2026-05-21: Microsoft patched two actively exploited Defender zero-days that CISA added to KEV with a June 3

Show Notes - 2026-05-21

Stories Covered

• 2026-05-21
• Today:
• Microsoft Defender Zero-Days (CVE-2026-41091, CVE-2026-45498) [Critical Alerts]
• RaaS Ecosystem Tradecraft Analysis [Ransomware & Extortion]
• Microsoft Disrupts Fox Tempest Malware-Signing Service [Ransomware & Extortion]
• Mini Shai-Hulud npm Supply Chain Attack [IOCs & Detection]
• SonicWall VPN MFA Bypass via CVE-2024-12802 [Business & Infrastructure Threats]
• TamperedChef Trojanized Productivity Software [Business & Infrastructure Threats]
• Typosquatting Embedded in Third-Party Scripts [Business & Infrastructure Threats]
• AI Coding Agents and Credential Leakage [Business & Infrastructure Threats]
• CISA Exposed GitHub Repo with Secrets [Business & Infrastructure Threats]
• 9-Year-Old Linux Kernel Privilege Escalation (CVE-2026-46333) [Windows / AD Security]
• PinTheft Linux Privilege Escalation (Arch Linux) [Windows / AD Security]
• Identity and Device Security Integration [General Security News]
• Supply Chain Vulnerability Crisis [General Security News]
• Drupal Core SQL Injection (CVE-2026-9082) [Vulnerability Disclosures]
• Memcached SASL Timing Side Channel (CVE-2026-47784) [Vulnerability Disclosures]
• DNS Software Vulnerabilities (Multiple CVEs) [Vulnerability Disclosures]
• Rsync Vulnerabilities (CVE-2026-43617, CVE-2026-43618, CVE-2026-43619, CVE-2026-43620, CVE-2026-29518, CVE-2026-45232) [Vulnerability Disclosures]
• GitHub CLI Terminal Escape Sequence Injection (CVE-2026-45803) [Vulnerability Disclosures]
• Cowboy SPDY Decompression Bomb (CVE-2026-43970) [Vulnerability Disclosures]
• WebSocket Uninitialized Memory Disclosure (CVE-2026-45736) [Vulnerability Disclosures]

CVEs Referenced

CVE-2008-4250, CVE-2009-1537, CVE-2009-3459, CVE-2010-0249, CVE-2010-0806, CVE-2024-12802, CVE-2026-29518, CVE-2026-32792, CVE-2026-33278, CVE-2026-40622, CVE-2026-41091, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42944, CVE-2026-42959, CVE-2026-42960, CVE-2026-43617, CVE-2026-43618, CVE-2026-43619, CVE-2026-43620, CVE-2026-43970, CVE-2026-44390, CVE-2026-44608, CVE-2026-45232, CVE-2026-45498, CVE-2026-45736, CVE-2026-45803, CVE-2026-46333, CVE-2026-47784, CVE-2026-9082

Read the full brief