Daily Drop (1304)

05-24-26

Sunday, May 24, 2026 // Buy Bob a Coffee // Ghostwire

Iran Signals Deep Distrust of U.S. Negotiations Amid Ongoing Regional Tensions

Bottom Line Up Front (BLUF): Iranian President Masoud Pezeshkian stated that Iran’s history of negotiations with the United States requires Tehran to exercise “utmost caution,” citing repeated breaches of promises, attacks during negotiations, and assassinations of Iranian officials. The comments come as Iran continues diplomatic engagement while simultaneously reinforcing deterrence messaging across the region.

Analyst Comments: Tehran is signaling that it remains open to negotiations while simultaneously building political justification for distrust, delayed concessions, or escalation if talks collapse. The rhetoric reflects a familiar Iranian posture: diplomacy framed as conditional, defensive, and shaped by historical grievance. The reference to assassinations and attacks during negotiations is particularly important because Iran continues linking current diplomatic engagement to broader security concerns involving Israel and the United States. That framing helps Iranian leadership justify maintaining hardline security policies even while pursuing talks.

READ THE STORY: Mehr

Cyber Threats Against Satellites Escalate as Space Systems Become Strategic Attack Surface

Bottom Line Up Front (BLUF): Cybersecurity experts warn that satellites and space-based infrastructure are becoming increasingly attractive targets for nation-state cyber operations, electronic warfare, and AI-assisted attacks. Analysts say modern threats now focus heavily on disrupting communications, hijacking command systems, spoofing navigation, and targeting ground infrastructure supporting commercial and military satellite operations.

Analyst Comments: Space systems are no longer niche aerospace assets—they are now operational critical infrastructure tied directly to military operations, intelligence collection, communications, navigation, financial systems, and global logistics. That changes the threat landscape dramatically. The important shift is that attackers increasingly do not need to physically destroy satellites to create strategic impact. Disruption, denial, deception, and command interference are often enough to degrade military coordination, ISR capabilities, communications resilience, or civilian infrastructure dependencies. In many cases, attacking the ground segment is significantly easier and operationally cheaper than targeting the spacecraft itself.

READ THE STORY: Orbital Today

Iran Warns U.S. Military Presence in Gulf Is a ‘Threat,’ Signals Broader Regional Escalation Risk

Bottom Line Up Front (BLUF): Iran’s Foreign Ministry warned that the U.S. military presence in the region represents a source of instability rather than security, while signaling that future conflict escalation may become uncontrollable if attacks against Iran continue. Tehran also accused the United States of conducting a “naval blockade,” demanded sanctions relief, and reiterated that any military response by Iran is framed as legitimate self-defense.

Analyst Comments: Iran is trying to shape the narrative that future escalation would not remain geographically contained if conflict resumes. The repeated references to Gulf bases are especially important. Tehran is effectively warning neighboring states that allowing U.S. operations from their territory could make them operational participants in future retaliation cycles. Iran has used this messaging before, but current rhetoric appears more direct and more closely tied to ongoing regional tensions and maritime security concerns. The “naval blockade” language is also notable because it reframes sanctions enforcement and maritime pressure operations as violations of international law. That framing supports Iran’s broader diplomatic strategy of presenting itself as acting defensively while portraying U.S. military posture as destabilizing and escalatory.

READ THE STORY: IRNA

Multiple NGINX Vulnerabilities Enable Remote Code Execution and Rate-Limit Bypass

Bottom Line Up Front (BLUF): Multiple vulnerabilities affecting NGINX, NGINX Plus, F5 WAF for NGINX, and related products could allow unauthenticated attackers to achieve remote code execution, memory disclosure, denial-of-service, HTTP/2 injection, and rate-limit bypassing. The most severe flaw, CVE-2026-42945, is already seeing exploitation activity in the wild just days after disclosure.

Analyst Comments: The combination of RCE potential, memory corruption bugs, and HTTP/3 rate-limit bypass creates strong conditions for rapid exploitation activity. CVE-2026-42945 stands out because the vulnerable rewrite pattern is common in real-world NGINX deployments. That dramatically increases exposure. The fact that VulnCheck already observed exploitation attempts on canary systems within days of disclosure suggests attackers moved quickly from analysis to operational testing.

