<p><strong>TLDR:</strong> The former Helm APT mirror domain <a href="http://baltocdn.com" target="_blank" rel="noopener nofollow">baltocdn.com</a> was re-registered by a third party on May 19 and may be serving malicious content — any CI/CD pipeline, Dockerfile, or script still pointing at it should be treated as compromised. The Gogs RCE situation got worse: a public exploit module is now available for the unpatched argument injection bug, and the sole maintainer is still unresponsive. Dutch police seized 200+ servers to dismantle a 17-million-device botnet tied to Russian proxy service ASOCKS. Symfony UX shipped a security-only release patching seven CVEs across LiveComponent and Autocomplete, including XSS, CSRF bypass, DoS, and HMAC replay issues.</p>
<hr>
<h2>Helm’s <a href="http://baltocdn.com" target="_blank" rel="noopener nofollow">baltocdn.com</a> domain re-registered, CI/CD pipelines at risk</h2>
<p>The Helm Security Team confirmed that <a href="http://baltocdn.com" target="_blank" rel="noopener nofollow">baltocdn.com</a> — decommissioned in September 2025 — was re-registered by an unknown third party on May 19, 2026 and may now be serving malicious content. Any system that pulled binaries from that domain after May 19 should be treated as compromised. The blast radius here is wide: Dockerfiles, CI/CD pipelines, and provisioning scripts that were never updated after the original decommission are all exposed. Migrate to <a href="http://packages.buildkite.com" target="_blank" rel="noopener nofollow">packages.buildkite.com</a> and audit your build infrastructure for stale references now. <a href="https://app.daily.dev/posts/c3U0x6rvj" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Gogs RCE: public exploit module released, maintainer still silent</h2>
<p>The unpatched argument injection bug in Gogs — any authenticated user can execute arbitrary code via a malicious branch name during merge — now has a public exploit module. Rapid7 disclosed after two months of no response from the project’s sole maintainer, and the situation hasn’t improved. Because Gogs ships with open registration by default, an attacker doesn’t even need a pre-existing account. If you’re running Gogs for anything sensitive, restrict network access and disable self-registration immediately. The harder question is whether a single-maintainer project with no security SLA belongs in your infrastructure at all. <a href="https://app.daily.dev/posts/l75671xG6" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Dutch police dismantle 17-million-device botnet linked to ASOCKS proxy service</h2>
<p>Dutch police and the NCSC seized more than 200 servers to take down a botnet of at least 17 million infected devices, following a tip from a security researcher. The infrastructure was tied to ASOCKS, a Russia-based residential proxy service advertising 7 million IP addresses and roughly 100,000 clients. Device owners had no idea their hardware was routing DDoS traffic, phishing campaigns, and scraping operations. The usual advice applies: change default credentials on routers and IoT devices, keep firmware current, and disable remote administration when you’re not actively using it. <a href="https://app.daily.dev/posts/PH2ZVXgif" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Symfony UX 2.36.0 / 3.1.0: seven CVEs patched across LiveComponent and Autocomplete</h2>
<p>Symfony UX pushed a security-only release fixing seven vulnerabilities. The headline issues are two XSS bugs — unescaped AJAX response data in Autocomplete (CVE-2026-49216) and attacker-controlled child component tag names in LiveComponent (CVE-2026-49210). Also patched: a CSRF bypass where the Accept header was CORS-safelisted and provided no real protection (CVE-2026-49215), an HMAC scope bug enabling cross-component prop replay attacks (CVE-2026-49212), a DoS via unbounded batch action arrays (CVE-2026-49209), permissive date prop hydration allowing time manipulation (CVE-2026-49208), and unescaped SQL LIKE wildcards in the Autocomplete entity endpoint (CVE-2026-49211). If you’re running symfony/ux-live-component or symfony/ux-autocomplete, upgrade to 2.36.0 or 3.1.0 immediately. <a