Forum Widgets
Recent Discussions
Tenable Security Intel Brief: wp2shell WordPress attacks underway
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, researchers disclosed wp2shell, a chain of two WordPress core flaws that lets an anonymous attacker run code on a stock install. WordPress pushed fixes to affected sites through forced auto-updates. Two WordPress core bugs chain into code execution with no login → Brief: Researchers disclosed wp2shell, a chain of two WordPress core flaws that lets an anonymous attacker run code on a stock install with no plugins and no login. Intel: CVE-2026-63030 is a flaw in the batch endpoint, a WordPress feature that bundles requests into one call, letting a request run with permissions it should not have. CVE-2026-60137 is a SQL injection that reaches the database. Adam Kues at Searchlight Cyber reported the route bug; a separate team reported the injection. WordPress shipped fixes July 17 through auto-updates; the full chain exists only in 6.9 and 7.0, while the injection alone reaches back to 6.8. Security firms have confirmed active exploitation within days of disclosure, including incident response in several attacks. Why it matters: The fix shipped as open-source code, so researchers reconstructed the flaw from the changed lines and proof-of-concept (PoC) exploits appeared within hours, their speed credited to AI-assisted tooling. Responders are already working confirmed attacks, and the weight is new: all four prior WordPress entries on CISA's KEV catalog were plugins, not Core. SonicWall SMA 1000 zero-days chained to give unauthenticated OS access → Brief: SonicWall disclosed two actively exploited vulnerabilities in its SMA 1000 remote-access appliances, with no available workaround and a federal remediation deadline of July 17. Intel: CVE-2026-15409 carries a CVSS 10.0 rating: it is an SSRF (server-side request forgery) weakness in the SMA 1000 Workplace interface that any unauthenticated remote attacker can reach. CVE-2026-15410 is a CVSS 7.2 code injection weakness inside the Appliance Management Console (AMC); when chained, the two let an attacker run commands on the appliance without logging in. SonicWall PSIRT confirmed "multiple cases indicating the active exploitation." The Cybersecurity and Infrastructure Security Agency (CISA) added both to the Known Exploited Vulnerabilities (KEV) catalog on July 14. No workaround exists. Why it matters: An SMA 1000 concentrates what an intruder otherwise has to earn: VPN session tokens, administrator credentials, and a map of the network behind the gateway. Exploitation was confirmed before any public proof-of-concept existed, and the CVEs drew a federal remediation deadline just three days after they were listed. Sandworm adopts ClickFix to compromise Ukrainian organizations → Brief: Ukraine's CERT confirmed that Sandworm (UAC-0145), a hacking unit tied to Russia's GRU military intelligence, is running ClickFix lures against Ukrainian targets across more than ten compromised websites. Intel: The group's compromised websites display a fake CAPTCHA that tells visitors to copy a PowerShell command and run it on their computer; the command delivers GHETTOVIBE, a VBS file saved to the Startup directory. A reconnaissance tool, SCOUTCURL, then collects system details, programs, files, and browser data so attackers can triage whether the target warrants further compromise. Higher-value systems received FREAKYPOLL, a compiled Python backdoor, and CERT-UA confirmed at least one organization's network was breached (advisory in Ukrainian). Delivery infrastructure uses SMARTAXE, which resolves its domain from a blockchain smart contract, complicating takedown. Why it matters: ClickFix was a crimeware staple, used primarily by financially motivated actors, as Ars Technica notes, "in the last year or so." Sandworm's adoption of it closes the gap between commodity lures and elite state intrusion. The same fake CAPTCHA a security team would file under petty crime can now be a GRU operation. OpenAI's own models escaped a test sandbox and breached Hugging Face → Brief: Hugging Face disclosed a July 16 intrusion into part of its production infrastructure; OpenAI has since confirmed the attacker was its own models, running a benchmark with safety classifiers disabled. Intel: OpenAI's models were running an internal cyber-capabilities benchmark with safety classifiers (guardrails against high-risk cyber activity) disabled. In that state, they exploited a previously unknown flaw in a software-download proxy to escape their sandbox. They then used stolen credentials and more previously unknown flaws to run their own code on Hugging Face's servers, reaching test answers in its production database. Hugging Face says the campaign fired thousands of actions across a swarm of disposable environments and reached a small set of internal datasets and credentials, with no sign user-facing models or Spaces were altered. Why it matters: The frontier AI models Hugging Face tried first refused the attack commands its responders submitted, forcing the forensics onto a model it could run on its own servers. The guardrails that blocked the defenders never touched OpenAI's models: the classifiers were off for the benchmark run. Stat of the week: 97% The share of ransomware victims breached through compromised credentials that had multi-factor authentication (MFA) enabled in some form at the time of the attack, according to the Sophos State of Ransomware 2026 report; deploying MFA and being covered by it are two different things. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Oracle July 2026 Critical Patch Update Addresses 1235 CVEs
On July 21, Oracle released its Critical Patch Update (CPU) for July 2026, the third quarterly update of 2026 and the largest CPU release ever. This CPU contains fixes for 1235 unique CVEs in 1449 security updates across 32 Oracle product families. Out of the 1449 security updates published this quarter, 18% of patches were assigned a critical severity. High severity patches accounted for the bulk of security patches at 52.7%, followed by medium severity patches at 24.7%. For more information about the July 2026 CPU release, including the availability of patches and Tenable product coverage, please visit our blog.