READ THE STORY: CCB

CISA Adds Drupal CVE-2026-9082 to KEV as PoCs Surface After Rapid Exploitation

Bottom Line Up Front (BLUF): CISA added Drupal Core CVE-2026-9082 to its Known Exploited Vulnerabilities (KEV) catalog after exploitation activity escalated almost immediately following disclosure. The SQL injection flaw affects Drupal sites using PostgreSQL databases and allows unauthenticated attackers to inject arbitrary SQL commands, potentially leading to credential theft, privilege escalation, data exposure, or remote code execution. Public proof-of-concept exploits are now circulating, and federal agencies have until May 27, 2026, to patch affected systems.

Analyst Comments: The flaw is especially dangerous because it compromises the very API layer intended to sanitize database queries and prevent SQL injection. When trust boundaries inside sanitization logic fail, downstream compromise paths become significantly easier to operationalize. Imperva’s telemetry showing more than 15,000 attack attempts against nearly 6,000 Drupal sites across 65 countries within 48 hours confirms attackers moved into mass scanning and validation mode almost immediately. Organizations running Drupal with PostgreSQL backends should assume broad internet-wide scanning is already underway. At this stage, exposed unpatched systems should be treated as potentially compromised rather than merely vulnerable.

READ THE STORY: Security Affairs

Hackers Exploit EOL F5 BIG-IP Appliances to Pivot Into Internal Linux and Active Directory Environments

Bottom Line Up Front (BLUF): Microsoft Threat Intelligence disclosed an active intrusion campaign in which attackers exploited end-of-life F5 BIG-IP appliances to gain SSH access into enterprise environments and pivot deeper into internal Linux and Windows infrastructure. The operation ultimately targeted Active Directory systems using NTLM relay techniques, credential theft, and exploitation of internal applications such as Atlassian Confluence.

Analyst Comments: The attackers did not need flashy zero-days or ransomware deployment to create serious enterprise risk. They leveraged an unpatched internet-facing appliance, moved laterally through trusted internal systems, harvested credentials, and chained together multiple known weaknesses until they reached domain infrastructure. The important detail is how efficiently the attackers operated once they gained SSH access. They immediately treated the compromised F5 appliance as a staging node for reconnaissance, internal enumeration, and pivot operations. That reinforces a growing reality in hybrid environments: edge appliances are effectively Tier-0 assets now. If attackers compromise them, they often inherit trusted network positioning that bypasses many traditional perimeter assumptions.

READ THE STORY: Cyberpress

RondoDox Botnet Exploits 2018 ASUS Router Flaw to Hijack Devices at Scale

Bottom Line Up Front (BLUF): The RondoDox botnet is actively exploiting CVE-2018-5999, a critical unauthenticated ASUS router vulnerability first disclosed in 2018, to hijack internet-exposed devices and build out DDoS infrastructure. Researchers estimate more than one million ASUS routers may be exposed, highlighting the continued operational risk posed by unsupported edge devices.

Analyst Comments: CVE-2018-5999 has had public exploit code available for years, but attackers are only now operationalizing it at scale because the target environment still exists. Consumer and SMB routers remain some of the weakest points on the internet—poor patching, weak visibility, and massive deployment volume make them ideal botnet fuel. RondoDox appears to be following the familiar Mirai playbook: compromise cheap edge devices, aggregate bandwidth, and weaponize them for DDoS or follow-on campaigns. The more interesting trend here is the continued focus on end-of-life hardware. Threat actors know organizations and consumers rarely replace networking gear until it physically fails.

READ THE STORY: HackRead

Cisco Patches Max-Severity Secure Workload Flaw Granting Site Admin Access

Bottom Line Up Front (BLUF): Cisco released patches for a critical authentication and validation flaw in Cisco Secure Workload that allows unauthenticated attackers to gain Site Admin privileges through exposed REST API endpoints. Tracked as CVE-2026-20223, the vulnerability enables cross-tenant access, sensitive data exposure, and configuration manipulation with maximum severity impact.

