companies continue to emerge in the space. Industry leaders and CISOs continually poke holes in the way governance, risk management, and compliance (GRC) and third-party risk management (TPRM) assessments are conducted – and the holes are only growing bigger. Yearly assessments, with their static questionaries to determine an organization's risk level, are stagnant, the polar opposite of how attackers' behave. Threat actors can now find and exploit vulnerabilities faster and discover new vectors to conduct supply-chain attacks."
  https://www.darkreading.com/cyber-risk/checkbox-assessments-aren-t-fit-to-measure-to-risk
• Ransomware: Over Half Of CISOs Would Consider Paying Ransom To Hackers
  "In the event of being hit by a ransomware attack, over half of cybersecurity leaders would consider paying the ransom demand to cybercriminals to end the incident and restore systems faster, according to newly released figures. Published on May 13, the report by Absolute Security suggested that 58% of CISOs would realistically think about paying the ransom, if that is what it took to help restore systems encrypted in a ransomware attack. The research suggested that CISOs in the US are more likely to consider paying a ransom demand, at 63%, than their counterparts in the UK, at just 47%."
  https://www.infosecurity-magazine.com/news/ransomware-over-half-cisos-would/
• Global Cyber Agencies Issue New SBOMs For AI Guidance To Tackle AI Supply Chain Risks
  "Multiple government cyber agencies have a new resource defining the minimum elements for software bills of materials (SBOMs) for AI to strengthen the AI-supply chain. The aim is to help public and private sector stakeholders improve transparency in their artificial intelligence (AI) systems and supply chains. The paper, Software Bill of Materials (SBOM) for Artificial Intelligence - Minimum Elements, was published on 12 May and was written by the G7 Cybersecurity Working Group."
  https://www.infosecurity-magazine.com/news/new-sboms-for-ai-guidance-2026/
  https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/KI/SBOM-for-AI_minimum-elements.pdf?__blob=publicationFile&v=4
• Alleged Dream Market Admin Arrested In Germany After US Indictment
  "German and U.S. authorities arrested the alleged administrator behind Dream Market, a popular dark web forum that shut down in 2019. During a May 7 raid on three locations, German and U.S. law enforcement arrested Owe Martin Andresen, 49, on multiple charges of money laundering. An indictment unsealed this week by the DOJ accused Andresen of being the main administrator of Dream Market. The Justice Department did not respond to requests for comment about whether they will ask for him to be extradited from Germany, where he also faces charges. U.S. Attorney Theodore Hertzberg said Andresen “will be prosecuted in both Germany and the United States as a result of his actions.”"
  https://therecord.media/dream-market-admin-arrested-in-germany
• Operating Inside The Lethal Trifecta: Blast Radius Reduction In AI Agent Deployments
  "AI agents that can read files, call APIs, and perform actions are already being deployed in enterprises. These agents often operate in the center of what Simon Willison terms ‘the lethal trifecta’: they can access private data, process untrusted content, and communicate externally, making them susceptible to data theft via indirect prompt injection – where an attacker plants instructions in content that the agent reads on behalf of a trusted user, such as an email, a web page, or a document. The agent follows the injected instructions with the user's privileges, and the user never sees the attack. The Agents Rule of Two generalizes the concept: an agent should satisfy at most two of a) processing untrusted inputs, b) accessing sensitive systems, and c) changing state externally."
  https://www.sophos.com/en-us/blog/inside-the-lethal-trifecta-blast-radius-reduction-in-ai-agent-deployments

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 7 รายการ เมื่อวันที่ 12 พฤษภาคม 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-132-01 Fuji Electric Tellus
• ICSA-26-132-02 Subnet Solutions PowerSYSTEM Center
• ICSA-26-132-03 ABB AC500 V3 Multiple Vulnerabilities
• ICSA-26-132-04 ABB Automation Builder Gateway for Windows
• ICSA-26-132-05 ABB AC500 V3 Stack buffer overflow in Cryptographic Message Syntax
• ICSA-26-132-06 ABB WebPro SNMP Card PowerValue
• ICSA-25-329-01 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories

Vulnerabilities

• SAP Fixes Critical Vulnerabilities In Commerce Cloud And S/4HANA
  "SAP has released the May 2026 security updates addressing 15 vulnerabilities across multiple products, including two critical flaws in Commerce Cloud and S/4HANA. Commerce Cloud is an enterprise-grade e-commerce platform used by online stores owned by large retailers and global brands, while S/4HANA is a cloud-based Enterprise Resource Planning (ERP) suite that will replace the company's on-premises ECC ERP system. Tracked as CVE-2026-34263, the first critical flaw is a missing authentication check in SAP Commerce Cloud that allows unauthenticated attackers to execute code on vulnerable servers."
  https://www.bleepingcomputer.com/news/security/sap-fixes-critical-vulnerabilities-in-commerce-cloud-and-s-4hana/
  https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2026.html
  https://www.securityweek.com/sap-patches-critical-s-4hana-commerce-vulnerabilities/
• Adobe Patches 52 Vulnerabilities In 10 Products
  "Adobe on Tuesday announced the release of patches for 52 vulnerabilities across 10 products, including critical-severity bugs that could lead to code execution and privilege escalation. More than half of the weaknesses Adobe addressed this month could be exploited for arbitrary code execution. Application denial-of-service (DoS) was the second most common type of resolved issue. When it comes to the severity of the resolved vulnerabilities, the Adobe Connect update takes the lead. It addresses two critical-severity flaws that could be exploited for arbitrary code execution (CVE-2026-34659, CVSS score of 9.6) and privilege escalation (CVE-2026-34660, CVSS score of 9.3)."
  https://www.securityweek.com/adobe-patches-52-vulnerabilities-in-10-products/
• New Exim BDAT Vulnerability Exposes GnuTLS Builds To Potential Code Execution
  "Exim has released security updates to address a severe security issue affecting certain configurations that could enable memory corruption and potential code execution. Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email. The vulnerability, tracked as CVE-2026-45185, aka Dead.Letter, has been described as a use-after-free vulnerability in Exim's binary data transmission (BDAT) message body parsing when a TLS connection is handled by GnuTLS."
  https://thehackernews.com/2026/05/new-exim-bdat-vulnerability-exposes.html
  https://www.exim.org/static/doc/security/EXIM-Security-2026-05-01.1/EXIM-Security-2026-05-01.1.txt
• Fortinet Warns Of Critical RCE Flaws In FortiSandbox And FortiAuthenticator
  "Fortinet has released security updates to address two critical vulnerabilities in FortiSandbox and FortiAuthenticator that could enable attackers to run commands or arbitrary code on unpatched systems. The first one, tracked as CVE-2026-44277, impacts the company's FortiAuthenticator Identity and Access Management (IAM) solution and was patched in FortiAuthenticator versions 6.5.7, 6.6.9, and 8.0.3. "An Improper Access Control vulnerability [CWE-284] in FortiAuthenticator may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests," Fortinet said in a Tuesday advisory."
  https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-rce-flaws-in-fortisandbox-and-fortiauthenticator/
  https://fortiguard.fortinet.com/psirt/FG-IR-26-128
• Microsoft May 2026 Patch Tuesday Fixes 120 Flaws, No Zero-Days
  "Today is Microsoft's May 2026 Patch Tuesday, with security updates for 120 flaws and no zero-days disclosed. This Patch Tuesday addresses 17 "Critical" vulnerabilities, 14 of which are remote code execution, 2 are elevation of privilege, and 1 is an information disclosure flaw. The number of bugs in each vulnerability category is listed below:"
  https://www.bleepingcomputer.com/news/microsoft/microsoft-may-2026-patch-tuesday-fixes-120-flaws-no-zero-days/
  https://blog.talosintelligence.com/microsoft-patch-tuesday-may-2026/
  https://www.darkreading.com/application-security/patch-tuesday-microsoft-zero-day-sight
  https://cyberscoop.com/microsoft-patch-tuesday-may-2026/
  https://www.securityweek.com/microsoft-patches-137-vulnerabilities/
  https://www.theregister.com/patches/2026/05/13/doozy-of-a-patch-tuesday-includes-30-critical-microsoft-cves/5239224
• Apple Patches Dozens Of Vulnerabilities In MacOS, iOS
  "Apple on Monday published 11 new security advisories to inform customers about dozens of vulnerabilities patched in its operating systems. iOS and iPadOS 26.5 address more than 60 CVEs, including 20 WebKit issues that can lead to crashes, exposure of sensitive user data, and security bypasses. Other vulnerabilities can be exploited for DoS attacks, security bypass, sandbox escape, access to sensitive user data, privilege escalation, and user tracking. Dozens of the vulnerabilities patched in the latest iOS and iPadOS versions were also addressed by Apple with the release of macOS Tahoe 26.5, which resolves nearly 80 vulnerabilities."
  https://www.securityweek.com/apple-patches-dozens-of-vulnerabilities-in-macos-ios/
  https://thehackernews.com/2026/05/ios-265-brings-default-end-to-end.html
• Microsoft Releases Windows 10 KB5087544 Extended Security Update
  "Microsoft has released the Windows 10 KB5087544 extended security update to fix the May 2026 Patch Tuesday vulnerabilities and resolve an issue with the new Remote Desktop warnings. If you are running Windows 10 Enterprise LTSC or are enrolled in the ESU program, you can install this update like normal by going into Settings, clicking on Windows Update, and manually performing a 'Check for Updates.'"
  https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5087544-extended-security-update/
• Claude Mythos Finds Only One Curl Vulnerability; Experts Divided On What It Really Means
  "A test of Anthropic’s restricted Claude Mythos model found just one low-severity vulnerability in the widely used open source data transfer tool curl, casting doubt on the AI company’s bold claims, though some argue the results say more about curl’s robust security than Mythos’ limitations. Daniel Stenberg, the lead developer of curl, revealed in a blog post on Monday that he was recently given the opportunity to test the Claude Mythos frontier AI model, which Anthropic claimed had identified thousands of zero-days in the weeks leading up to its launch. Anthropic is offering Mythos only to a few dozen major organizations as part of a restricted program due to concerns about potential misuse."
  https://www.securityweek.com/claude-mythos-finds-only-one-curl-vulnerability-experts-divided-on-what-it-really-means/
• Pwn2Own Berlin 2026 Hits Capacity As Rejected Hackers Release 0-Days
  "The world’s most famous hacking contest is facing a crisis it didn’t see coming. For the first time in 19 years, Pwn2Own Berlin 2026 has reportedly run out of space. The event, run by Trend Micro’s Zero Day Initiative (ZDI), hit a hard limit on how many hackers it can actually host. For your information, Pwn2Own is a live competition where experts detect zero-day vulnerabilities."
  https://hackread.com/pwn2own-berlin-2026-hits-capacity-hackers-0-days/

