Archived issue·05-22-2026

verified 12w ago

The Perimeter · Issue 05-22-2026

Cisco SD-WAN, PAN-OS captive portal, and a TanStack supply-chain worm

Two critical perimeter bugs are being exploited right now: CISA issued Emergency Directive 26-03 ordering federal agencies to patch Cisco Catalyst SD-WAN Manager/Controller (CVE-2026-20182) by Sunday, and Palo Alto's PAN-OS captive portal zero-day (CVE-2026-0300) is under active exploitation with patches just now landing. Both are unauthenticated, both give attackers full control of the device. The supply chain had its worst week of 2026 so far. The 'Mini Shai-Hulud' worm compromised 84 npm artifacts across TanStack, Mistral, and others using a GitHub Actions Pwn Request chained to OIDC token theft — and produced valid SLSA Level 3 attestations on the malicious builds. OpenAI told macOS users to update. Separately, node-ipc was hit again. On the WordPress side, Breeze Cache (400K installs) is being actively exploited, Slider Revolution 7 ships an authenticated RCE, and Avada Builder (1M installs) has an arbitrary file read plus SQLi. This week, recalculate trust in your build provenance: SLSA attestations are no longer sufficient evidence that a package is clean, and any team running ingress-adjacent Cisco or Palo Alto kit should treat patch windows as hours, not days.

Published: Friday, May 22, 2026
Entries: 12
Cadence: Weekly · Sundays
Curator: Brad Anderson

Wire

cisa.govNew addition to the Known Exploited Vulnerabilities catalog·

github.comGHSA: critical npm package compromise affecting CI pipelines·

wordfence.comWordPress plugin vulnerability with active exploitation·

drupal.orgHighly critical core security advisory published·

aws.amazon.comAWS security bulletin: IAM policy evaluation update·

unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·

krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·

snyk.ioComposer dependency advisory affecting production framework versions·

cisa.govNew addition to the Known Exploited Vulnerabilities catalog·

github.comGHSA: critical npm package compromise affecting CI pipelines·

wordfence.comWordPress plugin vulnerability with active exploitation·

drupal.orgHighly critical core security advisory published·

aws.amazon.comAWS security bulletin: IAM policy evaluation update·

unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·

krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·

snyk.ioComposer dependency advisory affecting production framework versions·

Web Application

frameworks · browsers · authentication flows

1 entry

github.com3moCVSS 8.1

FrankenPHP: Unicode path-splitting flaw lets non-PHP files execute as PHP (CVE-2026-45062)

FrankenPHP's splitPos() in cgi.go misuses golang.org/x/text/search with IgnoreCase when request paths contain non-ASCII bytes, letting an attacker make FrankenPHP treat a non-.php file as a PHP script. Where attackers can place file content via uploads or object storage, this escalates to RCE. CVSS 8.1.

CVE-2026-45062FrankenPHP

Fruition take

If you've adopted FrankenPHP for any Laravel/Symfony container — particularly with user uploads served from the document root — patch immediately and audit upload paths for any extension allowlist gaps.

Supply Chain

packages · build systems · dependency attacks

2 entries

snyk.io3mo

▲ headline

Mini Shai-Hulud worm compromises 84 npm artifacts across TanStack, Mistral, and others — first attack with valid SLSA L3 attestations

Snyk reports a worm chained a GitHub Actions 'Pwn Request,' cache poisoning, and OIDC token extraction from runner memory to publish 84 malicious artifacts across 42 @tanstack/* packages plus @squawk/* and @mistralai/*. The malicious builds carry valid SLSA Build Level 3 attestations, the first npm supply-chain attack to do so. OpenAI told macOS users to update affected dependencies.

@tanstack/* npm packages@mistralai/* npm packages@squawk/* npm packagesGitHub Actions OIDC

Fruition take

Audit lockfiles for @tanstack/*, @mistralai/*, and @squawk/* installs from the May 11–14 window; pin to known-good versions and rotate any npm/GitHub tokens used by CI in that period. SLSA attestations alone no longer prove a package is clean — your CI's OIDC trust boundary is now part of the supply chain.

github.com3moCVSS 9.8

vm2 sandbox escape via async generator (CVE-2026-45411, CVSS 9.8)

A new sandbox breakout in vm2 lets attacker code escape the sandbox and execute arbitrary commands on the host by catching host exceptions through yield* inside an async generator. CVSS 9.8. vm2 has been deprecated for over a year, but the package still pulls ~3M weekly npm downloads through transitive dependencies.

CVE-2026-45411vm2

Fruition take

If anything in your dependency graph still resolves vm2, treat it as remote code execution: vm2 3.11.3 patches this escape, but the package is deprecated and has a long history of sandbox breakouts, so use 3.11.3 only as a stopgap while you migrate to isolated-vm. Run `npm ls vm2` across services this week.

Infrastructure

kubernetes · cloud · network · ingress

1 entry

unit42.paloaltonetworks.com3moCVSS 7.8

'Copy Fail' (CVE-2026-31431) Linux kernel LPE: stealthy root across millions of hosts

Unit 42 details CVE-2026-31431, a high-severity Linux kernel local privilege escalation enabling stealthy root access. Cloudflare separately published its detection and mitigation response, confirming no malicious exploitation on its fleet. Patch availability varies by distribution; container hosts and shared-tenant nodes are the priority targets.

CVE-2026-31431Linux kernel

Fruition take

For Kubernetes operators: patch worker node kernels on the next maintenance window and confirm seccomp/AppArmor profiles are actually enforced on workloads — Copy Fail is the kind of LPE that turns a container escape from a research curiosity into one-shot root.