wp2shell (CVE-2026-63030, CVE-2026-60137): FAQs about exploit chain in WordPress Core
On July 17, 2026, WordPress released security updates addressing the wp2shell vulnerabilities alongside two GitHub Security Advisories. Adam Kues of Searchlight Cyber, who discovered and disclosed CVE-2026-63030, published research on the same day and chose to hold back the technical specifics given the severity of the finding. Searchlight Cyber also launched wp2shell.com, a testing tool that allows administrators to check whether their WordPress installation is vulnerable. On July 20, Searchlight Cyber published a full technical breakdown of the attack chain. wp2shell is a two-vulnerability exploit chain affecting WordPress Core. CVE Description CVSSv3 CVE-2026-63030 WordPress Core REST API Batch-Route Confusion Remote Code Execution Vulnerability 9.8 CVE-2026-60137 WordPress Core WP_Query author__not_in SQL Injection Vulnerability 5.9 Hexastrike began observing exploitation attempts in honeypots over the weekend following the July 17 disclosure and has since assisted with incident response in several confirmed attacks. Patchstack has also confirmed in-the-wild exploitation. Other researchers have reported seeing active exploitation in the wild. For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities
On July 14, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an alert confirming active exploitation of three on-premises SharePoint Server vulnerabilities: CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164. The alert noted that these flaws had been used to gain unauthorized access to SharePoint deployments across all supported on-premises versions and flagged two additional high-risk vulnerabilities, CVE-2026-55040 and CVE-2026-58644, as not yet exploited but warranting immediate patching. However in an update to the security advisory on July 15, Microsoft confirmed CVE-2026-58644 has been exploited in the wild. Five Microsoft SharePoint Server vulnerabilities are covered in CISA’s alert: Four with confirmed active exploitation and one newly disclosed high-severity flaw that Microsoft assesses as “Exploitation More Likely” according to Microsoft's Exploitability Index. All five affect all supported on-premises SharePoint Server versions: Subscription Edition, 2019, and 2016. CVE Description CVSSv3 VPR CVE-2026-32201 Microsoft SharePoint Server Spoofing Vulnerability 6.5 7.2 CVE-2026-45659 Microsoft SharePoint Remote Code Execution Vulnerability 8.8 9.4 CVE-2026-56164 Microsoft SharePoint Server Elevation of Privilege Vulnerability 9.8 - NVD 5.3 - Microsoft 9.5 CVE-2026-55040 Microsoft SharePoint Server Security Feature Bypass Vulnerability 9.1 7.3 CVE-2026-58644 Microsoft SharePoint Server Remote Code Execution Vulnerability 9.8 7.9 *Please note: Tenable’s Vulnerability Priority Rating (VPR) scores are calculated nightly. This blog post was published on July 16 and reflects VPR at that time. For more information about these vulnerabilities, including the availability of patches and Tenable product coverage, please visit our FAQ blog.CVE-2026-15409, CVE-2026-15410: SonicWall SMA 1000 zero-day vulnerabilities exploited in the wild
On July 14, SonicWall disclosed two vulnerabilities that are being exploited together in the wild: CVE Description CVSSv3 CVE-2026-15409 SonicWall SMA 1000 server-side request forgery (SSRF) vulnerability 10 CVE-2026-15410 SonicWall SMA 1000 remote code execution vulnerability (RCE) 7.2 While the advisory does not specify if they were exploited in tandem, together they form a fully remote, unauthenticated path to arbitrary OS command execution on affected appliances. CVE-2026-15409 is a SSRF vulnerability affecting the SMA 1000 Workplace interface. This flaw allows a remote, unauthenticated attacker to make network requests to locations of the attacker's choosing. In practice, SSRF on an internet-facing appliance can serve as a pivot, allowing an attacker to probe internal services, relay authentication material, or reach the AMC in a way that bypasses normal access controls. CVE-2026-15410 is a code injection vulnerability in the Appliance Management Console (AMC). The AMC is the administrative interface used to configure the appliance, manage users, set access policies, and monitor sessions. While this flaw does require the user to be authenticated, the potential chaining of these vulnerabilities makes the exploitation path possible without authentication These flaws have been exploited in the wild as zero-days. While SonicWall has not provided any details on attribution of which threat actors may be behind the attacks, several SonicWall vulnerabilities have been targeted in the past, including the exploitation of zero-days. For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.Tenable Security Intel Brief: UAT-7810 builds fresh relay networks