Malware

• Free OnlyFans Lure Used To Spread Cross-Platform CRPx0 Malware
  "OnlyFans – an attractive brand for hopeful users and their attackers. CRPx0 is a complex, stealthy and persistent malware campaign. It currently targets macOS and Windows systems, and appears to have Linux capabilities in development. It currently comprises cryptocurrency theft followed by large scale data exfiltration and ransomware. The campaign has been analyzed (PDF) in detail by Aryaka Threat Research Labs."
  https://www.securityweek.com/free-onlyfans-lure-used-to-spread-cross-platform-crpx0-malware/
  https://www.aryaka.com/docs/reports/crpx0-ransomware-operations-report.pdf
• RubyGems Suspends New Signups After Hundreds Of Malicious Packages Are Uploaded
  "ubyGems, the standard package manager for the Ruby programming language, has temporarily paused account sign ups following what has been described as a "major malicious attack." "We're dealing with a major malicious attack on Ruby Gems right now," Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, said in a post on X. "Signups are paused for the time being. Hundreds of packages involved – mostly targeting us, but some carrying exploits." Visitors to RubyGems' sign up page are now greeted with the message: "New account registration has been temporarily disabled.""
  https://thehackernews.com/2026/05/rubygems-suspends-new-signups-after.html
• Foxconn Confirms Cyberattack Impacting North American Factories
  "Taiwanese electronics manufacturer Foxconn said factories in North America are resuming their normal production cycles after a cyberattack affected several facilities. A spokesperson for the company confirmed the incident but declined to provide specifics on how many factories in North America were impacted. Foxconn has factories in Wisconsin, Ohio, Texas, Virginia, Indiana and several across Mexico. “The cybersecurity team immediately activated the response mechanism and implemented multiple operational measures to ensure the continuity of production and delivery. The affected factories are currently resuming normal production,” the spokesperson said."
  https://therecord.media/foxconn-confirms-cyberattack-north-american-factories
  https://www.theregister.com/cyber-crime/2026/05/12/foxconn-confirms-cyberattack-after-nitrogen-claims-apple-nvidia-data-theft/5239144
• Vibe Hacking: Two AI-Augmented Campaigns Target Government And Financial Sectors In Latin America
  "Threat actors using AI is an unsurprising and even long-predicted development. In a case in point, TrendAI Research has identified two emerging threat campaigns that used agentic AI to drive intrusion operations against government entities and financial organizations across several countries in Latin America. Though evidence suggests that the two groups are likely separate entities, they share strikingly similar tactics, as we detail in this report. This degree of overlap suggests that AI-assisted attacks are becoming a broader pattern among threat actor groups."
  https://www.trendmicro.com/en_us/research/26/e/vibe-hacking-two-ai-augmented-campaigns-target-government-and-financial-sectors-in-latin-america.html
• Attackers Combine ClickFix With PySoxy Proxying To Maintain Persistence
  "Cybercriminals have combined ClickFix attacks with PySoxy, a 10-year-old open-source Python SOCKS5 proxy, to maintain persistence on victims’ machines without malware, even after attempts at removal. The campaign has been detailed by cybersecurity researchers at ReliaQuest, who warned that it shows that ClickFix attacks are moving beyond one-time user execution into modular post-exploitation, making the attacks harder to identify and contain. ClickFix, is a social engineering tactic which tricks users into unwittingly running malicious commands or downloading harmful payloads onto their own machines. It has become a widely deployed method of distributing malware or stealing login credentials."
  https://www.infosecurity-magazine.com/news/clickfix-combined-pysoxy-proxying/
• Lorem Ipsum Malware: Trojanized MS Teams Installers Deliver Multi-Stage Loader And Backdoor
  "BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) security researchers have been tracking an emerging, rapidly maturing threat group conducting a global SEO-poisoning campaign that distributes trojanized Microsoft Teams installers. These installers ultimately deploy a multi-stage shellcode loader and backdoor BlueVoyant has designated Lorem Ipsum. Active since at least February 2026, the campaign opportunistically targets users searching for Microsoft Teams across at least six countries, with a US-based healthcare-sector client confirmed as targeted, with successful BlueVoyant interdiction. In roughly ten weeks, the operators evolved from a minimally obfuscated test build into an operationally mature loader chain featuring substitution cipher decoding, XOR-encrypted shellcode stubs, DLL sideloading, JFIF-disguised C2 traffic, and a per-victim UUID-tracked callback architecture. Most distinctively, the loader abuses letsdiskuss[.]com, a legitimate India-based question-and-answer/blogging platform, as a dead-drop resolver for C2 infrastructure across at least four attacker-controlled profiles."
  https://www.bluevoyant.com/blog/lorem-ipsum-trojanized-microsoft-teams-installers-multi-stage-loader-backdoor
• Python Backdoor Threat Analysis Following An AI Deepfake Impersonation Campaign
  "Genians Security Center identified a threat campaign suspected of being associated with APT37 that combines an obfuscated batch file command invocation technique with Compiled Python-based malware. This threat is distributed through email-based spear phishing in the form of ZIP-compressed files and begins by inducing the user to execute an LNK shortcut file contained inside. When the user runs the file, the actual command is reconstructed through an environment variable-based substring expansion technique, after which additional payloads are downloaded and executed sequentially."
  https://www.genians.co.kr/en/blog/threat_intelligence/python

