Security Affairs newsletter Round 577 by Pierluigi Paganini – INTERNATIONAL EDITION


Security Affairs newsletter Round 577 by Pierluigi Paganini – INTERNATIONAL EDITION

Pierluigi Paganini
May 17, 2026

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

Attackers exploit Funnel Builder bug to inject e-skimmers into e-stores
Pwn2Own Berlin 2026, Day Three: DEVCORE Crowned Master of Pwn, $1.298 Million Total
U.S. CISA adds a flaw in Microsoft Exchange Server to its Known Exploited Vulnerabilities catalog
Russian APT Turla builds long-term access tool with Kazuar Botnet evolution
OpenAI hit by supply chain attack linked to malicious TanStack packages
Pwn2Own Berlin 2026, Day Two: $385,750 more, Microsoft Exchange falls, and the running total crosses $900K
CVE-2026-42897: Microsoft confirms active exploitation of Exchange Server zero-day
Ghostwriter group resumes attacks on Ukrainian Government targets
Researchers uncover YellowKey and GreenPlasma Windows Zero-Days
Pwn2Own Berlin 2026, Day One: $523,000 paid out, AI products fall
U.S. CISA adds a flaw in Cisco Catalyst SD-WAN  to its Known Exploited Vulnerabilities catalog
Linux Kernel bug Fragnesia allows local root access attacks
Broadcom releases VMware Fusion security update for root access bug
NGINX Rift: an 18-year-old flaw in the world’s most deployed web server just came to light
FamousSparrow targets Azerbaijani energy sector in multi-wave espionage campaign
Nitrogen Ransomware claims massive data theft from Foxconn
Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming
OpenLoop Health confirms January 2026 Data breach affecting 716,000
Quest KACE SMA flaw CVE-2025-32975: when one unpatched tool opens the door to 60 organizations
Instructure settles with hackers following massive student data theft
Critical Fortinet vulnerabilities fixed in FortiSandbox and FortiAuthenticator
Hackers accessed BWH Hotels reservation system for months
The world’s most “Dangerous” AI, Anthropic’s Mythos, found only one flaw in curl
Attackers exploit cPanel CVE-2026-41940 to deploy Filemanager Backdoor
WannaCry, the ransomware attack that changed the history of cybersecurity
Android banking Trojan TrickMo evolves using TON network for C2
Identity security firm SailPoint discloses GitHub repository breach
Google warns artificial intelligence is accelerating cyberattacks and zero-day exploits
Crimenetwork returns after takedown, dismantled again by German authorities
U.S. CISA adds a flaw in BerriAI LiteLLM to its Known Exploited Vulnerabilities catalog
Instagram removed end-to-end encryption for DMs. What should users do?
New cPanel vulnerabilities could allow file access and remote code execution
Official JDownloader site served malware to Windows and Linux users between May 6 and May 7

International Press – Newsletter

Cybercrime

Healthcare Data Breach: Cybercriminals Attacked Health Insurance Agency in Ecuador

German operator of “Crimenetwork” arrested in Spain New version of the criminal trading platform “Crimenetwork” shut down – law enforcement authorities secure     

Foxconn confirms cyberattack impacting North American factories 

Cops arrest man suspected of being Dream Market kingpin 

TeamPCP’s Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages 

Our response to the TanStack npm supply chain attack  

Malware

JDownloader site hacked to replace installers with Python RAT malware    

New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps  

Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment  

This is what some the world’s largest banks of malware look like stacked as hard drives 

Popular node-ipc npm Package Infected with Credential Stealer  

Hacking

AI Vulnerability Research and the Fuzzer Era Déjà Vu: Why the Numbers Are Only Half the Story  

Behind the Scenes Hardening Firefox with Claude Mythos Preview  

Mythos finds a curl vulnerability

NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability  

Microsoft Vibing — capturing screenshots and voice samples without governance      

TrustFall: coding agent security flaw enables one-click RCE in Claude, Cursor, Gemini CLI and GitHub Copilot

Pwn2Own 2026 Capacity Overflow, Hackers Drop 0-Days Solo      

Mythos finds a curl vulnerability  

CVE-2025-32975: The Open Directory Behind the KACE SMA Breach and 60+ Downstream Victims