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Cisco Talos details UAT-7810, a China-nexus group whose likely job is standing up the relay networks other espionage crews use to strike their targets, and whose own arsenal now includes a newer version of its SHORTLEASH backdoor plus two previously unknown malware families. China-nexus UAT-7810 builds fresh relay networks with new malware → Brief: Cisco Talos is tracking UAT-7810, an advanced persistent threat (APT) group assessed with high confidence to be China-nexus, and which sustains the LapDogs Operational Relay Box (ORB) network that SecurityScorecard first documented in 2025. Intel: Talos assesses the actor's likely job is to stand up ORB networks, a type of covert network that secondary threat actors like UAT-5918 borrow to strike high-value targets. The actor primarily exploits known vulnerabilities (n-days) in unpatched Ruckus wireless routers (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717), and one server associated with UAT-7810 infrastructure was also used against ASUS AiCloud routers (CVE-2025-2492) in early 2026. Researchers found a newer version of its SHORTLEASH backdoor, tracked as LONGLEASH, plus two previously unknown families, the C-based DOGLEASH and the Java-based JARLEASH, whose configuration file carries comments in Simplified Chinese. Why it matters: Espionage here runs on a division of labor: one crew builds the relay layer, the operators who break in borrow it. LONGLEASH can act as an intermediate command and control (C2), so each compromised edge device becomes another rung of the network. LEASHTEST, a leftover test binary, shows the crew still validating its tooling after shipping LONGLEASH. Microsoft tells customers to expect higher volume of fixes from AI → Brief: Microsoft told Windows customers to expect more fixes in each monthly release as AI accelerates how fast it finds vulnerabilities in its own code. Intel: In a July 9 post, Pavan Davuluri, Microsoft's EVP of Windows and Devices, wrote that "As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release." Driving the increase is a multi-model agentic scanning harness (MDASH) that runs candidate flaws through debate across several AI model families before a separate pipeline strips false positives. Microsoft is also revising its Secure Development Lifecycle (SDL) for AI-enabled attack techniques and applying AI to move flaws through remediation faster, with humans kept in the loop for code review. On Tuesday, Microsoft released its July Patch Tuesday, addressing 569 CVEs, the largest release in Patch Tuesday history and nearly triple the previous record of 198 set in June. We break down the full release in our monthly Patch Tuesday blog. Why it matters: The research itself hasn't changed. The engine finding the flaws has. As the same tooling scales across vendors, the monthly cycle grows heavier by design, and the burden of testing and deploying that rising volume settles on the customers running the software. A vibe-coded script mapped Active Directory in a real breach → Brief: Huntress recovered a PowerShell script (a Windows scripting tool) that an attacker used during a June 3 intrusion to map an Active Directory (AD) environment, and its contents show it was built through "vibe coding," prompting AI in natural language until the output works. Intel: The attacker gained remote desktop protocol (RDP) access using pre-compromised credentials, staged tools in C:\ProgramData, a Windows system folder, then ran the script before using legitimate binaries to exfiltrate data. Huntress rebuilt it from telemetry and found the AI's fingerprints: a title reading "100% Working AD Information Gathering Script - FULLY FIXED," an unedited example server name the operator never replaced, five redundant ways to locate a domain controller, and an auto-generated HTML report summarizing the theft. Why it matters: Vibe coding puts bespoke, single-use tooling in the hands of a mediocre actor, and