Signals

Recent public signals

Crawlable detail links for recent public signal pages.

• Microsoft disrupts Fox Tempest malware-signing service aiding ransomware distribution

  Microsoft's Digital Crimes Unit has dismantled Fox Tempest, a financially motivated threat actor operating a malware-signing-as-a-service platform since May 2025.

• Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare

  Drupal says attackers may develop an exploit for the vulnerability within hours or days. The post Drupal to Patch Highly Critical Vulnerability at Risk of Quick Exploitation appeared first on SecurityWeek .

• Mini Shai-Hulud malware resurfaces in npm supply chain attack on AntV packages

  The Mini Shai-Hulud malware campaign has reemerged, compromising over 300 npm packages in the AntV data visualization ecosystem through a compromised maintainer account.

• DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability

  Patched in April, the underlying vulnerability allows local attackers to elevate their privileges to root. The post PoC Released for DirtyDecrypt Linux Kernel Vulnerability appeared first on SecurityWeek .

• Legacy Microsoft utility mshta exploited in rising malware campaigns

  Coverage discusses speculative scenarios; treat as market chatter and see linked sources.

• AI boosts vulnerability reporting but challenges bug bounty programs with noise

  The adoption of AI models like Anthropic’s Mythos and OpenAI’s Daybreak has significantly increased vulnerability reports submitted to bug bounty programs, including major platforms like GitHub.

• The New Phishing Click: How OAuth Consent Bypasses MFA

  In February 2026, a phishing-as-a-service (PhaaS) platform called EvilTokens went live. Within five weeks, it had compromised more than 340 Microsoft 365 organizations across five countries.

• USN-8275-1: Linux kernel (Xilinx ZynqMP) vulnerabilities

  AUSCERT External Security Bulletin Redistribution ESB-2026.5355 jq security update 19 May 2026 =========================================================================== AUSCERT Security Bulletin Summary --------------------------------- Product: jq Publisher: Red Hat Operating System: Red Hat Resolution...

• Grafana Labs confirms source code theft after GitHub breach, refuses ransom

  Grafana Labs disclosed a security breach involving their GitHub environment where hackers stole their source code by exploiting a compromised token. The company confirmed the incident publicly and stated they will not pay the ransom demanded by the attackers.

• Mini Shai-Hulud campaign compromises over 300 AntV npm packages via maintainer account

  A recent software supply chain attack under the Mini Shai-Hulud campaign targeted the AntV npm ecosystem by compromising a maintainer account. This enabled attackers to push over 300 malicious package versions automatically, affecting hundreds of packages including popular ones like echarts-for-react. The incident underscores the dangers of supply chain attacks on trusted software components and the critical importance of swift incident response to mitigate widespread impact.

• Windows 11 May security update fails on devices with low EFI partition space

  Microsoft's May 2026 security update for Windows 11 (KB5089549) fails to install on devices with 10 MB or less free space on the EFI System Partition (ESP). The installation proceeds initially but fails during reboot at about 35-36% completion, leaving systems unpatched and vulnerable.

• Windows 11 security update KB5089549 fails to install due to low EFI partition space

  Microsoft's May 2026 Windows 11 security update KB5089549 encounters installation failures on devices with limited EFI System Partition space, typically 10 MB or less. The error manifests as 0x800f0922 or an "Undoing changes" message during reboot, preventing the update from completing and leaving systems exposed to security risks. Microsoft has confirmed the problem and provided interim workarounds, highlighting the importance of sufficient EFI partition space for patch deployment.