SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Drupal Critical SQL Injection Flaw Exploited
A critical vulnerability in the Drupal content management system is being exploited in the wild, and the US Cybersecurity and Infrastructure Security Agency has added the flaw to its Known Exploited Vulnerabilities catalog (CISA KEV). CVE-2026-9082, CVSS score 9.8, allows an anonymous attacker to perform arbitrary SQL injection by sending specially crafted requests, due to improper neutralization of special elements in the Drupal core database extraction API. This flaw only affects sites using PostgreSQL. The flaw was disclosed along with patches on May 20; Drupal updated the advisory on May 22 to announce evidence of exploit attempts, and CISA issued a remediation deadline of May 27 for Federal Civilian Executive Branch (FCEB) agencies. Imperva Security has observed more than 15,000 exploitation attempts, primarily targeting US sites in gaming, financial services, computing and IT, and business sectors. Drupal urges users to upgrade to the latest supported software version indicated in the advisory, but has also backported patches for unsupported end-of-life versions due to the severity of the issue.
Editor's Notes
- Slide 1 of 2
If you're on Drupal 10 or 11, make sure that you're on the latest version. If you're on Drupal 9, you can apply the 9.5 update, and if on Drupal 8.9, you can try the patch for 8.9, but the real answer is to update to version 10 or 11, as Drupal 8 & 9 are unsupported. Even in the 10/11 space, if you're on 11.1.x, 11.0.x, or 10.4.x (or lower) you need to upgrade to newer versions, as these are EOL and don't receive security coverage. Yes, they are doing best effort to backport the given security fix, but there are other issues not addressed which will remain unaddressed. Give a hard look at moving to 11.3.10.
- Slide 2 of 2
Checking input for escape codes is becoming more and more difficult. As code becomes more portable, developers have less and less visibility into the environments in which their code may run. At a minimum developers should follow the guidance from OWASP and Akamai.
Slide 1 of 0- Slide 1 of 2
LiteSpeed cPanel Plugin Privilege Escalation Exploited
On May 19, 2026, LiteSpeed issued a security update for a critical flaw in the user-end cPanel plugin between v2.3 and v2.4.4, known at the time of disclosure to have already been actively exploited as a zero-day. CVE-2026-48172, CVSS score 9.8, allows any cPanel user to escalate privileges to root by exploiting mishandling of features in the lsws[.]redisAble function. Users should remediate by upgrading to the latest version of the cPanel plugin, which at the time of this writing is v2.4.7; this is packaged with LiteSpeed WHM plugin v5.3.1.0, though the WHM plugin is unaffected by this flaw. Users can uninstall the user-end cPanel plugin if upgrading is not possible yet. LiteSpeed also recommends users run a console command provided in the advisory to check if their server has been affected, then block any unauthorized IPs returned and examine the system logs for actions taken by those IPs. The US Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities (KEV) catalog on May 26, with a remediation deadline of May 29 for Federal Civilian Executive Branch (FCEB) agencies.
Editor's Notes
If you're not using the LiteSpeed user-end or WHM cPanel plugin, uninstall them, check for IoCs. If you are, update and check for IoCs. The updated plugins, released May 21, include multiple fixes, not just the fix for CVE-2026-68172. Make sure components in your cPanel infrastructure are set to auto-update.
Apex One Path Traversal Exploited in On-Premises Version
Trend Micro has issued a security bulletin addressing eight vulnerabilities in its Apex One enterprise endpoint security software for Windows, one of which has already been exploited in the wild. The exploited flaw, CVE-2026-34926, carries the lowest CVSS score in the bulletin at 6.7, and allows a local, pre-authenticated attacker to inject and deploy malicious code to agents by modifying a key table on the server, due to a directory traversal vulnerability. This only affects the on-premises version of Apex One, and exploitation requires that "a potential attacker must have access to the Apex One Server and [have] already obtained administrative credentials to the server via some other method." Users should upgrade to Apex One on-premises SP1 CP Build 18012 (for existing SP1 users) or SP1 Build 17079 (for new installs), with at least agent build 14.0.0.17079, or Apex One SaaS Security Agent build 14.0.20731. This flaw was added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog (CISA KEV) on May 21, with a remediation deadline of June 4 for Federal Civilian Executive Branch (FCEB) agencies.