href="https://app.daily.dev/feed-by-ids?id=aIbNeyTK6&amp;id=qnVTPZ1xE&amp;id=BE5s2bWYd&amp;id=H4NWrc5jt&amp;id=JMVs7Spy8&amp;id=2UiR1M4KT&amp;id=RYK4pKN1c&amp;id=V3TLigUzF&amp;id=dNEOriSNR" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>ChatGPT share links weaponized to host fake outage pages delivering malware:</strong> Push Security’s ‘LLMShare’ campaign shows threat actors using <a href="http://chatgpt.com/s/" target="_blank" rel="noopener nofollow">chatgpt.com/s/</a> links to render convincing OpenAI outage pages via Google Ads, then redirecting victims to sites serving macOS and Windows infostealers. The same abuse pattern has been observed on Claude Artifacts and Grok — AI platform sharing features are becoming a reliable phishing delivery mechanism. <a href="https://app.daily.dev/posts/h2GQ8yzz2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI-assisted scanning finds critical RCE in Elixir’s decimal library in under 30 minutes:</strong> A researcher with no prior security experience spent $10 on Claude to scan popular Hex packages and found a critical vulnerability in the decimal library — used by nearly every database and money-handling package in the Elixir ecosystem — in under 30 minutes. He’s since reported roughly twice as many vulnerabilities as have been publicly disclosed. The EEF’s CNA is now facing its first real stress test, and the security infrastructure is currently underfunded and volunteer-staffed. <a href="https://app.daily.dev/feed-by-ids?id=3Ca4o71dK&amp;id=mg4tY2o4e" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google Chrome makes Device Bound Session Credentials (DBSC) generally available:</strong> Chrome’s DBSC feature — which cryptographically binds session cookies to a device’s hardware security chip — is now rolling out automatically to all Google Workspace and personal account users. Stolen cookies become useless to attackers without the corresponding private key, directly countering infostealers like Lumma and Rhadamanthys that previously exploited revived session cookies to bypass MFA. <a href="https://app.daily.dev/posts/hmsdZDL44" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Notepad++ patches two CVSS 7.8 ACE bugs in XML config files:</strong> CVE-2026-48778 and CVE-2026-48800 let a local attacker who can write to shortcuts.xml or config.xml inject malicious executables that survive reboots and blend into the Run menu. All three CVEs (including a lower-severity crash bug) were fixed in version 8.9.6.1, released the same day as disclosure. <a href="https://app.daily.dev/posts/lzFTQ7GmZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft vs. NightmareEclipse: responsible disclosure dispute turns public:</strong> The researcher claims Microsoft deleted his accounts and refused communication, leading him to publish bug details before patches shipped. Microsoft says the uncoordinated drops put working exploit code in attackers’ hands. Both sides have a point, but the broader concern is that eroding researcher-vendor trust is increasingly dangerous as AI compresses the window between vulnerability discovery and exploitation. <a href="https://app.daily.dev/feed-by-ids?id=TnjAcREqY&amp;id=TtPvp3AmH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>DDoS-as-a-Service market grew roughly 10x in high-signal ads from 2023 to 2026:</strong> Flare’s analysis shows the market has shifted from scattered scripts to polished subscription platforms with tiered pricing ($5 one-hour attacks up to $2,000 botnet networks), API access, and Cloudflare bypass claims. Real-world ceiling: Cloudflare blocked a 31.4 Tbps attack and Microsoft mitigated a 15.72 Tbps attack in 2025. <a href="https://app.daily.dev/posts/LUID308bM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Axios SSRF patch bypass: 16 million loopback addresses left unblocked (CVE-2026-42043):</strong> The original SSRF fix in Axios hardcoded only three loopback addresses, ignoring that RFC 1122 defines the entire 127.0.0.0/8 subnet as loopback. Attackers could route requests to 127.0.0.2 or similar addresses, bypassing NO_PROXY checks silently. Fixed in v1.15.1. <a href="https://app.daily.dev/posts/9cS8ox4Oq" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Android lock screen bypass via Gemini Deep Research remains unpatched on Pixel 6a:</strong> A