DJBSEC's CyberNews 2026-05-21

Today’s daily news covers the following categories: Threat Intelligence Vulnerability Authentication Ransomware Privacy Malware

---

Attackers Abuse Cloudflare Storage Endpoints for Malicious Operations

Threat Intelligence
Threat actors are increasingly abusing Cloudflare storage endpoints to host and distribute malicious content while blending in with legitimate traffic. Researchers say attackers are leveraging trusted cloud infrastructure to evade security filtering and reputation-based defenses. These campaigns may involve phishing pages, malware payloads, or command-and-control communications hidden behind reputable services. Abuse of trusted cloud platforms continues to complicate detection for defenders. Organizations are encouraged to monitor outbound traffic patterns and strengthen cloud security visibility.
Read More

DirtyDecrypt Linux Kernel Vulnerability Exposes Systems to Attack

Vulnerability
Researchers have disclosed a new Linux kernel vulnerability dubbed “DirtyDecrypt” that could allow attackers to bypass protections and potentially escalate privileges. The flaw reportedly impacts low-level kernel operations tied to memory and encryption handling. Linux vulnerabilities of this type are particularly concerning because they affect servers, cloud infrastructure, and enterprise workloads at scale. Public disclosure may accelerate exploitation attempts by threat actors. Administrators are urged to apply patches quickly and monitor systems for unusual activity.
Read More

Microsoft Self-Service Password Reset Feature Abused in Azure Data Theft Attacks

Authentication
Attackers are abusing Microsoft’s self-service password reset functionality in Azure-related environments to facilitate data theft operations. Researchers say threat actors use social engineering and account recovery workflows to gain unauthorized access to user accounts. Once compromised, attackers can exfiltrate sensitive cloud data and establish persistence. The campaign highlights how legitimate account management features can be weaponized against organizations. Security experts recommend strengthening identity verification and monitoring password reset activity closely.
Read More

The Gentlemen Ransomware Expands Attacks on Windows Systems

Ransomware
The Gentlemen ransomware operation is expanding its attacks against Windows environments using updated malware and infrastructure. Researchers report that the group is targeting organizations with data theft and encryption-based extortion tactics. The ransomware is capable of disrupting business operations while threatening victims with public data leaks. Analysts say the group continues refining its tooling to improve stealth and persistence. Organizations are advised to maintain offline backups and strengthen endpoint monitoring defenses.
Read More

Public GitHub Account Exposed GovCloud and CISA Credentials

Privacy
A contractor’s publicly accessible GitHub account reportedly exposed sensitive GovCloud and CISA-related credentials. The leaked information could potentially have allowed unauthorized access to government cloud infrastructure if abused before remediation. Security experts say the incident highlights ongoing risks tied to credential management and developer practices. Even highly sensitive environments remain vulnerable to accidental exposure through public repositories. Organizations are being urged to adopt automated secret scanning and stricter credential handling controls.
Read More

Critical ChromaDB Flaw Allows AI Application Server Hijacking

Vulnerability
A maximum-severity vulnerability affecting ChromaDB, a popular database platform used in AI applications, could allow attackers to hijack servers remotely. Researchers warn that successful exploitation may provide full control over affected AI infrastructure and connected data. As AI platforms become more widely adopted, attackers are increasingly targeting the supporting ecosystems around them. The flaw highlights growing security concerns tied to AI development frameworks and databases. Organizations using ChromaDB are being urged to patch immediately and restrict unnecessary exposure.
Read More

Microsoft Disrupts Malware Code-Signing Service Used by Ransomware Groups

Malware
Microsoft says it has disrupted a malicious code-signing service that was being used by ransomware groups to sign malware payloads. Signed malware can appear more legitimate to operating systems and security products, increasing the effectiveness of attacks. Researchers say the service helped cybercriminals bypass detection and distribute trusted-looking malicious software. The disruption is part of broader efforts to weaken cybercriminal infrastructure and supply chains. Security teams are encouraged to continue validating software signatures and monitoring suspicious binaries.
Read More