Breaches/Hacks/Leaks

• Instructure Reaches 'agreement' With ShinyHunters To Stop Data Leak
  "Instructure, the edtech giant behind the widely popular Canvas learning management system (LMS), has reached an "agreement" with the ShinyHunters extortion group to prevent the data stolen in a recent breach from being leaked online. The company says over 30 million educators and students use its Canvas platform across more than 8,000 schools and universities worldwide. In a Tuesday statement, Instructure said the cybercrime gang also returned the stolen data (which includes usernames, email addresses, course names, enrollment information, and messages) and provided shred logs confirming its destruction."
  https://www.bleepingcomputer.com/news/security/instructure-reaches-agreement-with-shinyhunters-to-stop-data-leak/
  https://thehackernews.com/2026/05/instructure-reaches-ransom-agreement.html
  https://therecord.media/instructure-pays-ransom-canvas-incident-congress-investigation
  https://www.malwarebytes.com/blog/news/2026/05/stolen-canvas-data-was-returned-after-hacker-agreement-instructure-says
  https://www.securityweek.com/deal-reached-with-hackers-to-delete-data-stolen-from-the-canvas-educational-platform/
• West Pharmaceutical Services Hit By Disruptive Ransomware Attack
  "Pennsylvania pharma giant West Pharmaceutical Services is scrambling to restore systems impacted by a ransomware attack last week. The incident, the company says in an incident notice, occurred on May 4 and prompted the “proactive shutdown and isolation of affected on-premise infrastructure”. The containment measure disrupted the company’s business operations globally, West Pharmaceutical Services said in a Monday filing with the Securities and Exchange Commission (SEC)."
  https://www.securityweek.com/west-pharmaceutical-services-hit-by-disruptive-ransomware-attack/
  https://therecord.media/west-pharmaceutical-warns-of-ransomware-attack-impacting-operations