Editor's Notes
You may need to apply service packs to Apex One before you'll be able to install the patch, as there are minimum required versions to apply it. That will give you ample time to consider the choice to not use a hosted version. There was a time where I'd go to the mat to use on-premises/local services, but with the rate of change and threat vectors, we need to reserve that option for only when absolutely required so we can keep on top of things. Even once chosen, you need to regularly review that decision tree to see if things have changed.
The Rest of the Week's News
Patch UniFi OS for Three CVSS 10.0 Flaws
Ubiquiti has published a security advisory addressing five vulnerabilities in UniFi OS, including three that are maximum-severity, one critical-severity, and one high-severity. The flaws carrying CVSS score 10.0 are exploitable by an attacker with network access: CVE-2026-34908 allows unauthorized system changes due to improper access control; CVE-2026-34909 allows access to an underlying account and files on the underlying system due to path traversal; and CVE-2026-34910 allows command injection due to improper input validation. CVE-2026-33000, CVSS score 9.1, is also an improper input validation flaw allowing command injection, but is only exploitable by an attacker with high privileges. CVE-2026-34911, CVSS score 7.7, allows an attacker with low privileges to obtain sensitive information by accessing and manipulating files on the underlying system, due to a path traversal vulnerability. The CVE Numbering Authority (CNA) for all five flaws is HackerOne, indicating that they were reported through a bug bounty program. Users of Ubiquiti products running UniFi OS should check the security advisory bulletin to update software to the most current fixed versions.
Editor's Notes
- Slide 1 of 2
Think unauthenticated command injection to your UniFi environment. Read the bulletin carefully, as the update needed varies due to how you've deployed UniFi. Note that the mitigations for the flaws amount to updates to the software, so in other words, there are no workarounds. Also make sure that you're not exposing the console of UniFi services to the Internet.
- Slide 2 of 2
Ten-plus years of proven success show that bug bounties work, but a new shift is on the horizon. As next generation code analysis tools like Mythos and GPT-5.5-Cyber become standard industry fixtures, the role of bug bounty programs will inevitably evolve. These AI advancements are set to play a massive part in finally making "secure by design and default" an industry reality rather than just an aspiration.
Slide 1 of 0- Slide 1 of 2
In-Person IT Staff Impersonators Target Law Firms
The US Federal Bureau of Investigation has issued a FLASH advisory warning of ongoing social engineering attacks targeting law firms, in which threat actors have been stealing data by posing as IT support staff, both via remote access tools and by appearing in person. The FBI states that the threat actor (called "Silent Ransom Group," or SRG) has been stealing data and extorting organizations since 2022, and relies on rapid threats to sell or leak data after the theft, rather than using ransomware. In attacks observed in 2026, SRG began by contacting targets via email or directly by phone, impersonating IT staff and coercing employees into granting access to company systems through legitimate remote access software. If this tactic failed, a threat actor posing as IT support would arrive in person, insert a storage device into the target's computer, and claim that in order to mitigate impact from a phishing email, "they need to image the device or create a backup file." The threat actor then escalates privileges and immediately exfiltrates data without encryption, using WinSCP, Rclone, Google Drive, or OneDrive, or exfiltrating directly onto the in-person attacker's USB storage. Ransom demands follow via email with threats to leak or sell the stolen data, as well as phone calls to the target's clients and employees to pressure the company into negotiating. The FBI advisory notes that many components of these attacks exploit legitimate tools that will not be flagged by detection software, and recommends that organizations take defensive steps: verify all visitor credentials including physical ID cards, limit remote access to sensitive data, develop and communicate policies for how IT support communicates and authenticates with employees, train staff against phishing, maintain regular backups, require phishing-resistant MFA, and if possible, block port 22 and disable remote access and external drive installation permissions on company computers with access to sensitive data. The FBI is seeking any specific information from victims of SRG attacks that may be legally shared.