GhostLock — Lockout Without Encryption

Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP  

CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED)

BitUnlocker Downgrade Attack

Two more public disclosures, it will never stop

Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild

Pwn2Own Berlin 2026: Day Three Results and Master of Pwn              

Intelligence and Information Warfare

‘Disposable spies’: Poland records unprecedented number of Russian espionage cases

Revealed: Israeli Tech Exposes Users of Musk’s Starlink Satellite-based Internet      

FamousSparrow APT Targets Azerbaijani Oil and Gas Industry    

FrostyNeighbor: Fresh mischief and digital shenanigans

Gamaredon’s infection chain: Spoofed emails, GammaDrop and GammaLoad 

What BO Team is hiding: the ZeronetKit backdoor from the inside and connections to Head Mare

Kazuar: Anatomy of a nation-state botnet

Cybersecurity

Meta can read your Instagram DMs starting Friday. One step could protect you  

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access  

NHS to grant Palantir contractors ‘unlimited access’ to patient data

The May 2026 Security Update Review 

US govt seeks Instructure testimony on massive Canvas cyberattack

Welcome to the vulnpocalypse, as vendors use AI to find bugs and patches multiply like rabbits

Is the SOC Obsolete, and We Just Haven’t Admitted It Yet?

MPs want social media treated more like unsafe toys than harmless apps  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


I built my first PC in my early teens, and I just never really stopped. A passion for building desktops turned into a career, and two decades later, I still love everything about the process of building a PC, from picking the parts to actually assembling them and benchmarking the final rig.

With all that said, I’m about to buy a prebuilt PC, and it’s not just because of the prices, although they do play a part.

For most people, a prebuilt gets the important stuff right

If you shop smart, it can be a safe way to get a desktop

No, I haven’t somehow abandoned everything I’ve stood by for the last two decades. I still love PC building, and yes, I do normally try to convince my less building-inclined friends to build their own PC rather than buy a dodgy prebuilt. (It usually doesn’t work.)

I’m not exactly throwing in the towel. I’m just opening up my mind to possibilities. And the fact is that the vast majority of people who use desktop PCs don’t need the bleeding-edge performance or top-notch customization that comes with building your own computer. For most people, a prebuilt PC is just fine.

That’s exactly why I’m buying a prebuilt instead of building one myself: the computer is for my mom.



















Quiz
8 Questions · Test Your Knowledge

DIY PC building
Trivia Challenge

From socket types to cable chaos — test your knowledge of building computers from scratch.

HistoryHardwareTroubleshootingQuirksTips

What year did Intel release the first consumer processor that popularized the DIY desktop PC market — the Intel 8086?

Correct! The Intel 8086 launched in 1978 and gave birth to the x86 architecture still used in PCs today. It was a 16-bit processor running at 5–10 MHz — a far cry from today’s multi-GHz giants. This chip laid the foundation for decades of DIY computing.

Not quite — the Intel 8086 debuted in 1978. It introduced the x86 instruction set that still underpins virtually every desktop and laptop processor sold today. IBM later used the cheaper 8088 variant for its first PC in 1981, which is sometimes confused as the origin point.

When building a PC, what does ‘POST’ stand for in the context of the boot process?

Correct! POST stands for Power-On Self-Test, a diagnostic routine your motherboard runs every time you boot up. It checks that critical components like RAM, CPU, and GPU are present and functional. If POST fails, you’ll often get beep codes or LED indicators to help diagnose the problem.

The correct answer is Power-On Self-Test. Every time you press the power button, your motherboard runs POST to verify that essential hardware is connected and working. Failed POST is one of the first hurdles new PC builders encounter, often caused by unseated RAM or a forgotten power connector.

Why do experienced PC builders recommend touching a metal part of the case before handling components?

Correct! Static electricity built up on your body can silently destroy sensitive PC components in an instant — a phenomenon called electrostatic discharge (ESD). Touching bare metal grounds you and neutralizes that charge before it can zap your CPU or RAM. Anti-static wrist straps work even better for extended build sessions.