General News

• April 2026 Threat Trend Report On Ransomware
  "this report summarizes ransomware-related statistics based on Dedicated Leak Sites (DLS) (ransomware PR sites or PR pages) and Quantity of ransomware damaged systems identified during the month of April 2026. it also provides major ransomware issues in Korea and abroad and Damage Trends by Industry/Region."
  https://asec.ahnlab.com/en/93657/
• Cyber Threats Spike In April 2026 As Ransomware Expands And Attack Volumes Climb After Short-Lived Moderation
  "In April 2026, global cyber-attack activity rebounded sharply following the brief moderation observed in March. Organizations experienced an average of 2,201 weekly cyber-attacks, representing a 10% increase month over month and an 8% increase year over year. This reversal underscores the volatility of today’s threat landscape. After three consecutive months of gradual decline, April’s data confirms that the earlier easing was temporary rather than structural. Attackers continue to leverage automation, expanded digital footprints, and exposed cloud and GenAI environments to sustain elevated pressure across industries and regions."
  https://blog.checkpoint.com/research/cyber-threats-spike-in-april-2026-as-ransomware-expands-and-attack-volumes-climb-after-short-lived-moderation/
• State-Sponsored Actors, Better Known As The Friends You Don’t Want
  "Most organizations operate under the assumption that anything residing within their trust boundary is trustworthy. Software arrives from vetted vendors, employees pass background checks, cloud providers hold compliance certifications, and build pipelines produce signed artifacts. In practice, these assumptions are rarely scrutinized, and state-sponsored actors have constructed their operational methodology around exploiting precisely this gap. They operate inside the trust boundary, using trusted tools, holding valid credentials, and performing actions that appear entirely authorized. Conventional security architecture is not designed to identify this, and that limitation warrants acknowledgment before turning to what incident response looks like when the adversary is a state-sponsored."
  https://blog.talosintelligence.com/state-sponsored-actors-better-known-as-the-friends-you-dont-want/
• State Of Ransomware In 2026
  "With International Anti-Ransomware Day taking place on May 12, Kaspersky presents its annual report on the evolving global and regional ransomware cyberthreat landscape. Ransomware remains one of the most persistent and adaptive cyberthreats. In 2026:"
  https://securelist.com/state-of-ransomware-in-2026/119761/
• WannaCry, The Ransomware Attack That Changed The History Of Cybersecurity
  "In memory of the day the digital world was shaken, but learned to fight back. The WannaCry ransomware attack represents one of the most significant events in recent cybersecurity history, not only for its global scale but also for the technical and geopolitical implications it raised. Analyzing its history means understanding how known vulnerabilities, advanced tools, and delays in mitigation can converge into an event capable of disrupting critical infrastructure worldwide."
  https://securityaffairs.com/192015/malware/wannacry-the-ransomware-attack-that-changed-the-history-of-cybersecurity.html
• Is The SOC Obsolete, And We Just Haven’t Admitted It Yet?
  "For decades, the Security Operations Center (SOC) has been the beating heart of enterprise defense. Analysts monitor dashboards, triage alerts, and investigate incidents around the clock. The SOC is often portrayed as the last line of defense—a place where intelligence meets action. And yet, if we are honest, the SOC as we know it is already obsolete. Not because analysts aren’t skilled or diligent, but because the very nature of cyber threats has changed faster than our operational models can keep up."
  https://www.securityweek.com/is-the-soc-obsolete-and-we-just-havent-admitted-it-yet/
• Canvas Hackers ShinyHunters Say Their Official Domain Was Suspended
  "The notorious hacking group ShinyHunters, recently linked to the large-scale compromise and defacement of Instructure’s Canvas LMS platform, claims its official clearnet domain has been suspended by the domain registry, fueling online speculation that the site may have been targeted following the group’s recent attacks. The issue surfaced on Monday, May 11, 2026, when the group’s public-facing domain, shinyhunte[.]rs, suddenly went offline. Soon after, rumors spread across underground forums and social media platforms suggesting the domain may have been seized by law enforcement agencies, including speculation about possible FBI involvement."
  https://hackread.com/canvas-hackers-shinyhunters-official-domain-suspended/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

Vulnerabilities

• New GhostLock Tool Abuses Windows API To Block File Access
  "A security researcher has released a proof-of-concept tool named GhostLock that demonstrates how a legitimate Windows file API can be abused in attacks to block access to files stored locally or on SMB network shares. This technique, created by Kim Dvash of Israel Aerospace Industries, abuses the Windows 'CreateFileW' API and file-sharing modes to prevent other users and applications from opening files while handles remain active. The GhostLock technique abuses the 'dwShareMode' parameter in the CreateFileW() function, which specifies the type of access other processes have to a file while it is opened."
  https://www.bleepingcomputer.com/news/security/new-ghostlock-tool-abuses-windows-api-to-block-file-access/
  https://ghostlock.io/
  https://github.com/kimd155/ghostlock

