Daily Cybersecurity News - May 18, 2026

Windows just got a fresh local privilege escalation zero day that lets attackers grab SYSTEM on fully patched machines.

The flaw sits in cldflt.sys, the Windows Cloud Files Mini Filter Driver. The exploit abuses the undocumented CfAbortHydration API to create arbitrary registry keys without access checks, spawning a SYSTEM shell from a standard user account. Public PoC released on GitHub by researcher Chaotic Eclipse.

Same bug Google Project Zero reported in 2020 as CVE-2020-17103. Microsoft supposedly patched it that December, but the original PoC still works unmodified.

BleepingComputer confirmed the exploit works on a fully patched Windows 11 Pro running the May 2026 Patch Tuesday updates.

NGINX just got hit with a critical flaw that attackers are already exploiting.

CVE-2026-42945, dubbed Nginx Rift, is a heap buffer overflow in the ngx_http_rewrite_module. Crashes the worker process on default setups. With ASLR disabled, it enables remote code execution. CVSS 9.2, actively exploited right now.

Affects NGINX Open Source and NGINX Plus versions 0.6.27 through 1.30.0. Fixed in 1.31.0+ and 1.30.1+. The bug sat in the codebase for 18 years.

Attacks started within days of disclosure.

Grafana Labs lost source code after hackers used a stolen GitHub access token to break into its environment.

Attackers downloaded the codebase, then tried to extort Grafana for ransom. Grafana refused, citing FBI guidance.

The root cause was an internal misconfigured GitHub Action with a Pwn Request pattern. An attacker forked a Grafana repo, dumped environment variables through the workflow, and walked out with a privileged token.

Credentials were invalidated and the vulnerable workflow removed. Extortion group CoinbaseCartel has claimed the attack.

A new macOS stealer called SHub Reaper layers Apple, Google, and Microsoft cues across a single attack chain.

Fake WeChat or Miro installer hosted on a typo-squatted Microsoft domain, execution disguised as an Apple security update, persistence hidden in a fake Google Software Update path. Steals credentials, wallets, and documents while dropping a backdoor.

Instead of the older Terminal trick, Reaper uses the applescript:// URL scheme to launch Script Editor with a pre-loaded payload, sidestepping Apple's macOS Tahoe 26.4 mitigation.

The SHub family has been around for roughly two years. Reaper is the new variant SentinelLabs flagged this week.

A threat actor is already weaponizing the open-source Shai Hulud worm against NPM developers. They took the recently leaked source code and built clones that scan package registries for new maintainers, then inject malicious payloads into popular libraries.

The move is unsurprising given TeamPCP dropped the source on GitHub on May 12 alongside a $1,000 supply chain attack contest on BreachForums. Most copycats just reuse the original logic rather than innovate on it.

OX Security has detected four malicious NPM packages from this campaign so far, including one near-verbatim Shai-Hulud clone.

A pre-Stuxnet Lua-based tool called Fast16 sabotaged nuclear weapons testing simulations years before the famous worm.

It corrupted uranium compression models inside high-fidelity simulators. The malware ran on air-gapped networks and altered results without detection at the time.

This predates Stuxnet by at least five years, with oldest components dating to around 2005. It shows early cyber sabotage focused on simulation data integrity rather than physical destruction.

The malware was originally referenced in the Shadow Brokers leak of NSA's Territorial Dispute components. SentinelOne published the first analysis in April; Symantec and Carbon Black confirmed the uranium-compression simulation targeting this week.

Most LLM defenses scan inputs for suspicious tokens or prompt injection patterns. New research from Microsoft and the Institute of Science Tokyo shows a backdoor attack called

MetaBackdoor that bypasses those checks entirely. The trigger is not hidden text, it is the positional structure of the input itself. Once the input crosses a certain length, the model leaks its system prompt or emits attacker-specified tool calls.

The data looks clean during normal use. This is early-stage research on one attack method, not a broad survey of deployed models.

The attack succeeds against several popular open-weight models.