Daily Security Briefing #261

May 21, 2026 | Read Online

GRIDTIDE disrupted, AI training data poisoning exposed, and Microsoft Defender zero-day vulnerabilities exploited…

Executive Summary

The cybersecurity landscape remains complex with attackers adapting to disruptions. The recent GRIDTIDE campaign disruption highlights the importance of collaboration in combating cyber threats. Meanwhile, critical vulnerabilities in Drupal core have been exposed, and Microsoft has disclosed two new zero-day vulnerabilities in Microsoft Defender that are actively being exploited. Additionally, AI training data poisoning has become a growing concern.

Top Articles

Q1 2026 Threat Landscape Report: Zero-clicks, geopolitical tensions, and some wins for law enforcement The first quarter of 2026 reinforced that attackers are moving faster, operating with greater coordination, and exploiting weaknesses before most organizations can respond effectively. From escalating geopolitical tensions to increasingly aggressive ransomware operations, the latest quarterly Threat Landscape Report highlights a security environment where reactive defense strategies are becoming unsustainable. rapid7.com

Protect GenAI Chatbots with Check Point WAF Generative AI chatbots are quickly becoming the new front door to your business, creating a new risk for you. They answer customer questions, support employees, guide buyers, and increasingly connect to internal documents, APIs, knowledge bases, and business workflows. checkpoint.com

TamperedChef Malware Hides in Signed Apps to Drop Stealers and RATs A large-scale malware campaign dubbed “TamperedChef” is leveraging trojanized productivity applications such as PDF editors, calendar tools, and file converters to silently deploy information stealers and remote access trojans (RATs), according to recent threat intelligence findings. gbhackers.com

Microsoft Defender Zero-Day Vulnerabilities Actively Exploited in the Wild Microsoft has disclosed two new zero-day vulnerabilities in Microsoft Defender that are actively being exploited in the wild, raising concerns among security professionals and enterprise users. gbhackers.com

Critical Drupal Core Vulnerability Exposes Websites to Attacks The Drupal Security Team has officially released SA-CORE-2026-004, patching a highly critical SQL injection vulnerability (CVE-2026-9082) that affects Drupal core’s database abstraction API across nearly all supported and legacy versions. cyberpress.org

TamperedChef Malware Abuses Signed Productivity Apps To Deliver Stealers A massive global malvertising campaign known as TamperedChef is actively infecting systems by hiding information-stealing malware within trojanized productivity software. cyberpress.org

Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor Cybersecurity researchers have disclosed details of a new Linux malware dubbed Showboat that has been put to use in a campaign targeting a telecommunications provider in the Middle East since at least mid-2022. thehackernews.com

ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories Attackers are not always breaking in; they are using the parts we already trust. That is what makes it worrying. The danger is in normal things now - updates, apps, cloud buttons, support chats, trusted… thehackernews.com

Google accidentally exposed details of unfixed Chromium flaw Google has accidentally leaked details about an unfixed issue in Chromium that keeps JavaScript running in the background even when the browser is closed, allowing remote code execution on the device. bleepingcomputer.com

Apple blocked over $11 billion in App Store fraud in 6 years Apple revealed that it blocked over $11 billion in fraudulent App Store transactions over the last six years, more than $2.2 billion in potentially fraudulent App Store transactions in 2025 alone. bleepingcomputer.com

Lawmakers from both parties say CISA cuts have gone too far Reps. Don Bacon, R-Neb., and James Walkinshaw, D-Va., found rare bipartisan agreement that the agency tasked with defending civilian networks has been diminished at a moment when threats from China and others are growing. cyberscoop.com

AI Transparency: This newsletter uses AI to curate, rank, and summarize cybersecurity content from leading industry blogs. All articles link directly to original authors. Executive summaries are AI-generated based on article content. I curate the sources and deliver the digest—the original authors deserve the credit for their excellent work.