Malware

• Official CheckMarx Jenkins Package Compromised With Infostealer
  "Checkmarx warned over the weekend that a rogue version of its Jenkins Application Security Testing (AST) plugin had been published on the Jenkins Marketplace. The compromise was claimed by the TeamPCP hacker group, which initiated a spree of supply-chain attacks that included the Shai-Hulud campaigns on npm and the Trivy vulnerability scanner breach, resulting in the delivery of credential-stealing malware. Jenkins is one of the most widely used Continuous Integration/Continuous Deployment (CI/CD) automation solutions for software building, testing, code scanning, application packaging, and deploying updates to servers."
  https://www.bleepingcomputer.com/news/security/official-checkmarx-jenkins-package-compromised-with-infostealer/
  https://thehackernews.com/2026/05/teampcp-compromises-checkmarx-jenkins.html
  https://www.securityweek.com/checkmarx-jenkins-ast-plugin-compromised-in-supply-chain-attack/
  https://www.theregister.com/devops/2026/05/11/checkmarx-tackles-another-teampcp-intrusion-as-jenkins-plugin-sabotaged/5237780
• New TrickMo Variant: Device Take Over Malware Targeting Banking, Fintech, Wallet & Auth Apps
  "Modern Android banking malware increasingly evolves through architectural redesigns intended to improve stealth, resilience, and operational flexibility rather than through entirely new user-facing capabilities. As platform protections and detection measures continue to improve, operators adapt by redesigning communication layers, modularising offensive functionality, and strengthening persistence and remote-control mechanisms."
  https://www.threatfabric.com/blogs/new-trickmo-variant-device-take-over-malware-targeting-banking-fintech-wallet-auth-app
  https://www.bleepingcomputer.com/news/security/trickmo-android-banker-adopts-ton-blockchain-for-covert-comms/
  https://www.infosecurity-magazine.com/news/trickmo-c-ton-network-android/
• Behind a Fake Claude Code Installer
  "Ontinue’s Cyber Defense Center has been observing an ongoing campaign targeting developers through fake installation pages that mimic popular developer tools, including counterfeit Claude Code installers. These lures swap legitimate one-line installers for attacker-controlled commands. Since the beginning of the year, multiple documented cases have highlighted similar fake agent/installer schemes targeting developers. This report details an additional payload stream not documented elsewhere: the same lure with a different payload."
  https://www.ontinue.com/resource/blog-behind-a-fake-claude-code-installer/
  https://www.infosecurity-magazine.com/news/fake-claude-code-installer/
  https://www.theregister.com/security/2026/05/11/cookie-thieves-caught-stealing-dev-secrets/5238248
  Operation HookedWing: 4-Year Multi-Sector Phishing Campaign
  "From 2022 to the present, a persistent phishing campaign that has not been publicly documented until now, referred to in this report as Operation HookedWing, has been compromising organizations across multiple sectors and countries. The SOCRadar Threat Research team has identified that the campaign operates a custom phishing kit which, at the time of publication, has not been attributed to any known threat actor."
  https://socradar.io/blog/operation-hookedwing-4-year-phishing/
  https://www.securityweek.com/over-500-organizations-hit-in-years-long-phishing-campaign/
• Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 For Backdoor Deployment
  "CVE-2026-41940 is a high-severity unauthenticated authentication bypass vulnerability affecting cPanel & WHM. This product is widely used in Linux server operations and virtual hosting management. The vulnerability has a CVSS score as high as 9.8 (Critical). Without providing any account or password, an attacker can remotely bypass authentication and take over the cPanel / WHM control panel, allowing an unauthenticated remote attacker to gain administrator privileges on the affected server."
  https://blog.xlab.qianxin.com/mr_rot13-the-elusive-6-year-hacker-group-weaponizing-critical-cpanel-flaws-for-backdoor-deployment/
  https://thehackernews.com/2026/05/cpanel-cve-2026-41940-under-active.html
• Inside AD CS Escalation: Unpacking Advanced Misuse Techniques And Tools
  "Active Directory Certificate Services (AD CS) is a foundational component of Windows enterprise infrastructure, responsible for managing public key infrastructure (PKI) and issuing certificates that enable authentication and encryption across networks. Despite its critical role in the enterprise identity infrastructure, AD CS is often undermined by insecure default configurations and design complexities, resulting in exploitable attack surfaces. Due to misconfigured templates and overly permissive enrollment rights, AD CS has emerged as a high-impact, under-monitored vector for privilege escalation and unauthorized identity impersonation in modern environments."
  https://origin-unit42.paloaltonetworks.com/active-directory-certificate-services-exploitation/
• OpenClaw’s Hologram: Fake Installer Ships Rust Infostealer
  "Hologram is dropper-delivered via a fake OpenClaw installer, undetected by automated sandboxes. The operator abuses Azure DevOps, Telegram, and Hookdeck as infrastructure—legitimate services inside most enterprise allowlists. While Huntress documented the first wave in February1, this post covers the second wave: six-binary modular implant framework, novel Hookdeck C2 relay, and the first documented use of clroxide in a crimeware campaign: built by the same developer, eleven weeks later. A third wave rotated infrastructure during analysis with some new capabilities."
  https://www.netskope.com/blog/openclaw-hologram-fake-installer-ships-rust-infostealer
• TanStack Npm Packages Compromised In Ongoing Mini Shai-Hulud Supply-Chain Attack
  "The Socket Threat Research team detected a compromise across 84 npm package artifacts in the tanstack namespace. Affected packages were modified to add a suspected credential stealer targeting various CI systems, including Github Actions. All packages were flagged by Socket AI Scanner in six minutes or less after publication. Several of the newly turned malicious packages, like pkg:npm/@tanstack/react-router have over 12 million weekly downloads, and are widely consumed both directly and transitively across the npm ecosystem, making this compromise especially significant from a software supply-chain perspective."
  https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack

Breaches/Hacks/Leaks

• Instructure Confirms Hackers Used Canvas Flaw To Deface Portals
  "Education technology giant Instructure has confirmed that a security vulnerability allowed hackers to modify Canvas login portals and leave an extortion message. BleepingComputer has learned that both the breach and defacements involved multiple cross-site scripting (XSS) vulnerabilities that enabled the attacker to obtain authenticated admin sessions. The second hack was to draw attention and to pressure Instructure into entering negotiations to pay a ransom following an initial breach disclosed a week before. Instructure is the developer of Canvas, a popular learning management system (LMS) used by schools and universities around the world to handle assignments and coursework."
  https://www.bleepingcomputer.com/news/security/instructure-confirms-hackers-used-canvas-flaw-to-deface-portals/
  https://cyberscoop.com/canvas-instructure-data-theft-extortion-the-com/
  https://www.infosecurity-magazine.com/news/shinyhunters-escalates-canvas/
  https://www.securityweek.com/canvas-system-is-online-after-a-cyberattack-disrupted-thousands-of-schools/
  https://www.theregister.com/security/2026/05/12/double-canvas-intrusion-confirmed-as-shinyhunters-resets-leak-deadline/5238361
• Skoda Data Breach Hits Online Shop Customers
  "Automobile manufacturer Skoda has disclosed a data breach impacting the personal information of its online shop’s users. The incident, the company says, was discovered as part of its technical security monitoring and was the result of a vulnerability in the portal’s software. Immediately after learning of the cyberattack, the car maker took the shop offline, patched the exploited vulnerability, reviewed existing security mechanisms, and retained external forensics experts to help with the investigation. It also notified the relevant authorities."
  https://www.securityweek.com/skoda-data-breach-hits-online-shop-customers/
• SailPoint Discloses GitHub Repository Hack
  "Identity management and governance provider SailPoint has disclosed a cybersecurity incident involving its GitHub repositories. In a filing with the Securities and Exchange Commission (SEC), the company revealed that the incident occurred on April 20 and was immediately contained. “On April 20, 2026, we detected unauthorized access to a subset of our GitHub repositories. Our incident response team quickly terminated the unauthorized activity and resolved the issue,” the SEC filing reads."
  https://www.securityweek.com/sailpoint-discloses-github-repository-hack/
  https://securityaffairs.com/191997/data-breach/identity-security-firm-sailpoint-discloses-github-repository-breach.html
• BWH Hotels Guests Warned After Reservation Data Checks Out With Cybercrooks
  "BWH Hotels is informing customers about a third-party data breach that gave cybercriminals access to six months' worth of data. The notification email stated that BWH Hotels, which owns the WorldHotels, Best Western Hotels & Resorts, and Sure Hotels brands, identified the intrusion on April 22, but the affected data goes back to October 14, 2025. BWH Hotels CTO Bill Ryan, who penned the notification email, said names, email addresses, telephone numbers, and/or home addresses belonging to "certain guests" were accessed by an unauthorized third party. The intruders also accessed reservation details, such as reservation numbers, dates of stay, and any special requests."
  https://www.theregister.com/security/2026/05/11/best-western-hotels-confirms-web-app-data-breach/5238020
• Tables Turned: Gentlemen Ransomware Group Suffers Data Leak
  "A ransomware organization is suffering an extreme case of turnabout is fair play through a data breach that splaying internal correspondence across the internet. "The Gentlemen" surfaced as a ransomware-as-a-service organization in mid-2025 with - as SOCRadar has noted - little intention of playing nice. Hints that The Gentlemen suffered a data breach first surfaced on May 4, in a post to cybercrime forum Breached with the subject line "The Gentlemen - hacked data for sale," requested $10,000, payable in bitcoin, "for the full data," with samples available on request. Whether or not someone paid isn't clear, but on Friday, the same user listed a link to file-sharing site MediaFire, for downloading the stolen data for free."
  https://www.bankinfosecurity.com/tables-turned-gentlemen-ransomware-group-suffers-data-leak-a-31654