The answer is to discharge static electricity. Your body can carry thousands of volts of static charge without you feeling a thing, but that invisible zap can permanently damage a CPU or RAM stick. It’s one of the oldest and most important safety habits in PC building — cheap insurance for expensive parts.

A newly built PC powers on, fans spin, but there’s no display output. What is the MOST common first thing to check?

Correct! This is arguably the most common rookie mistake in PC building — plugging the monitor into the motherboard’s video output when a dedicated GPU is installed. The motherboard’s HDMI or DisplayPort is disabled by default when a GPU is present. Always connect your display directly to the graphics card.

The most common culprit is having the monitor plugged into the motherboard’s video port instead of the dedicated GPU. When a graphics card is installed, most systems disable the motherboard’s integrated video outputs automatically. It’s such a frequent mistake that it has become a running joke in PC building communities.

What is the purpose of thermal paste when installing a CPU cooler?

Correct! Even finely machined metal surfaces have tiny imperfections and air gaps at the microscopic level. Thermal paste — also called thermal interface material (TIM) — fills those gaps to ensure maximum heat conduction from the CPU to the cooler. Without it, air pockets act as insulation and temperatures can skyrocket dangerously.

Thermal paste fills microscopic gaps between the CPU lid and the cooler’s base plate. Metal surfaces may look flat and smooth, but at a microscopic scale they’re riddled with tiny ridges and valleys that trap air — and air is a terrible heat conductor. A thin, even layer of thermal paste eliminates those gaps and keeps temperatures in check.

The ATX motherboard form factor, which became the standard for DIY desktop PCs, was introduced by which company and in what year?

Correct! Intel introduced the ATX (Advanced Technology Extended) standard in 1995, replacing the older AT form factor. ATX standardized component placement, power supply connectors, and airflow direction — making DIY builds far more practical and interchangeable. Nearly 30 years later, ATX and its derivatives like Micro-ATX and Mini-ITX still dominate the market.

ATX was introduced by Intel in 1995. It was a major leap forward from the previous AT standard, defining a common layout for motherboards, cases, and power supplies that made mixing and matching components from different vendors straightforward. That standardization is a huge reason DIY PC building became so accessible.

When installing RAM into a motherboard with four slots, where should you install two sticks to enable dual-channel mode on most boards?

Correct! Dual-channel mode requires RAM to be installed in matched pairs on alternating slots — typically A2 and B2, or slots 2 and 4. This allows the memory controller to access both sticks simultaneously, effectively doubling memory bandwidth. Your motherboard manual will show the exact recommended slots, usually color-coded for convenience.

To enable dual-channel mode, RAM should go in alternating slots — such as slots 2 and 4, often color-coded on the motherboard. Placing both sticks in adjacent slots (like 1 and 2) forces single-channel operation, which can noticeably reduce performance in memory-intensive tasks. Always check your motherboard manual for the exact recommended configuration.

What is ‘coil whine’ in the context of a newly built gaming PC?

Correct! Coil whine is a high-pitched, sometimes whirring or buzzing noise caused by tiny electromagnetic coils (inductors) on a GPU or PSU vibrating at audible frequencies under heavy electrical load. It’s technically a defect in manufacturing tolerances but is extremely common and not usually harmful to the component. Ironically, it’s often loudest in high-end GPUs under uncapped framerates.

Coil whine is that annoying high-pitched squeal coming from inductors on your GPU or power supply vibrating under electrical load. It tends to be loudest when framerates are uncapped or during heavy computational tasks. While alarming to new builders, it’s usually harmless — though some manufacturers will replace components with severe coil whine under warranty.

Challenge Complete

Your Score

/ 8

Thanks for playing!

My mom does actually play quite a few games every single day, so I initially started off by putting parts together in order to get something good, cost-effective, reliable, and equipped with a discrete GPU. But as I ran into more and more roadblocks, I was once again reminded why my friends often can’t be bothered with building their own PCs.

These days, the evergreen belief that custom PCs are somehow better and more worth it than prebuilts is growing slightly outdated. Now, more than ever, many users can get by with a simple plug-and-play PC instead of going on weeks-long deep dives.

