May 16, 2026

Header image for the Red Dot Weekly Cyber Security News https://reddotsecurity.news

Hello all,

This week brought another round of fun updates from Microsoft, Adobe, SAP, and others with Patch Tuesday releases. Immediately following Microsoft’s patch releases, a hacker who I shall dub Dirtbag Eclipse, released two new zero-day exploits, one of which I’ll cover in a bit more detail in a moment, along with a few other items that stood out to me. The unfortunate victims of this very public tantrum that Dirtbag Eclipse is having are the millions of Windows users that have been put into threat actors’ crosshairs via exploits that have no available patches.

There were lots of other exploits and vulnerabilities that were announced this past week, so make sure you read the full listing, checking for any that may apply to you or systems you support. In addition to the spate of vulnerabilities that were publicly announced this past week, Pwn2Own Berlin 2026 is underway and has already found a number of high-value zero-day exploits. Expect that they will be announced within the next 90 days. In the meantime, lets get to the headline news.

Headline NEWS:

Cisco continues to stay in the weekly headline news, this time with a zero-day authentication bypass vulnerability in their Catalyst SD-WAN Controller. Cisco’s Security Advisory states, “This vulnerability exists because the peering authentication mechanism in an affected system is not working properly.” The vendor has released a patch and guidance to locate and mitigate any existing exploitation. CISA is urging immediate attention to this defect. Yeah, don’t wait on this one if you use Cisco’s SD-WAN.
Exchange On-Prem from Microsoft has a zero-day defect that is under active exploitation. This vulnerability is trivial to exploit, only requiring a user to open a specially crafted email in Outlook Web Access (OWA). If you use any supported version of Exchange On-Premises, hopefully you left the Microsoft Emergency Mitigation Service active (it is on by default) since there is an emergency mitigation that was published. Articles that we’ve linked show how to check if the mitigation has been applied and explain what Exchange functionality has been crippled in response to this new defect.
Fortinet released ForitUpdates to fix security FortiIssues in FortiAuthenticator and ForitSandbox. The defects can enable an unauthenticated threat actor to execute unauthorized code, achieving remote code execution. They are not known to be under active exploitation, yet. So FortiPatch soon.
Microsoft Patch Tuesday was this week. There were no zero-days patched, which is a nice respite. However, there were 120 or more patches and fixes in this cycle, so there is a lot that needs to be addressed. Get to vetting them quickly, since threat actors are certainly scanning the patches to see what was plugged and how.
Microsoft Zero-Days in BitLocker and a privilege escalation involving CTFMON that can grant SYSTEM level access were made public by Nightmare-Eclipse, or Chaotic Eclipse. I prefer the name Dirtbag Eclipse since this individual’s very public feud has major knock-on effects for millions of Windows users worldwide. The BitLocker bypass is particularly troubling, because that means that any lost of stolen laptop could potentially require a breach notification vs. a simple loss statement. Because if whatever is on the laptop is easily accessible via now well published instructions, the data must be considered compromised. Ouch. This one will hurt. Currently, the only mitigation is to add a BIOS password and BitLocker PIN.

In Ransomware, Malware, and Vulnerabilities News:

AI caused breaches are covered by several articles in this week’s full listing. They describe how AI enabled breaches resulted from human error, by people sharing the wrong information with a public AI. And now the organization must go through breach notification and potential lawsuits as a result. If your organization hasn’t implemented proper Governance, Regulation, and Compliance (GRC) policies around the use of AI, you may be too late already. But don’t let that stop you, immediately begin the needed process so that you don’t become a victim. If you need help, the company I work for – Integris – is ready and able.

In Other News Events of Note and Interest:

Google has been busy this week with lots of announcements. The most significant is their Android-powered Aluminum OS is coming, along with a new Googlebook to run it. There’s a 16-minute-long leak video that spills the beans on just about everything about it linked in the full listing of articles.

Musings

I’ve got nothing snarky or too witty to say this week. We defenders have a lot to keep up with, and I applaud you all for your persistence, and your dedicated, tireless, severely underappreciated, often unlauded service. Well done! Keep plugging away, one defect, one compromise, one remediation at a time.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Like this:

Leave a ReplyCancel Reply