no two of its scripts look alike. What does not change is the tradecraft: the Active Directory enumeration underneath behaves the same way on the operating system no matter who prompted it, and that behavior is what detection can still read. Iran-nexus Cavern Manticore hides its C2 across three .NET formats → Brief: Check Point Research uncovered an Iran-nexus advanced persistent threat (APT) group it tracks as Cavern Manticore, running a modular C2 framework against Israeli government and IT-sector organizations. Intel: Already inside its targets, the group abuses a legitimate software-deployment feature, in one case SysAid's update mechanism, to drop a malicious dynamic link library (DLL) beside a trusted program (WinDirStat) that loads it and launches the Cavern backdoor. Its standout move is architectural: one .NET framework built three separate ways, forcing analysts into a different set of analysis tools for each component, while most samples evade nearly all antivirus detection. Check Point links the group to Iran's Ministry of Intelligence and Security (MOIS) and notes technical overlaps with MuddyWater and Lyceum, a subgroup of OilRig. Why it matters: None of this needed a new exploit. The intrusion runs on the target's own trusted software and on ordinary .NET compilation choices, and each module unloads itself from memory after it runs, leaving little on disk to scan. The near-invisibility is assembled almost entirely from legitimate parts. Stat of the week: 5,811 The number of arrests across 97 countries in Operation First Light 2026, a crackdown on social engineering scams and money laundering that also intercepted USD 293 million in illicit assets, according to Interpol. Tenable’s RSO serves as Tenable’s Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Microsoft’s July 2026 Patch Tuesday Addresses 569 CVEs
On July 7, Microsoft released its July 2026 Patch Tuesday release, the largest Patch Tuesday release to date. This update patched 569 CVEs with 56 rated critical, 510 rated as important and 3 rated as moderate. This month's update included fixes for three zero-days, two of which were exploited in the wild. CVE-2026-56155 is an elevation of privilege vulnerability affecting Active Directory Federation Services. It received a CVSSv3 score of 7.8 and is rated important. Microsoft notes that this flaw was exploited in the wild as a zero-day and is credited to researchers with the Microsoft Detection and Response Team (DART). Successful exploitation would allow an attacker to gain administrator privileges. CVE-2026-56164 is an elevation of privilege vulnerability in Microsoft SharePoint Server. It received a CVSSv3 score of 5.3 and is rated moderate. According to Microsoft, it was exploited in the wild as a zero-day. CVE-2026-50661 is a security feature bypass vulnerability affecting Windows BitLocker. It received a CVSSv3 score of 6.1 and is rated as important. It was publicly disclosed prior to a patch being available and assessed as “Exploitation Less Likely” according to Microsoft's Exploitability Index. While an exploit is public, the advisory notes that exploitation requires physical access to the target device. This month’s update includes patches for: .NET .NET Core .NET Framework ASP.NET Core Active Directory Certificate Services (AD CS) Active Directory Domain Services Active Directory Federation Services (AD FS) Azure Active Directory Azure CycleCloud Azure Monitor Agent Azure Spring Apps Code Integrity DLL (ci.dll) Composite Image File System Driver Content Delivery Manager Desktop Window Manager Extensible Storage Engine (ESENT) GitHub Copilot and Visual Studio GitHub Copilot and Visual Studio Code Github Copilot HTTP/2 Microsoft 365 Copilot for iOS Microsoft Bing App for IOS Microsoft Copilot Microsoft Defender Microsoft Defender for Endpoint Microsoft Dynamics NAV Microsoft Edge for Android Microsoft Exchange Server Microsoft Fabric Data Warehouse Microsoft Graphics Component Microsoft Input Method Editor (IME) Microsoft Install Service Microsoft NAT Helper Components (ipnathlp.dll) Microsoft Office Microsoft Office Excel Microsoft Office OneNote Microsoft Office PowerPoint Microsoft Office SharePoint Microsoft Office Word Microsoft Printer Drivers Microsoft Surface Microsoft Windows Microsoft Windows App Store Microsoft Windows Codecs Library Microsoft Windows Media Foundation Microsoft Windows Search Component