May 30, 2026 - Red Dot Security

Header image for the Red Dot Weekly Cyber Security News https://reddotsecurity.news

Hello all,

This weekend brings an end to the first half of 2026. It seems to me to have just flown by very fast, but maybe that’s just me. Speaking of fast, quite a few sources are saying that the amount and frequency of new vulnerabilities appearing is definitely rising. On the heels of the Mythos release and other AI models digging for defects, Microsoft has stated that they expect that their monthly patch releases will continue to increase in quantity for some time to come. While not being quite as explicit about it, other vendors such as Oracle, SAP, and Adobe are all showing signs of this new AI driven patch plethora. Speaking of plethora, on to the headline news.

Headline NEWS:

Trend Micro warns of Apex One Zero-Day. Exploitation has been observed in at least one instance, despite the somewhat high bar of needing to already have administrative access on the affected server. CISA has ordered all federal agencies to patch for this defect by June 4, citing that vulnerabilities such as this pose a significant risk. In addition to the critical zero-day hole, Trend also addressed several other vulnerabilities. So, patch it if you have it.
Veeam Backup & Replication Tool Vulnerability Enables Privilege Escalation Attacks. This defect is in the Veeam Agent for Microsoft Windows and can enable a threat actor to escalate privileges. The article notes that once privilege escalation has been achieved the threat actor can disable security controls, execute arbitrary commands, and move laterally through the network – duh. That’s pretty much the m.o. of every priv-esc. If you use Veeam Backup & Replication, check for updates.

In Ransomware, Malware, and Vulnerabilities News:

This week there’s a Cornucopia of items that I feel are of particular note, such as, FBI warning about Kali365 Phishing service, LiteSpeed cPanel plugin zero-day critical vulnerability, Microsoft SharePoint patch, a Chromium bug that can turn your browser into a bot, 7-Zip and Putty vulnerabilities that need patching, a devious new way to lock you out of your Google account, and a Palo Alto PAN-OS GlobalProtect authentication bypass is now being actively exploited. Links to these articles and more are at RedDotSecurity.news in our Vulnerabilities and Exploits section. In Phishing, Malware, and Similar, Microsoft has an internal email account that is being used by spammers somehow, Microsoft Teams continues to be used to impersonate IT helpdesk staff, and ChatGPT share links are being abused to deliver malware.

In Other News Events of Note and Interest:

Google Device Bound Session Credentials are coming to all Chrome users. This is a way to tie the session cookie directly to a specific piece of hardware and does not permit reuse. This is being rolled out to all users now after being in beta test mode since April. Since the session cookie is tied to the computer’s Trusted Platform Module (TPM) on Windows, and the Secure Enclave on macOS, it should prove to be rather effective against token and session theft. I am certainly hoping that this works as advertised and puts a serious dent in dirtbag activity.

Musings

On June 1st, Atlantic Hurricane season starts. Now would be an excellent time to pause and take stock of your preparations should you, your business, or employees be impacted by a tropical cyclone. Check your insurance policies, check where you store your documentation, check your Incident Response, Disaster Recovery, and Business Continuity plans, and if you are potentially in an area that could be impacted by a tropical weather event, make sure that this scenario has been planned for and you’re ready.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Like this: