Daily Cybersecurity News - May 19, 2026

Microsoft Exchange just got hit with a zero-day that attackers are already abusing to steal mailboxes. CVE-2026-42897 is a cross-site scripting flaw in Outlook Web Access. Unauthenticated attackers send a crafted email that runs arbitrary JavaScript in the victim's browser session when opened in OWA.

CVSS 8.1.

No patch exists yet. Microsoft is shipping temporary mitigations through the Exchange Emergency Mitigation Service. Affects on-prem Exchange Server 2016, 2019, and Subscription Edition. Exchange Online is not affected.

CISA added it to the KEV catalog on May 15, requiring federal agencies to remediate by May 29.

ChromaDB has an unpatched flaw that lets attackers run code on your server without any login.

CVE-2026-45829, CVSS 10.0. The Python FastAPI server instantiates user-controlled embedding function settings before checking access permissions. An unauthenticated attacker sends a crafted request to the collections endpoint with a malicious HuggingFace model reference and trust_remote_code set to true, and the server happily executes it.

Any ChromaDB deployment left exposed to the internet faces this risk. HiddenLayer found 73% of internet-exposed instances on Shodan are running the vulnerable version range.

Introduced in version 1.0.0, still unpatched as of 1.5.8. HiddenLayer tried to disclose to ChromaDB starting February 17 and got no response.

A CISA contractor left AWS GovCloud keys sitting public on GitHub until last weekend. The "Private-CISA" repo exposed administrative credentials to three GovCloud accounts, plaintext passwords for dozens of internal systems including the Landing Zone DevSecOps environment, and artifactory access. The contractor explicitly disabled GitHub's secret detection feature.

This was a plain old public repo mistake, not some clever intrusion. The contractor, a Nightwing employee, appears to have used the public repo to sync files between work and home machines.

Repo was public from November 13, 2025 to mid-May 2026. GitGuardian flagged it after automated alerts went unanswered, then notified Krebs. CISA says it found no evidence of compromise but is still investigating.

Grafana Labs got hit through a GitHub compromise. Hackers walked away with source code for their open source monitoring tool.

Extortion group CoinbaseCartel has claimed the attack on their data leak site. Grafana confirmed the breach and said they invalidated the compromised credentials and added extra security measures. The real angle is how the attackers reached the code through GitHub.

A misconfigured GitHub Action with a Pwn Request pattern let them dump environment variables and walk away with a privileged token, points to CI/CD pipeline risks rather than a flashy zero-day.

Five repos in total were accessed. Grafana refused to pay the ransom, citing FBI guidance.

TeamPCP keeps spreading through developer tools.

They poison NPM packages and VSCode extensions to steal credentials from developers working on multiple projects. Latest wave hit the @antv data visualization ecosystem, plus GitHub Actions (actions-cool/issues-helper) and a VSCode extension.

Same worm pattern they've used before, now hitting a new victim in the visualization library space. Infrastructure stays consistent with prior campaigns.

Active since September 2025, with hundreds of packages compromised across npm, PyPI, Docker Hub, OpenVSX, and VS Code Marketplace. The AntV wave alone hit 323 packages in a 22-minute automated burst on May 19.

A PhaaS platform called EvilTokens has hit more than 340 Microsoft 365 organizations since launching in mid-February.

Targets get a message prompting them to enter a short code at microsoft[.]com/devicelogin. The platform then abuses OAuth device code flow to steal refresh tokens that bypass MFA entirely.

Device code abuse is familiar tradecraft but EvilTokens packages it as a turnkey service for low-skill operators. This lowers the bar compared to custom campaigns that usually need custom infrastructure.

It has already spread across seven countries, with most victims in the US, Canada, Australia, France, India, Switzerland, and the UAE. Affiliates focus on finance, HR, logistics, and sales roles.

A compromised version of the Nx Console extension slipped into the VS Code Marketplace and stole developer credentials.

Attackers published nrwl.angular-console version 18.95.0, a tampered build of the real Nx tool released using stolen maintainer credentials. The extension has 2.2M+ installs. The moment a developer opened any workspace, it silently fetched and ran a 498 KB obfuscated payload from a dangling orphan commit inside the official nrwl/nx GitHub repo.

This is classic supply chain abuse, not novel tradecraft. They reused the extension update path that has worked against package managers for years.

Malicious version stayed live in the marketplace for roughly 11 minutes before the Nx team detected and removed it. Anyone who installed during that window should treat their credentials as fully compromised.