Analyst Comments: The concerning part here isn’t just the CVSS score—it’s the combination of unauthenticated access plus cross-tenant administrative control inside a platform designed specifically for zero trust segmentation. That’s the kind of irony attackers love. The flaw effectively undermines the trust boundary Secure Workload is supposed to enforce. If exposed management interfaces are reachable externally or from compromised internal segments, attackers could pivot directly into policy control and visibility layers. Even though Cisco says there’s no evidence of exploitation yet, vulnerabilities involving auth bypass on enterprise networking infrastructure tend to get weaponized quickly once patch diffing starts.

READ THE STORY: Bleepingcomputer

Ubiquiti Patches Three Max-Severity UniFi OS Vulnerabilities Exposing Devices to Remote Attacks

Bottom Line Up Front (BLUF): Ubiquiti released patches for three maximum-severity UniFi OS vulnerabilities that allow remote attackers to abuse improper access controls, path traversal, and command injection weaknesses. The flaws impact internet-exposed UniFi OS deployments, with nearly 100,000 publicly accessible endpoints currently tracked online.

Analyst Comments: This is a rough week for UniFi administrators. The most concerning detail here is not just the severity ratings—it’s the combination of remotely exploitable flaws affecting management infrastructure that is frequently exposed directly to the internet in SMB and distributed enterprise environments. UniFi ecosystems are increasingly attractive to attackers because they sit in privileged network positions while often lacking the operational maturity applied to traditional enterprise networking gear. Attackers know these devices frequently remain internet-accessible with inconsistent patch cycles and weak segmentation controls.

READ THE STORY: Bleepingcomputer

Critical UniFi OS Command Injection Flaw Maps to Exploitation Phase

Bottom Line Up Front (BLUF): A malicious actor with network access and high privileges could exploit CVE-2026-33000, an Improper Input Validation vulnerability in UniFi OS devices, to execute command injection. Published and modified on May 21, 2026, the flaw is rated high risk due to potential full device compromise, though exploitation requires privileged access.

Analyst Comments: The high-privilege requirement limits opportunistic exploitation, but attackers who already have admin access—through phishing, credential theft, or lateral movement—could use this as a second-stage compromise path against UniFi OS infrastructure. The threat intel picture is messy. The advisory metadata flags “Exploit Available: YES,” but also reports 0 public GitHub PoCs. That contradiction should be treated carefully until corroborated by Ubiquiti or another trusted source. With EPSS reportedly at 0.1%, broad exploitation appears unlikely in the near term, but weaponization remains plausible if technical details or a working PoC surface.

READ THE STORY: Bleepingcomputer

CVE-2026-9367: NousResearch Hermes-Agent Command Injection Flaw Exposes Terminal Tool Abuse Risk

Bottom Line Up Front (BLUF): CVE-2026-9367 affects NousResearch hermes-agent up to commit 5157f5427f19488b31c6fdebbacd15d798ce7f63. The flaw sits in tools/approval.py, specifically the detect_dangerous_command function used by the terminal_tool component, and can allow OS command injection. Public exploit details are reportedly available, and the vendor did not respond to early disclosure attempts.

Analyst Comments: Anything that lets an AI agent inspect, approve, or execute terminal commands becomes a high-value attack surface. If the guardrail function itself can be manipulated, the control layer becomes part of the exploit path. The reporting is a little messy: the overview says remote attack is possible, while the details list “Remotely Exploit: No.” Treat that inconsistency carefully. Until confirmed otherwise, assume exposed deployments, shared agent environments, CI/CD integrations, and systems where untrusted prompts or commands reach terminal_tool are at elevated risk.

READ THE STORY: CVEFEED

Packagist Supply Chain Attack Infects 8 Packages With GitHub-Hosted Linux Malware

Bottom Line Up Front (BLUF): Researchers uncovered a coordinated supply chain campaign targeting Packagist packages, where attackers embedded malicious postinstall scripts inside package.json files to deploy Linux malware from GitHub Releases. The attack affected at least eight PHP/Composer packages and abused cross-ecosystem dependency trust to bypass typical security reviews focused only on Composer metadata.

Analyst Comments: The interesting part isn’t just the malware delivery—it’s the ecosystem pivot. Attackers hid malicious JavaScript lifecycle hooks inside PHP packages knowing many AppSec teams only audit composer.json and ignore bundled Node tooling. That blind spot is becoming a recurring theme across modern development stacks. The use of GitHub Releases as payload infrastructure also continues to trend because it blends into legitimate developer traffic and complicates takedowns. Even without the second-stage payload, the installer itself effectively grants remote code execution during install or CI/CD execution. If your pipelines automatically build or install dependencies from dev branches like dev-main or dev-master, this should be a wake-up call.