Editor's Notes
- Slide 1 of 5
This sort of attack is difficult to detect, as SRG is using legitimate remote access or system management tools to carry out the attack, meaning we're reliant on staff questioning the operation. The first mitigation seems straightforward: carefully verify support personnel, and be willing to say "no" if you're uncomfortable. The problem is that they are going to use social engineering, to include playing on urgency and dire consequences of failure to allow the action. They will be very convincing, which drives the need to produce solid policies about when this sort of activity can happen and how those actions are authenticated. Then train staff on how to handle the situation: if possible, roleplay with people who are both good at social engineering and not well known to staff. On top of this, you need to restrict access to data, especially sensitive data, so that what can be captured in a successful attack is minimized. Have rules about where data is (and is not) stored, and implement online and offline backup or archive copies. Eat this elephant one bite at a time, as it can be very disruptive to operations.
- Slide 2 of 5
To be honest, most of the findings here are not new. Many ransomware groups have moved on from encrypting the victim’s environment to simply stealing the data and extorting victims with the threat of publishing the data. The use of social engineering attacks impersonating IT staff is also nothing new. The fact that attackers are moving beyond just phishing emails and targeting victims with phone calls or text messages is nothing new also (just ask our friends at MGM /Caesars). About the only thing new in this advisory is the fact that an attack included someone physically visiting a site; this is new (and rare), as it puts the individual at high risk. What may have happened here is, instead of the attacker visiting the site, the attackers possibly hired an insider to do the attack for them (the details are a bit vague in the report). Organizations should not be changing how they manage human risk based on this report. Robust training of your workforce is an important control, meaning training that goes beyond just email-based phishing attacks and includes various different elements of social engineering attacks (phone calls, text messages, in-person). The good news is that the indicators for almost all of these are the same, like a sense of urgency, pressure to ignore policies, etc. The bad news is my concern: We are doing such a good job training people about phishing emails that they may begin to think attacks happen only over email.
- Slide 3 of 5
These impersonation scams are so difficult to verify, and it’s not helping that hiring IT people is becoming more challenging with this type of thing happening. Law firms have so much critical data that it’s not surprising that they are a big target.
- Slide 4 of 5
The best defense against cybercrime is not allowing initial access to the device, whether remote or in-person. Always, always stop and think before acting. The fact that the SRG gang has been so successful says that law firms need a lot of remedial cyber training.
- Slide 5 of 5
Carefully check the bona fides of any and all to whom you grant access, privileged or not. Retain images of all credentials presented.
Slide 1 of 0- Slide 1 of 5
FBI Kali365 Warning
The US Federal Bureau of Investigation has issued a Public Service Announcement warning of Kali365, an emerging phishing-as-a-service platform. According to the alert, "Through the Kali365 platform subscription, cyber threat actors can capture 'OAuth' tokens and gain persistent access to targeted individuals/entities' Microsoft 365 environments." The attackers lure targets with a phishing email that appears to come from trusted cloud productivity and document-sharing services. The email includes a device code, which targets are instructed to enter on a legitimate Microsoft verification page. Once the provided code is entered, the attackers are able to capture OAuth access and refresh tokens, giving them access to the target's Microsoft 365 accounts. The FBI advises users to "Restrict... device code flow to limit or block device authentication codes can help prevent or limit this style of attack." Kali365 is often spread via Telegram, and was first detected in April 2026. Researchers at Arctic Wolf published an analysis of the campaign in late April; they found that Kali365 also has adversary-in-the-middle attack capabilities.
Editor's Notes
- Slide 1 of 4
Capturing OAuth tokens will continue to be an attack technique we need to learn how to prevent. Restricting device code flow to limit or block device authentication codes can help prevent or limit this style of attack. You'll need a combination of conditional access policies and blocking authentication transfer policies. Before you can create these, you're going to need to audit existing device code flow to determine what's legitimate and needs to continue.
