Daily Cybersecurity News - May 21, 2026

Drupal sites running PostgreSQL just got hit with a highly critical SQL injection bug in Drupal core.

CVE-2026-9082 sits in Drupal’s database abstraction API. Anonymous attackers can send crafted requests and trigger SQL injection on PostgreSQL-backed sites.

Impact can go past login bypass. Drupal says it can lead to information disclosure, privilege escalation, remote code execution, or other attacks depending on the setup.

Drupal 7 is not affected. Fixed versions are 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, and 11.3.10.

Microsoft just patched two zero-day flaws in Windows Defender that attackers already used in real attacks.

Affects Windows 10 and 11 devices running current Defender versions. No specific distros or builds called out yet.

Patch rollout started Wednesday across enterprise and consumer channels.

Hackers hit GitHub with 3,800 internal repositories exposed through a single compromised extension.

Attackers used a malicious version of the Nx Console VS Code extension. This extension came from the TanStack npm supply chain attack last week. GitHub confirmed the link after investigating the repo breach.

The real angle here is supply chain trust. One tainted package in the developer tooling chain gave attackers a direct path into private code at scale.

The malicious extension was live for a short window, but that was enough. In developer tooling, one poisoned extension can move fast because it sits close to code, tokens, and internal repos.

Grafana Labs got hit through a leftover GitHub token that survived the TanStack npm supply chain compromise.

Attackers used the token to reach internal systems and pull source code plus build artifacts. The incident happened right after the TanStack attack last week.

This was a classic follow-on from a supply chain hit. The company missed one rotation step and handed attackers a path inside.

A China-aligned group is hitting telecommunications providers in Asia with two new pieces of malware.

They drop Showboat on Linux boxes and JFMBackdoor on Windows systems. The malware gives them remote access after initial compromise of telco networks.

Showboat is fresh for them. Most China-aligned crews still stick to familiar Windows tools.

The campaign has been active since at least mid-2022, so this is not a fresh smash-and-grab. It looks more like long-term access against telecom targets.

A new wave of fake Android apps is stealing money through carrier billing fraud for premium services.

They disguise themselves as popular games and productivity tools. The apps use WebView automation with JavaScript injection and OTP interception to push through fraudulent subscriptions without user consent.

Microsoft took down Fox Tempest, a fake signing service that gave malware authors legitimate-looking certificates to evade detection.