General News

• April 2026 Dark Web Breach Incident Trend Report
  "the April 2026 Dark Web Breach Incident Trend Report is compiled from data breach cases posted on the deep web and dark web forums. some information is included in cases where it is difficult to fully verify the factuality of the information due to the nature of the source."
  https://asec.ahnlab.com/en/93628/
• April 2026 Dark Web Issue Trend Report
  "the April 2026 Dark Web Issue Trend Report summarizes the Major Issues that occurred on the deep web and dark web. due to the nature of the sources, some of the information is difficult to fully verify."
  https://asec.ahnlab.com/en/93633/
• Dark Web Threat Actor Trend Report, April 2026
  "the April 2026 Dark Web Threat Actor Trend Report summarizes trends in hacktivists and threat actors operating on the deep web and dark web. due to the nature of the sources, some of the information is difficult to fully verify as factual."
  https://asec.ahnlab.com/en/93634/
• Q1 2026 Ransomware Report: Fewer Groups, Higher Impact
  "Ransomware activity remained elevated in Q1 2026, continuing the trend established over the past year. According to the State of Ransomware Q1 2026 report from Check Point Research, overall attack volume stayed near historic highs. At the same time, the structure of the ransomware ecosystem changed materially. After two years of increasing fragmentation, activity is consolidating around a smaller number of dominant groups. For organizations, this shift reduces the number of active actors but increases the potential impact of individual incidents."
  https://blog.checkpoint.com/research/q1-2026-ransomware-report-fewer-groups-higher-impact/
• GTIG AI Threat Tracker: Adversaries Leverage AI For Vulnerability Exploitation, Augmented Operations, And Initial Access
  "Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial workflows. This report, based on insights derived from Mandiant incident response engagements, Gemini, and GTIG’s proactive research, highlights the dual nature of the current threat environment where AI serves as both a sophisticated engine for adversary operations and a high-value target for attacks."
  https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access
  https://thehackernews.com/2026/05/hackers-used-ai-to-develop-first-known.html
  https://www.bleepingcomputer.com/news/security/google-hackers-used-ai-to-develop-zero-day-exploit-for-web-admin-tool/
  https://www.darkreading.com/cloud-security/hackers-ai-exploit-dev-attack-automation
  https://cyberscoop.com/google-threat-intelligence-group-ai-developed-zero-day-exploit/
  https://www.infosecurity-magazine.com/news/hackers-using-ai-zero-day-first/
  https://hackread.com/google-hackers-used-ai-develop-zero-day-exploit/
  https://www.securityweek.com/google-detects-first-ai-generated-zero-day-exploit/
  https://securityaffairs.com/191984/ai/google-warns-artificial-intelligence-is-accelerating-cyberattacks-and-zero-day-exploits.html
• Tech Can't Stop These Threats — Your People Can
  "I begin, as every strong article should, with a caveat: Technical security controls are critically important. Deploy them all — the SOAR playbooks, the SIEM log ingestions, the EDR clients — and use as many as you have budget and time and manpower to use. And, for the love of all that's secure, don't stop tuning them. However, those same technical controls can't stop a growing category of cyberattacks that are specifically engineered to evade or abuse real systems and trusted employees to do their dirty work. For these cases, your best (and sometimes only) defense isn't another dashboard or detection; it's an employee who knows what they're looking at and what they can do to stop it."
  https://www.darkreading.com/cyberattacks-data-breaches/tech-cant-stop-these-threats-people-can

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand