30
30
30
30
30
30
30
30
30
30
30
CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key
Apache Airflow Akeyless provider before 0.3.1 lets DAG authors bypass team-scope guards and read other teams' secrets.
CVE-2026-86465 (moderate) affects apache-airflow-providers-akeyless before 0.3.1. The Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key: in multi-team deployments, a DAG author scoped to one team can supply a Variable key containing a path separator that resolves a secret belonging to another team.
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
35
45
30
Search results are sending people to fake Bitrefill checkouts
Scam sites impersonating Bitrefill's crypto checkout appear in search results, tricking victims into sending up to $1,990 in crypto directly to scammers.
Malwarebytes documents a cluster of lookalike domains copying Bitrefill's gift card checkout, surfaced via search engine results rather than email. Victims choose an amount up to $1,990 and pay in Bitcoin, Ethereum, USDC, USDT, Solana, or Litecoin to scammer-controlled addresses, with no recourse since crypto payments are irreversible. Domains use typosquatting and Punycode/IDN homoglyph tricks, and the fake sites run commercial analytics software to measure and optimize victim conversion. Bitrefill's security team is working with takedown specialists to remove the sites.
40
Bisonal Malware Used in Attacks Against Russia and South Korea
Unit 42 details a Bisonal malware variant, active since 2014, targeting Russian and South Korean defense organizations via PDF-disguised spearphishing emails.
In early May, Unit 42 discovered a campaign delivering a Bisonal malware variant against at least one Russian communications security and cryptography company and one unidentified organization in South Korea. The variant, in the wild since at least 2014, introduces a new C2 cipher and rewritten networking and persistence code, with only 14 samples collected to date. Attackers spoofed Russian state corporation Rostec in spearphishing emails carrying an executable disguised with a PDF icon; the dropper decrypts an RC4-encrypted DLL and establishes persistence via a registry Run key. Bisonal has been used since 2013 against government, military, and defense targets in South Korea, Russia, Japan, and India, alongside successors Bioazih and Dexbia.
48
30
30
30
30
35