READ THE STORY: THN

Multiple Critical Vulnerabilities Disclosed in Sparx Systems Pro Cloud Server and Enterprise Architect

Bottom Line Up Front (BLUF): CERT Polska disclosed five vulnerabilities affecting Sparx Systems Pro Cloud Server and Enterprise Architect, including broken access control, authentication bypass, SQL query execution, race condition-based remote code execution, and denial-of-service flaws. Several issues allow low-privileged or unauthenticated attackers to execute arbitrary SQL queries or achieve remote code execution against vulnerable deployments.

Analyst Comments: This is a pretty severe set of findings for organizations using Sparx infrastructure in software engineering or enterprise modeling environments. The standout issue is the combination of broken access controls with direct SQL execution paths inside Pro Cloud Server. That effectively turns application-layer weaknesses into backend database compromise. The race condition vulnerability (CVE-2026-42099) is especially dangerous because it provides a realistic path to remote code execution using attacker-controlled PHP files. Race-condition RCEs are usually noisy and timing-sensitive, but they become much more reliable in cloud or high-latency environments where response delays can be manipulated.

READ THE STORY: CERT.PL

Anthropic’s Project Glasswing Finds 10,000+ Vulnerabilities in One Month, Exposing the Reality of the AI-Patching Gap

Bottom Line Up Front (BLUF): Anthropic revealed that its AI-driven defensive security initiative, Project Glasswing, identified more than 10,000 high- or critical-severity vulnerability candidates in its first month of operation. After human validation, researchers confirmed over 1,000 legitimate high-impact flaws across widely used open-source software, underscoring a growing imbalance between AI-assisted vulnerability discovery and the industry’s ability to patch systems fast enough.

Analyst Comments: The headline is not “10,000 vulnerabilities found.” The real story is that Anthropic validated more than 1,000 serious exploitable flaws in a single month using one internal capability. That fundamentally changes the economics of offense and defense. The industry has spent years optimizing detection pipelines while patch management remained slow, fragile, and operationally painful. AI now widens that gap. Finding bugs is becoming cheap. Fixing them still requires engineers, testing cycles, downtime approvals, and coordination across vendors and customers. That mismatch is where things get dangerous.

READ THE STORY: Security Affairs

Charter Communications Confirms Breach as ShinyHunters Threatens Leak of 42 Million Records

Bottom Line Up Front (BLUF): Charter Communications confirmed a cybersecurity incident after the ShinyHunters extortion group claimed it stole data tied to more than 42 million customers. The threat actor alleges the breach exposed personally identifiable information (PII) and threatened to leak the data publicly if negotiations are not opened before May 27, 2026. Charter stated that no sensitive personal information or customer proprietary network information (CPNI) was exfiltrated, though the company continues investigating the incident.

Analyst Comments: The most important detail here is not the “42 million records” claim—it is the continued pattern surrounding ShinyHunters operations targeting SaaS ecosystems and enterprise cloud environments. This increasingly looks less like isolated breaches and more like a scalable intrusion model focused on exposed credentials, weak third-party integrations, cloud token abuse, and inherited trust relationships inside enterprise platforms. Charter’s statement is also carefully worded. Saying “no sensitive PI or CPNI” was exfiltrated does not necessarily mean no customer data was accessed. Companies often distinguish between regulated categories of sensitive information and broader operational datasets that may still carry reputational and fraud risk.

READ THE STORY: Cyber Insider

OpenAI Moves Into Full Political Damage-Control Mode as AI Backlash Intensifies

Bottom Line Up Front (BLUF): OpenAI is aggressively reshaping its public-policy and communications strategy as political backlash against AI companies grows. Chief Global Affairs Officer Chris Lehane is leading efforts to soften public fears around AI while simultaneously pushing for state-level regulations favorable to OpenAI’s growth and liability protections. The company is also increasingly tied to political lobbying networks and pro-AI super PAC activity.

Analyst Comments: OpenAI appears to recognize that it is no longer operating as just another Silicon Valley company shipping software products. The company is now managing a legitimacy crisis tied to labor fears, safety concerns, political influence, copyright disputes, and growing public distrust of AI firms. A year ago, the dominant industry narrative centered on acceleration—AGI timelines, massive productivity gains, and transformative economic impact. That messaging is now being recalibrated as public skepticism intensifies and policymakers begin paying closer attention.

READ THE STORY: WIRED

Palantir Expands ICE Oversight Features After Internal Backlash Over Immigration Enforcement Contracts

Bottom Line Up Front (BLUF): Palantir conducted an internal “hack week” focused on building enhanced auditing and oversight controls for software used by DHS and ICE, including tools capable of tracking user activity, detecting suspicious data access, and monitoring dataset exfiltration. The initiative comes amid growing employee unrest over the company’s expanding role in U.S. immigration enforcement operations.

Analyst Comments: The initiative followed internal backlash from employees concerned about Palantir’s involvement in immigration enforcement programs connected to the Trump administration. Internal communications reviewed by WIRED showed employees questioning the ethical implications of the company’s work with ICE and demanding greater transparency around contracts and operational use cases.

READ THE STORY: WIRED

UAE Cyber Insurance Market Reaches $70 Million as AI-Driven Threats Push Risk Costs Higher

Bottom Line Up Front (BLUF): The UAE Cybersecurity Council says the country’s cyber insurance market has grown to approximately $70 million as organizations respond to increasing cyber threats and expanding digital transformation initiatives. Officials expect premiums to rise further as AI-assisted attacks, social engineering campaigns, and large-scale digital risk exposure continue accelerating across critical sectors.

Analyst Comments: The important detail here is not the current market size—it is the acknowledgment that insurers now expect AI-driven attacks to materially increase risk exposure and claims frequency. That means organizations are likely heading into a future where weak cybersecurity hygiene directly impacts insurance affordability and coverage availability. The industry has already been moving this direction globally. Insurers increasingly require baseline controls such as MFA, endpoint detection, incident response planning, privileged access management, and continuous monitoring before issuing policies. In practice, cyber insurance is evolving into a quasi-regulatory enforcement layer for cybersecurity standards.

READ THE STORY: Gulfnews

Items of interest

CISA Credential Leak Sparks Congressional Scrutiny After GitHub Exposure of Sensitive GovCloud Access

Bottom Line Up Front (BLUF): CISA is under congressional pressure after researchers discovered a publicly exposed GitHub repository containing privileged AWS GovCloud credentials and internal agency access data. The leak, reportedly tied to a contractor-managed repository named “Private-CISA,” raised immediate concerns about potential persistence opportunities for nation-state actors and highlighted ongoing operational security failures inside the federal government’s top cyber defense agency.

Analyst Comments: If valid privileged credentials are sitting in a public repository, attackers skip reconnaissance and exploitation and move straight to access operations. The bigger issue here is not just exposure — it’s trust erosion. CISA is the agency responsible for advising critical infrastructure operators on cyber hygiene, yet it suffered the same GitHub credential leakage problem security teams warn junior developers about weekly. The most concerning detail is the mention of AWS GovCloud credentials potentially enabling persistence. If a state actor accessed the repository before remediation, the risk shifts from “credential leak” to possible long-term cloud foothold establishment. Depending on IAM permissions, temporary tokens, logging gaps, or federated trust relationships, this could become far more serious than a simple secrets exposure.

READ THE STORY: Cyberscoop

CISA Contractor AWS Leak + Industrial Robot Exploits (Video)

FROM THE MEDIA: We analyze a high-stakes CISA supply chain breach involving AWS GovCloud and investigate critical command injection vulnerabilities threatening industrial robot fleets. This briefing also covers new npm-targeting malware and the latest global efforts to dismantle cybercrime infrastructure.

Introduction to secret leaks and getting started with GitHub Secret Protection (Video)

FROM THE MEDIA: Have your secrets leaked? Learn about what you can do to mitigate risk -- and stop secrets from leaking in the first place.

The selected stories cover a broad range of cyber threats and are intended to help readers frame key publicly discussed threats and improve overall situational awareness. InfoDom Securities does not endorse any third-party claims made in its original material or related links on its sites; the opinions expressed by third parties are theirs alone. For further questions, don’t hesitate to get in touch with InfoDom Securities at dominanceinformation@gmail.com.