PHP & CMS

wordpress · drupal · plugins · php frameworks

4 entries

wordfence.com3mo

Burst Statistics (200K WordPress sites): critical authentication bypass

Wordfence's PRISM research platform found a critical authentication bypass in Burst Statistics, installed on 200,000+ WordPress sites. Disclosed May 8; patched version available. Combined with the Breeze and Avada disclosures, three high-impact WordPress plugin advisories landed this week.

Burst Statistics WordPress plugin

Fruition take

Burst is often left enabled on sites that no longer actively use it for analytics — sweep client estates for stale activations and either update or deactivate.

wordfence.com3mo

Avada Builder (1M installs): arbitrary file read and SQL injection

Wordfence disclosed an Arbitrary File Read and an SQL Injection in Avada Builder, used on roughly 1,000,000 WordPress sites. Both flaws allow data disclosure including credentials and database contents. Patched versions are available; no in-the-wild exploitation reported yet but disclosure on a million-site plugin draws attention fast.

Avada Builder WordPress plugin

Fruition take

Avada is shipped on most premium Avada theme installs — push the Builder update to all managed sites this week, not next sprint, before exploit code circulates.

wordfence.com3mo

Slider Revolution 7 patches authenticated arbitrary file upload to RCE

Slider Revolution patched an authenticated arbitrary file upload reachable by subscriber-level users, enabling RCE. While the plugin reports 5M+ installs, only the ~45,000 sites on 7.0+ are affected — the bug was introduced in the 7.x rewrite. Reported April 18; patch available.

Slider Revolution WordPress plugin

Fruition take

Check if any client site runs Slider Revolution 7.x with open registration enabled — that combination is the immediate exposure. On older 6.x installs you can defer, but plan the 7.x upgrade path.

wordfence.com3mo

Breeze Cache (400K WordPress sites) under mass exploitation for unauthenticated RCE

Wordfence disclosed a critical Arbitrary File Upload in Breeze Cache (~400,000 active installs) on April 22; exploitation began the same day. The flaw lets unauthenticated attackers upload PHP backdoors. Wordfence has blocked 30,000+ exploit attempts. A patched version shipped April 21.

Breeze Cache WordPress plugin

Fruition take

If any managed WordPress site has Breeze installed, confirm it's on the patched build and grep wp-content/uploads for recent .php drops — same-day exploitation means many sites were hit before site owners patched. Add Breeze to your standard WAF virtual-patch list for client estates.

Identity & Auth

oauth · saml · iam · session attacks

1 entry

cloud.google.com3mo

Mandiant: UNC6671 'BlackFile' uses vishing + AiTM to bypass MFA on M365 and Okta

Google Threat Intelligence Group tracks UNC6671 ('BlackFile') running an extortion operation that combines voice phishing with adversary-in-the-middle SSO compromise against Microsoft 365 and Okta. Once inside, operators run Python and PowerShell to programmatically exfiltrate data. AiTM bypasses traditional MFA — phishing-resistant factors are the only durable defense.

Microsoft 365Okta

Fruition take

If your Auth0 or Okta tenants still allow push or TOTP as a primary factor for admins, this is the campaign to cite when forcing the move to WebAuthn/passkeys. Audit conditional-access policies for any 'trusted location' loophole that AiTM proxies can ride through.

Threat Intel

active exploitation · breaches · ransomware

3 entries

nvd.nist.gov3moKEVCVSS 10.0

▲ headline

CISA Emergency Directive 26-03: Cisco Catalyst SD-WAN auth bypass (CVE-2026-20182) under active exploitation

CISA added CVE-2026-20182 to KEV and issued Emergency Directive 26-03 requiring federal agencies to patch by Sunday. The flaw lets an unauthenticated remote attacker bypass authentication and gain admin on Cisco Catalyst SD-WAN Manager and Controller. Cisco shipped fixes Thursday; exploitation is observed in the wild. This is the second CVSS 10.0 Cisco network-control bug exploited this year.

CVE-2026-20182Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Controller

Fruition take

If you run Catalyst SD-WAN Manager or Controller anywhere in your edge path, patch this weekend and audit admin accounts and recent config pushes — pre-patch exploitation has been confirmed. Treat any SD-WAN management plane reachable from the internet as compromised until you've reviewed access logs.

nvd.nist.gov3moKEV

Microsoft Exchange OWA XSS (CVE-2026-42897) added to CISA KEV

CISA added CVE-2026-42897, a cross-site scripting flaw in Outlook Web Access during web page generation, to the Known Exploited Vulnerabilities catalog. Under specific interaction conditions, arbitrary JavaScript runs in the user's browser context. Federal agencies must apply mitigations per BOD 22-01.

CVE-2026-42897Microsoft Exchange ServerOutlook Web Access

Fruition take

Any Exchange Server with internet-facing OWA needs the patch this cycle — XSS in OWA is consistently weaponized for session theft against admin accounts.

nvd.nist.gov3moKEVCVSS 9.3

PAN-OS captive portal zero-day (CVE-2026-0300) actively exploited for unauthenticated RCE as root

Unit 42 confirms in-the-wild exploitation of an out-of-bounds write in the PAN-OS User-ID Authentication Portal (Captive Portal) allowing unauthenticated RCE as root on PA-Series and VM-Series firewalls. Added to CISA KEV May 6; Palo Alto released patches May 13. Workaround: restrict Captive Portal to trusted zones or disable it.

CVE-2026-0300Palo Alto Networks PAN-OSPA-Series firewallsVM-Series firewalls

Fruition take

If any PAN-OS device exposes the User-ID Authentication Portal to untrusted networks, patch now or disable the portal — root RCE is being exploited. Pull packet captures and review GlobalProtect/User-ID logs for the IoCs in Unit 42's brief before assuming clean.