Security Fixes, Windows Back Doors, and More

posted by Roy Schestowitz on May 19, 2026

• LWN ☛ Security updates for Monday

  Security updates have been issued by AlmaLinux (freerdp, gimp:2.8, jq, kernel, and rsync), Debian (chromium, ffmpeg, firewalld, kernel, nginx, openjpeg2, openssh, php7.4, and redis), Fedora (apptainer, chromium, coturn, dnsmasq, firefox, kernel, libgit2_1.8, libmetal, nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, open-amp, perl-Net-CIDR-Lite, pgbouncer, pypy, python-jupytext, python-uv-build, rsync, rust-astral-tokio-tar, uriparser, uv, valkey, and yelp), Mageia (dpkg, firefox, thunderbird, golang, haproxy, and samba), Slackware (dnsmasq and kernel), and SUSE (apache-commons-configuration2, apache2, apptainer, chromedriver, cups-filters, curl, dnsmasq, expat, ffmpeg-4, ffmpeg-7, firebird, firewalld, flux2-cli, glibc, go1.25, go1.26, gosec, grub2, ImageMagick, java-11-openj9, java-17-openj9, java-1_8_0-openj9, java-1_8_0-openjdk, java-21-openj9, java-25-openj9, kdenlive, kernel, kernel-devel, keylime-config, krb5, libIex-3_4-33, mozjs115, mozjs78, nginx, openssh, openvswitch, ovmf, PackageKit, perl-Crypt-URandom, perl-CryptX, perl-libwww-perl, perl-Net-CIDR-Lite, perl-Text-CSV_XS, podman, postgresql17, postgresql18, python-pyOpenSSL, python310, rsync, sed, tekton-cli, valkey, xen, and zypper-docker).

• Security Week ☛ Hackers Earn $1.3 Million at Pwn2Own Berlin 2026

  Participants demonstrated exploits for Windows, Linux, VMware, Nvidia, and Hey Hi (AI) products.

• Scoop News Group ☛ Interpol leads cybercrime crackdown across 13 countries in Middle East, North Africa

  Operation Ramz resulted in 201 arrests and disrupted phishing services, malware and financial scams.

• SANS ☛ TeamPCP Supply Chain Campaign: Activity Through 2026-05-17, (Mon, May 18th)

  Since the last update, the TeamPCP supply chain campaign produced its loudest stretch since the March Trivy disclosure: an officially confirmed Checkmarx Jenkins plugin compromise and a new self-spreading Mini Shai-Hulud worm across npm and PyPI.

• Security Week ☛ Millions Impacted Across Several US Healthcare Data Breaches

  Several healthcare data breaches impacting hundreds of thousands and even millions were added to the HHS tracker.

• Security Week ☛ ‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery

  Four vulnerabilities in OpenClaw can be chained together to steal credentials, escape the sandbox, and plant persistent backdoors.

• Security Week ☛ Grafana Confirms Breach After Hackers Claim They Stole Data

  Grafana appears to have been targeted by Coinbase Cartel, a cybercrime group linked to ShinyHunters, Scattered Spider, and Lapsus$.

• Security Week ☛ Exploitation of Critical NGINX Vulnerability Begins

  The flaw leads to denial-of-service on default configurations and to remote code execution if ASLR is disabled.

• Scoop News Group ☛ The Canvas breach proved that prevention is no longer enough

  Cybercriminals brought down the most widely used learning platform in North America. The Canvas breach is a blueprint for how SaaS attacks now work — and a warning about how unprepared most organizations still are.

• SANS ☛ ISC Stormcast For Tuesday, May 19th, 2026 https://isc.sans.edu/podcastdetail/9936, (Tue, May 19th)

  (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

• OpenSSF (Linux Foundation) ☛ Taking Stock of the State of European Cyber Resilience Act (CRA) Compliance: An Urgent Wake-up Call for the Open Source Ecosystem

• Windows TCO

  • Bruce Schneier ☛ Zero-Day Exploit Against backdoored Windows BitLocker