Wednesday, May 27, 2026
Daily digest
The GlassWorm/Glassworm supply chain botnet takedown is the headline infrastructure security story today — it directly threatens developer pipelines and CI/CD toolchains, which should prompt a review of any npm, PyPI, or VS Code extension dependencies in your environment.
GlassWorm/Glassworm Botnet Disrupted After C2 Infrastructure Takedown
CrowdStrike, Google, and the Shadowserver Foundation simultaneously dismantled all C2 channels for GlassWorm, a supply chain campaign that has targeted software developers through malicious npm packages and IDE extensions since early 2025. The botnet's C2 relied on Solana blockchain transactions and BitTorrent DHT to resist takedown — an unusually resilient architecture. Any organization where developers consume open-source packages or extensions should audit recent installs and review pipeline integrity controls.
Microsoft Issues Out-of-Band SharePoint Patch
Microsoft released an emergency, out-of-cycle patch for SharePoint, bypassing the normal Patch Tuesday cadence — a signal that the vulnerability is considered high severity. SharePoint is frequently a high-value lateral movement target because it often houses sensitive documents and credentials. M365 GCC High tenants should verify the patch status of any on-premises SharePoint hybrid connectors or SharePoint Server instances immediately.
CISA Gives Feds 4 Days to Patch Actively Exploited cPanel Plugin Flaw
CISA added a critical vulnerability in the LiteSpeed cPanel user-end plugin to its Known Exploited Vulnerabilities catalog with an unusually tight four-day remediation deadline for federal agencies, indicating active in-the-wild exploitation. The flaw affects servers running the LiteSpeed plugin within cPanel environments. While this targets internet-facing hosting infrastructure rather than enterprise stacks directly, the aggressive deadline reflects CISA's posture on web-facing server vulnerabilities and is relevant context for any GovCloud-hosted web properties.
Gitea Vulnerability Exposes Private Container Images Without Authentication
CVE-2026-27771 allows unauthenticated remote attackers to pull private container images from any Gitea instance prior to version 1.26.2 — no credentials required. Organizations using self-hosted Gitea as a container registry for internal pipelines are directly exposed. Patch to 1.26.2 immediately and audit container registry access logs for unauthorized pulls.
Megalodon Malware Infects Thousands of GitHub Repos in Six Hours
A campaign dubbed Megalodon pushed malicious commits to more than 5,500 GitHub repositories in roughly six hours, exfiltrating credentials, developer secrets, and other sensitive data. The speed and scale of the compromise suggests automated tooling and underscores the risk of trusting third-party repository content in CI/CD pipelines. Review GitHub Actions workflows and any recently cloned repositories for unexpected commit activity or exfiltration of secrets.
FBI Warns of Silent Ransom Group In-Person Data Theft Attacks on Law Firms
The FBI issued a warning that the Silent Ransom Group (SRG) is physically entering U.S. law firm offices while posing as IT support personnel, then plugging in USB drives to exfiltrate data. This social engineering vector bypasses network-layer defenses entirely and exploits the assumption that someone in the building is legitimate. Physical security controls — visitor logging, USB port restrictions via Intune/group policy, and staff verification procedures — are the relevant mitigations.
MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries
Iranian state-linked group MuddyWater conducted a Q1 2026 espionage campaign against at least nine organizations across industrial manufacturing, public sector, financial services, and professional services verticals in nine countries. The campaign used DLL side-loading as its primary persistence and execution technique, abusing legitimate signed binaries to load malicious payloads. Defense contractors and public-sector organizations — a core CMMC audience — fit squarely in this threat actor's historical targeting profile.
AI-Assisted Exploit Development Outpaces Scanner Detection
New research confirms attackers are using AI to dramatically compress the time between CVE disclosure and working exploit development, outrunning the detection signatures of common vulnerability scanners. This shrinks the effective patching window and undermines patch-cycle assumptions baked into many compliance programs. India's CERT-In has responded by mandating 12-hour remediation windows for actively exploited internet-facing systems — a benchmark worth considering for your own escalation thresholds.
OMB Swaps Biden-Era Cyber Logging Memo for New Prioritized Logging Directive
OMB has rescinded its Biden-era memorandum on federal logging requirements and replaced it with a directive focused on prioritized, lower-volume log collection rather than broad ingestion. The shift reduces the scope of what agencies must collect but introduces risk if the prioritization criteria miss attacker activity that broader logging would have caught. CMMC Level 2 contractors tracking federal logging standards for alignment purposes should review the new directive, as it signals a philosophical shift in how the federal government is approaching audit (AU) controls.
State Cyber Leaders Beg Congress for More Funding as Local Grant Program Faces Sunset
State and local cybersecurity officials testified before Congress about the damage caused by federal cutbacks to cyber grants and information-sharing initiatives, with the State and Local Cybersecurity Grant Program facing a September reauthorization deadline. Loss of the program would defund critical infrastructure protection efforts at the state level and degrade threat intelligence sharing that benefits the broader DIB ecosystem. Contractors who rely on state-level fusion centers or MS-ISAC feeds for threat intel should monitor this closely.
When Certificates Expire 8x Faster, Manual Renewals Break
TLS certificate maximum validity is shrinking from 398 days to 200 days as of March 2026, with further reductions to 47 days planned by 2029 — meaning teams that handle renewals manually will face an unsustainable volume of work almost immediately. The article makes the case for automated certificate lifecycle management (CLM) tooling as a hard operational requirement, not a nice-to-have. For environments running Nutanix AHV, Kubernetes, or internal PKI tied to M365 GCC High, this is an infrastructure planning priority.
AWS Well-Architected Best Practices for Software Supply Chain Security
AWS published updated guidance on software supply chain security covering dependency integrity, artifact signing, and registry hygiene following a series of high-profile npm attacks including Shai-Hulud, Chalk/Debug, and axios. The post is directly relevant to GovCloud workloads that consume open-source dependencies and references Amazon Inspector integration for automated package flagging. Given the same-day GlassWorm and Megalodon supply chain stories, this serves as actionable hardening guidance.