ASUS ROG Zephyrus G14

Operating System

Windows 11 Home

CPU

AMD Ryzen 9 8000 Series

The ROG Zephyrus G14 has been redesigned with an all-new premium aluminum chassis for increased durability and elegance. At 0.63 inches thin and weighing in at just 3.31lbs, this gaming powerhouse combines portability with cutting-edge technology.


Building PCs is great fun, but it’s not for everyone

I’ve stopped trying to convince my friends otherwise

A white full-tower desktop gaming PC with a mATX case, large air cooler, and RX 6800. Credit: Ismar Hrnjicevic / How-To Geek

Building your own PC is one of the most satisfying things you can do if you’re a desktop user, but that’s only true if you actually enjoy the whole process. Over the years, I’ve realized that many people just don’t enjoy it, and that’s alright. It can be overwhelming, and it becomes more of a hobbyist thing than a go-to with each passing year.

A lot of people don’t want to spend their evenings watching reviews, comparing chipsets, going through benchmarks, wondering whether there’s enough PSU headroom or whether a motherboard will need a BIOS update, and so on. Those same people might still want to own a desktop PC, and good prebuilts exist to save us all the trouble.

For someone like my mom, who is definitely a casual user, building a PC would make zero sense. I’d put in a lot of effort—I always go way overkill with every single build—and it’d have been wasted. And yes, I’d have fun, but for my mom, the end user, the end result would’ve been one and the same.

For a regular desktop user, a good prebuilt often gets the important things right without demanding that kind of effort. It comes assembled, tested, and ready to go, and it usually bundles the parts that matter most to everyday use: a modern CPU, enough RAM, a decent SSD, built-in connectivity, and some kind of warranty if things go wrong.

Besides, most desktop users aren’t like enthusiasts; they don’t need to optimize every tiny little thing. Looking at various Steam Hardware Surveys tells us that people go for the midrange time and time again, and I find it hard to believe that all those RTX 4060 owners overclock their PCs and spend hundreds of dollars on cooling.

In 2026, the market makes this whole argument a lot easier

Let’s not ignore the elephant in the room

Crucial DDR5 RAM and an M.2 NVMe in their original packaging. Credit: Ismar Hrnjicevic / How-To Geek

At a time when we’ve all done our panic buying and given up on the PC market, buying a prebuilt makes even more sense. Here’s how I know: I tried to build a PC first.

As that’s my default, obviously, I started by assembling a list of components my mom could use and going on a price-matching crusade. Some parts are reasonably affordable, such as the CPU, the motherboard, or the cooler, but the overpriced components make up for whatever you might manage to save on the other stuff. Getting RAM, an SSD, and a discrete GPU brand new right now is a challenge, and these pricing obstacles remove one of the best things about custom builds: saving money.

Typically, when you build your own PC, you save on the cost of assembly that’s baked into a prebuilt. You can also score better deals on the components themselves. But when there are very few deals to be had, and you don’t want to buy used, well, you’re kind of left with no upgrades right now. The best way to upgrade your PC in this climate is to spend zero dollars and wait it out.

Prebuilts aren’t perfect, but they can be good enough

Don’t let elitist communities tell you otherwise

A wall-mounted OLED TV connected to a desktop PC being used to watch "Fargo." Credit: Ismar Hrnjicevic / How-To Geek

Prebuilts are a good solution right now. Some manufacturers still haven’t carried the increased cost of parts over to the consumer, or at least not entirely, and if you score a good deal, you’ll actually save both time and money. You’ll miss out on the fun, but for many people, it’s more of a chore than entertainment.

With that said, prebuilts aren’t perfect. When you shop, make sure that you keep an eye out for some of the most common prebuilt PC traps.


There are alternatives

If you don’t want to buy a prebuilt PC but still want to save time and/or money and not build your own, you can always consider buying a used PC or a mini PC. I’ve toyed with the idea of a mini PC for my mom, and it’d be cheaper, but I want her to have a discrete GPU, so we’re going with a full-sized prebuilt.

However, if you don’t need a discrete graphics card, buying a mini PC can be a good, affordable way to get yourself a desktop replacement with minimal hassle. (Hint: mini PCs also make good sidekicks for actual desktops.)



Source link