Daily Security Briefing #262

May 22, 2026 | Read Online

Multiple vulnerabilities exposed, AI attacks on the rise, and a massive C2 operation uncovered…

Executive Summary

Cybersecurity threats continue to evolve with malicious actors adapting to disruptions. This week’s top stories highlight the exposure of multiple vulnerabilities, including a critical Langflow vulnerability added to the Known Exploited Vulnerabilities Catalog. Meanwhile, AI attacks have become increasingly sophisticated, with attackers using commercial AI for exploitation work. Additionally, a massive C2 operation has been uncovered in Middle East telecommunications networks.

Top Articles

Metasploit Weekly Wrap-Up The latest Metasploit weekly blog highlights a new network component vulnerability in Cisco Catalyst SD-WAN Controller, patched by Cisco. The admin/networking/cisco_sdwan_vhub_auth_bypass module addresses CVE-2026-20182. rapid7.com

AI Attacks No Longer Experimental A recent AI threat landscape report reveals a single operator compromised nine Mexican government agencies using commercial AI for exploitation work. The campaign highlights the growing concern of AI-powered attacks. checkpoint.com

Massive C2 Operation in Middle East Telecoms Hackers are exploiting Middle East telecommunications networks and hosting providers to operate large-scale command-and-control (C2) infrastructure. The findings highlight a strategic shift toward infrastructure-level tracking. gbhackers.com

Russian Hackers Combine RDP, VPNs, Supply Chains Russian state-sponsored and aligned threat groups are combining Remote Desktop Protocol (RDP), Virtual Private Networks (VPNs), supply chain compromise, and social engineering to gain initial access to targeted networks. gbhackers.com

Nimbus Manticore Operations During the Iranian Conflict Key findings from Nimbus Manticore (UNC1549) operations reveal targeting internet-connected cameras, conducting destructive attacks against US and Israeli entities, and exfiltrating data from cloud environments. checkpoint.com

CISA Tries to Contain Data Leak Lawmakers demand answers as CISA struggles to contain a data leak caused by a contractor intentionally publishing AWS GovCloud keys and agency secrets on a public GitHub account. krebsonsecurity.com cisa-security-leak.html

Alleged Kimwolf Botmaster ‘Dort’ Arrested Canadian authorities arrest a 23-year-old Ottawa man suspected of building and operating the fast-spreading Internet-of-Things botnet, Kimwolf. krebsonsecurity.com

First VPN Dismantled in Global Takedown Authorities dismantle a criminal virtual private network (VPN) service used by 25 ransomware groups, disrupting First VPN Service. thehackernews.com

Ghostwriter Targets Ukraine Government Entities The Belarus-aligned threat actor Ghostwriter targets Ukrainian government organizations with Prometheus phishing malware. thehackernews.com

CISA Adds Langflow Vulnerability to KEV Catalog CISA adds a critical Langflow vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, signaling active exploitation in the wild. cyberpress.org

AI Transparency: This newsletter uses AI to curate, rank, and summarize cybersecurity content from leading industry blogs. All articles link directly to original authors. Executive summaries are AI-generated based on article content. I curate the sources and deliver the digest—the original authors deserve the credit for their excellent work.