- Slide 2 of 4
Phishing-as-a-Service will continue to be a major vector as more systems go cloud-native. If you have yet to start deploying passkeys or any type of FIDO2, this is the time to seriously consider it.
- Slide 3 of 4
With so many business tools now in the cloud, attackers are weaponizing human habit. Users frequently wave through authentication prompts without a second thought, granting threat actors initial access. Once inside, criminals exploit the gaps left by poor patch and configuration management. This reality underscores why security awareness training continues to be the most effective defense.
- Slide 4 of 4
We cannot expect Microsoft to protect its users from all social engineering. That said, Microsoft needs to press on with its rollout of Passkeys. Management needs to understand the limitations and risks of federated authentication.
Slide 1 of 0- Slide 1 of 4
Alleged KimWolf Botnet Operator Arrested
Canadian authorities arrested Jacob Butler in Ottawa, Canada earlier this week in response to an extradition warrant filed by the US Department of Justice. Butler allegedly operated the KimWolf botnet, which has been used to conduct distributed denial-of-service (DDoS) attacks "which were measured at nearly 30 Terabits per second, a record in recorded DDoS attack volume," according to prosecutors. The botnet's services were sold in a cybercrime as a service model. Law enforcement authorities in Canada, Germany, and the US disrupted the botnet's infrastructure in March 2026 as part of a larger operation. Other botnets disrupted in that operation include Aisuru, JackSkid and Mossad. KimWolf used compromised IoT devices, including digital photo frames, TV streaming boxes, and webcams. Cybersecurity journalist Brian Krebs identified Butler as the botnet's likely operator in February 2026; at that time, Butler denied the allegation. According to court documents, Butler's IP address, account information, transactions, online messages, and other evidence point to Butler as KimWolf's administrator. He has been charged with one count of aiding and abetting computer intrusion, and could face up to 10 years in prison if he is convicted.
Editor's Notes
- Slide 1 of 2
The law enforcement action seized infrastructure used by KimWolf, as well as by several other botnets, and the Justice Department is ready to seize infrastructure supporting as many as another 45 DDoS-for-hire platforms. While the service was sold to others to carry out attacks, KimWolf was tied to DDoS attacks which were measured at nearly 30 Terabits per second. Given the preponderance of SOHO/IoT devices compromised for this botnet, it's a good time to make sure your devices are supported, updated and not doing double duty. If they've been "just working" for a while, consider power-cycling them as well.
- Slide 2 of 2
IoT devices are now the main drivers behind DDoS attacks. They are rarely prioritized by consumers, meaning they often run on default passwords, lack security updates, and operate long past their EoL. Even though the operator was arrested, these devices remain fully exploitable and waiting for the next bot herder to take control.
Slide 1 of 0- Slide 1 of 2
Glassworm Botnet Takedown
The CrowdStrike Counter Adversary Operations team, in collaboration with Google and the Shadowserver Foundation, disrupted the Glasswork botnet, taking down all four of the botnet's command-and-control (C2) channels simultaneously. The Glassworm infrastructure was built for resilience, relying on C2 server addresses hidden in the memo fields of Solana blockchain transactions, the BitTorrent Distributed Hash Table (DHT), Google Calendar event titles as dead-drop locations, and direct server connections. In its report, CrowdStrike writes, "Since at least early 2025, Glassworm operators have systematically targeted software developers, a population with access to source code repositories, cloud platforms, CI/CD pipelines, and package registries." The Glasswork operators took advantage of the situation with "trojanized VSCode extensions ... published to the OpenVSX marketplace, disguised as popular tools like time trackers and code formatters; compromised npm and Python packages [that] introduced malicious code through postinstall hooks and setup scripts;" and poisoning more than 300 GitHub repositories with the help of stolen credentials. Glassworm has been operational since early 2025.
Editor's Notes
It's interesting to note that Glassworm was architected to be resilient to takedown by leveraging a combination of blockchain, peer-to-peer, and legitimate web services as resolution layers. Think C2 protected by multiple layers of indirection, necessitating a closely coordinated takedown to prevent re-emergence. Glassworm used a combination of programming languages (JavaScript, Rust, Zig) in concert with multiple package ecosystems (VSCode, npm,PyPI, GitHub), optimizing their ability to disrupt supply chains. Focus on protecting developer environments, build pipelines, and code repositories. Make sure that you're implementing ALL the security best practices to reduce the risk of supply chain compromise.
Dutch Police Arrest Web Admins and Football Club Hacker
Dutch Authorities carried out arrests and seizures in two separate cybersecurity cases at the end of this month. On *May 18, 2026*, the Netherlands Fiscal Information and Investigation Service (FIOD) arrested two men on suspicion of making economic resources available to entities sanctioned by the EU, specifically by acting as a cover for a Russian web hosting company sanctioned since May 2025. 57-year-old Youssef Zinad, arrested in Amsterdam, owns the Dutch company alleged to have assumed control of the sanctioned technical infrastructure, and 39-year-old Andrey Nesterenko, arrested in The Hague, owns another Dutch company that handles the operation's internet connectivity. Brian Krebs reports that the original sanctioned entity, "Stark Industries," was used "to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union" starting shortly before Russia's invasion of Ukraine. FIOD searched three businesses and two data centers, seizing laptops, phones, and more than 800 servers. Unrelatedly, on *May 26, 2026*, Dutch National Police in Buren arrested a 35-year-old man suspected of multiple instances of unauthorized access to the computer systems of professional Amsterdam football club AFC Ajax. When Ajax disclosed the breach in March, RTL news reported that a now-patched security flaw gave the attacker access to over 300,000 fans' private data and control over more than 42,000 season tickets and 500 stadium bans, as well as the ability to view the personal details and incident information of banned fans.
Editor's Notes
The problems at AFC Ajax serve as a reminder that Equifax types of attacks are still possible if we don't maintain our security posture. In this case, watch security fundamentals: patching/updating, secure configurations, MFA, monitoring, and inventory. Note that in the above Netherlands FIOD story, “sanctioned” means an individual or organization which is legally restricted by a government or international body, typically for violations which could include terrorism, money laundering, drug trafficking, or human rights abuses. Interacting with a sanctioned entity can have serious consequences for all involved.
Data Leak at UK Visa Portal Non-Government Website
The personal data of thousands of people who applied for UK immigration visas through a website called UK Visa Portal has been exposed through a misconfigured Amazon bucket. The website is not affiliated with the UK government. The compromised information includes passport data and photographs; in all, more than 100,000 documents were exposed. The website has addressed the issue that allowed others to view the uploaded photos and passport scans. The company has not stated publicly whether they plan to notify the people whose data were exposed, nor whether they plan to notify US and EU regulators, as required by law. TechCrunch has asked a partner in a US law firm who claims to represent UK Visa Portal "how long the Amazon-hosted bucket was exposed, the reason it was exposed, ... if the company had any logs to determine if anyone accessed or downloaded the exposed data, ... [and] who at UK Visa Portal is responsible for cybersecurity." At the time of writing, TechCrunch had not received a reply. Visa applicants are advised to apply through the UK government website.
Editor's Notes
- Slide 1 of 2
The S3 bucket has been secured, while questions around the incident have not been. TechCrunch reports that in response to their report of the incident, they were approached by a law firm claiming to represent the UK Visa Portal, yet they were unwilling to provide supporting evidence this was indeed the case. A couple of things for you to verify: If you're using legal representation, make sure they have verifiable documents they can provide showing they are legitimately engaged. Second, be careful sending a legal team after a bug report. Lastly, be transparent about breaches and incidents. A posture of remediation, prevention of recurrence, and clearing the air with affected individuals is far better than denial, and likely denial will get you crosswise with privacy and incident reporting regulations which are so common these days.
- Slide 2 of 2
Yet another misconfigured AWS S3 bucket. The Center for Internet Security has developed cloud security foundation benchmarks for the majority of Cloud Security Providers. You can download it from the AWS security hub located at: https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html.
Slide 1 of 0- Slide 1 of 2