Comparing 30 May 2026 with the previous day 23 May 2026.
An actively exploited authentication bypass in PAN-OS GlobalProtect enables unauthorized VPN access; while Palo Alto is not in Joel Traber's stated stack, any manufacturing company using Palo Alto firewalls for remote access must treat this as an immediate remediation priority.
Russian intelligence services are establishing shell companies and recruiting intermediaries to systematically acquire Western manufacturing equipment, machine tools, and dual-use technology,a direct threat to European industrial enterprises and their supply chains.
Active campaign using dependency confusion against developer environments: threat actors with Russian email addresses register spoofed scoped npm packages mimicking internal corporate namespaces to deploy reconnaissance payloads.
UNC6671 uses vishing and adversary-in-the-middle techniques to bypass MFA, compromise Microsoft 365 and Okta, and exfiltrate data for extortion; the recent shutdown of their data leak site may signal a rebranding rather than cessation of operations.
No changes in this category.
No changes in this category.
BRICKSTORM operates below the guest OS layer on the virtualization plane where EDR agents are ineffective and traditional security controls historically lag , a critical visibility gap for most organizations.
State-backed North Korean threat actor compromised axios npm packages with malicious dependency and deployed multi-platform backdoor; active supply-chain campaign relevant to software development and industrial control system environments.
Chinese APT group UNC2814 operates the GRIDTIDE campaign against telecommunications and government organizations across 42 countries with focus on international infrastructure; Google and Mandiant have initiated disruption operations.
Sophisticated APT groups like UNC6201 and UNC5807 optimize for extreme persistence by targeting edge devices (VPNs, routers) lacking EDR telemetry; exploitation occurs on average 7 days before patch availability, with custom malware deployed directly to network appliances.
Destructive cyberattacks are deliberately employed by state actors as a cost-effective weapon during conflicts; organizations should prioritize proactive hardening measures against wipers and destructive malware.
A Pwn2Own-winning vulnerability enables unauthenticated remote code execution on Canon printers across the network with high CVSS 8.8 severity.
Network-accessible Canon multifunction printers can be abused for unauthenticated remote code execution; this attack surface is frequently overlooked.
An integer-overflow vulnerability in ESXi's VMXNET3 driver enables local privilege escalation from high-privileged guest processes with CVSS 8.2; a ZDI/Pwn2Own finding indicates robust exploitation potential.
Pwn2Own demonstration of VMware ESXi exploitation reveals real privilege-escalation risks in critical virtualization infrastructure.
The vulnerability enables a protocol downgrade attack on Ubiquiti AI Pro Discovery without authentication, presenting a network entry point for network-adjacent attackers.
Local attackers with code execution can escalate to system privileges (CVSS 7.8); patches required for Windows Server 2022/2019.
A local privilege escalation vulnerability in Windows with high CVSS requires prior code execution but increases the risk of insider threats or post-compromise exploitation in the enterprise environment.
A local privilege escalation in Windows cdd with high CVSS score (8.8) requires prior code execution but poses significant risk for already-compromised systems.
A 0-day vulnerability in Microsoft Azure MCP with CVSS 9.8 enables unauthenticated remote code execution, threatening cloud identity and collaboration infrastructure across all Azure-dependent organizations.
This CVE was published in 2022; the ZDI disclosure is a post-embargo publication following Pwn2Own , patch status should be verified.