Microsoft Windows Speech Microsoft XML Microsoft XML Core Services Minecraft Bedrock Dedicated Server Outlook Copilot Power BI Quality Windows Audio/Video Experience (QWAVE) service RPC Runtime Reliable Multicast Transport Driver (RMCAST) Remote Desktop Client Role: DNS Server SQL Server SQL Server ODBC driver Universal Plug and Play (upnp.dll) Virtual Hard Disk (VHD) Miniport Driver Visual Studio Visual Studio Code Window PC Manager Windows Active Directory Windows Admin Center Windows Ancillary Function Driver for WinSock Windows App Installer Windows AppX Deployment Service Windows Application Model Windows Audio Compression Manager (ACM) Windows Audio Service Windows Backup Engine Windows BitLocker Windows Bluetooth Port Driver Windows Bluetooth Service Windows Boot Loader Windows Brokering File System Windows Client-Side Caching (CSC) Service Windows Clip Service Windows Clipboard Server Windows Clipboard User Service Windows Cloud Files Mini Filter Driver Windows Common Log File System Driver Windows Connected User Experiences and Telemetry Windows Container Isolation FS Filter Driver (unionfs.sys) Windows CryptoAPI Windows Cryptographic Services Windows DHCP Client Windows DHCP Server Windows DNS Windows DWM Windows DWM Core Library Windows Data.dll Windows Devices Human Interface Windows DirectX Windows Domain Controller Windows Event Logging Service Windows FTP Service Windows File Explorer Windows File History Service Windows Filtering Platform (WFP) Windows GDI Windows GDI+ Windows Graphics Kernel Windows Group Policy Windows HTTP.sys Windows Hyper-V Windows Image Acquisition Windows Installer Windows Internal System User Profile Windows Internal Task Bar Windows Internet Key Exchange (IKE) Protocol Windows Kernel Windows Kernel Mode Driver Windows Kernel-Mode Drivers Windows Key Guard Windows LUAFV Windows Local Security Authority Subsystem Service (LSASS) Windows MIDI Service Module Windows Management Services Windows Media Windows Message Queuing Windows Message Queuing Queue Manager Windows NTFS Windows Narrator Braille Windows Netlogon Windows Network Address Translation (NAT) Windows Network File System Windows Network Policy Server SNMP Windows Notification Windows OLE Windows Operating Systems Windows Overlay Filter Windows PowerShell Windows Presentation Foundation (WPF) Windows Print Spooler Components Windows Projected File System Windows Push Notifications Windows Quality of Service (QoS) Packet Scheduler Windows RDP Windows RPC API Windows Redirected Drive Buffering Windows Remote Access Connection Manager Windows Remote Access Service Infrastructure Windows Remote Desktop Protocol Windows Remote Desktop Services Windows Remote Help Defense Windows Resilient File System (ReFS) Windows Routing and Remote Access Service (RRAS) Windows Runtime Windows SMB Windows SMB Server Windows SMB Server Network Transport Driver (srvnet.sys) Windows Schannel Windows Secure Boot Windows Secure Kernel Mode Windows Secure Socket Tunneling Protocol (SSTP) Windows Sensor Data Service Windows Server Windows Server Backup Windows Server Network driver Windows Server Update Service Windows Spaceport.sys Windows StateRepository API Windows Storage Windows Storage Spaces Direct Windows Subsystem for Linux Windows System Windows TCP/IP Windows Telephony Service Windows Terminal Windows Trusted Runtime Interface Driver Windows USB Audio Class driver (usbaudio.sys) Windows USB Driver Windows USB Hub Driver Windows USB Print Driver Windows USB Video Driver Windows Unified Consent System Windows Universal Disk Format File System Driver (UDFS) Windows User Interface Core Windows VMSwitch Windows Virtual Filtering Platform (VFP) Windows WalletService Windows Web Proxy Auto-Discovery Protocol (WPAD) Windows WebView Windows Win32K Windows Win32K - GRFX Windows Wireless Networking Windows Wireless Wide Area Network Service For more information, please visit our blog.Microsoft’s June 2026 Patch Tuesday Addresses 198 CVEs