researcher found that long-pressing the gear icon in Gemini’s lock screen overlay and selecting Deep Research launches the full Gemini app without authentication on a fully patched Pixel 6a running Android 16. Full account access, conversation history exfiltration, and persistent lock screen capabilities are all reachable in under 60 seconds. Still unpatched as of publication. <a href="https://app.daily.dev/posts/iQxk6y6Ie" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>California AG sues 23andMe over 2023 breach exposing 7 million customers’ genetic data:</strong> The lawsuit alleges 23andMe failed to implement reasonable security safeguards, missed intrusion detection opportunities, and made misleading public statements blaming customers for the credential-stuffing attack. Violations cited include California’s Genetic Information Privacy Act, CCPA, and False Advertising Law, with statutory penalties of $1,000–$7,500 per violation. <a href="https://app.daily.dev/posts/cbFeT2u1o" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ubiquiti/UniFi patches six CVEs including a perfect 10.0 scorer:</strong> The UniFi patch batch includes a CVSS 10.0 path traversal and command injection vulnerability. If you’re running UniFi infrastructure, patch now. <a href="https://app.daily.dev/posts/TtPvp3AmH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AWS Shield Advanced adds packet-level DDoS attack flow logs:</strong> Logs include source/destination IPs, ports, protocols, packet and byte counts, and source country, published every 5 minutes to S3, CloudWatch Logs, or Firehose. Useful for post-incident forensics and threat intelligence on active attacks. <a href="https://app.daily.dev/posts/iYqQX5X3Q" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Composer 2.10 ships unified dependency policy block with native malware blocking:</strong> The new config.policy block brings security advisories, malware reports, abandoned packages, and custom blocklists under one configuration object. The malware list is enabled by default and blocks during composer install from a lockfile — not just at audit time. <a href="https://app.daily.dev/posts/ynq88Kd1g" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google security engineer charged with insider trading on Polymarket using internal search data:</strong> Michele Spagnuolo allegedly used Google’s internal ‘Year in Search’ tool to place ~$2.75M in bets on Polymarket under the alias ‘AlphaRaccoon’, winning approximately $1.2M in USDC before the FBI traced the account back to him. He faces up to 20 years each on wire fraud and money laundering charges. <a href="https://app.daily.dev/posts/2pPtZn5Vj" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenAI’s GPT-5.5-Cyber and Anthropic’s Claude Mythos offered to Japan’s three megabanks:</strong> MUFG, SMBC, and Mizuho will get access through a ‘Trusted Access for Cyber’ programme brokered with involvement from Japan’s Finance Minister and the US Treasury Secretary. The structural concern: concentrating powerful defensive AI in large, vettable institutions widens the security gap for smaller banks and fintechs. <a href="https://app.daily.dev/posts/PKJaXhGFN" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


CVE disclosures, supply-chain attacks, security incidents, and developer-facing security tooling.

Security Digest

A security-focused roundup covering multiple high-severity incidents: Helm's decommissioned baltocdn.com domain was re-registered by an unknown party and may serve malicious content, threatening CI/CD pipelines still pointing at it. The Gogs RCE argument injection bug now has a public exploit module with the sole maintainer still unresponsive. Dutch police seized 200+ servers dismantling a 17-million-device botnet tied to Russian proxy service ASOCKS. Symfony UX patched seven CVEs including XSS, CSRF bypass, HMAC replay, and DoS issues. Additional notable items include ChatGPT share links weaponized for phishing, an AI-assisted RCE discovery in Elixir's decimal library, Chrome's DBSC rollout, Notepad++ ACE patches, an Axios SSRF bypass, an Android lock screen bypass via Gemini, and a CVSS 10.0 UniFi vulnerability.

Helm's baltocdn.com domain hijacked, Gogs RCE exploit now public