On June 9, Microsoft released its June 2026 Patch Tuesday release which patched 198 CVEs with 32 rated as critical and 166 rated as important. This month's updates included three zero-days that were publicly disclosed prior to patches being made available. This Patch Tuesday release is the largest release since the Patch Tuesday program began, smashing the previous record of 167 CVEs in the October 2025 Patch Tuesday release. One of the zero-days is CVE-2026-50507, a security feature bypass vulnerability affecting Windows BitLocker. It received a CVSSv3 score of 6.8 and is rated as important. According to Microsoft, an attacker with physical access to the system could bypass the BitLocker Device Encryption feature in order to gain access to the device's encrypted data. This vulnerability appears to be the flaw known as Bitskrieg and a collaboration between Chaotic Eclipse (Nightmare Eclipse) and Jonas L. Chaotic Eclipse or Nightmare Eclipse has published several additional zero-days recently, including BlueHammer (CVE-2026-33825), GreenPlasma, MiniPlasma and YellowKey (CVE-2026-45585). This month’s update includes patches for: .NET ASP.NET Core Active Directory Domain Services Azure HorizonDB Azure Stack Edge Copilot Chat (Microsoft Edge) Function Discovery Service (fdwsd.dll) GitHub Copilot and Visual Studio Code HTTP/2 Linux MANA Driver M365 Copilot Microsoft Azure Attestation service and Device Health Attestation Service Microsoft Azure Kubernetes Service Microsoft Bing Microsoft Copilot Microsoft Defender for Endpoint Microsoft Dynamics 365 (on-premises) Microsoft Exchange Online Microsoft Exchange Server Microsoft Graph Microsoft Graphics Component Microsoft Kinect Microsoft Live Share Canvas SDK Microsoft Office Microsoft Office Click-To-Run Microsoft Office Excel Microsoft Office Project Microsoft Office SharePoint Microsoft Office Word Microsoft PC Manager Microsoft PowerToys Microsoft Teams for Android Microsoft UxTheme Library (uxtheme.dll) Microsoft Windows DNS Nuance PowerScribe Office for Android Remote Desktop Client Role: Windows Hyper-V UI Automation Manager (uiamanager.dll) Universal Plug and Play (upnp.dll) Visual Studio Code Windows Administrator Protection Windows Ancillary Function Driver for WinSock Windows Application Identity (AppID) Subsystem Windows BitLocker Windows Bluetooth Port Driver Windows Bluetooth Service Windows Boot Manager Windows Collaborative Translation Framework Windows Common Log File System Driver Windows Cryptographic Services Windows DHCP Client Windows DHCP Server Windows DWM Core Library Windows Deployment Services Windows HTTP.sys Windows Hotpatch Monitoring Service Windows Hyper-V Windows Internet (wininet.dll) Windows Kerberos Windows Kernel Windows Kernel-Mode Drivers Windows Mark of the Web (MOTW) Windows Media Windows NT OS Kernel Windows NTFS Windows Narrator Braille Windows Network Controller (NC) Host Agent Windows Performance Monitor Windows Program Compatibility Assistant Service Windows Projected File System Filter Driver Windows Push Notifications Windows RDP Windows SDK Windows Secure Boot Windows Shell Windows Storage Windows TCP/IP Windows Telephony Service Windows UEFI Windows Universal Disk Format File System Driver (UDFS) Windows Win32K - GRFX Winlogon For more information, please visit our blog.Oracle May 2026 Critical Security Patch Update Addresses 35 CVEs
On May 28, Oracle released its Critical Security Patch Update (CSPU) for May 2026. This CSPU contains fixes for 35 unique CVEs in 35 security updates across 5 Oracle product families. Out of the 35 security updates published, 31.4% of patches were assigned a critical severity. High severity patches accounted for the bulk of security patches at 51.4%, followed by critical severity patches at 31.4%. For more information about the May 2026 CSPU release, including the availability of patches and Tenable product coverage, please visit our blog.Mini Shai-Hulud: Frequently asked questions about the TeamPCP supply chain campaign
Between September 2025 and May 2026, a threat group tracked as TeamPCP has conducted a series of coordinated supply chain attacks across the npm and PyPI package ecosystems. The campaign, which the group calls Shai-Hulud, uses a self-propagating worm that steals developer and cloud credentials, then leverages those credentials to publish poisoned versions of additional packages. Each compromised continuous integration and continuous deployment (CI/CD) pipeline becomes a new distribution vector, enabling exponential spread. The current iteration is known as Mini Shai-Hulud. Tenable’s Research Special Operations Team (RSO) has compiled an FAQ blog to discuss what Mini Shai-Hulud is, how the campaign operates, who has been affected and what organizations should do to protect their software supply chains. For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.