AutoCypher – Page 5 – Trackr.Live

§ Author

CVE-2026-42897: The Exchange OWA XSS Zero-Day, the EEMS Mitigation, and the Period-2 ESU Patch Cliff Most Coverage Buries

CVE-2026-42897 is an actively exploited OWA cross-site-scripting flaw in Microsoft Exchange Server 2016, 2019, and Subscription Edition. CVSS 8.1, KEV-listed, federal remediation deadline May 29. A specially crafted email runs JavaScript in the victim’s OWA session — session token theft, mailbox read, send-as, mailbox rules — and the catch buried in Microsoft’s guidance is that a permanent patch is gated behind Period 2 ESU enrollment for everyone still on 2016 or 2019. The EEMS mitigation works, with caveats. Here’s what’s real about it.

Cyber Tools

Detecting DPRK IT Worker Infiltration: What the Signal Actually Looks Like

A defender’s view of the Famous Chollima / Nickel Tapestry IT worker scheme as it looks in 2026 — the telemetry that actually catches it, the false positives that swamp you in week one, and where it sits in the 800-53 catalog.

Cyber Tools

TeamPCP Claims a 4,000-Repo GitHub Source Code Sale: What Goes in the Verification Column, and What You Actually Patch Around

TeamPCP — the supply-chain crew behind the Trivy / Checkmarx / KICS / LiteLLM compromises and the Shai-Hulud worm — surfaced a sale listing on May 19, 2026 claiming roughly 4,000 GitHub private repositories of internal source code. The claim is pending verification, the ESIX score is 7.96, and the group’s track record is exactly the mix of ‘demonstrably capable’ and ‘inclined to repackage’ that makes this kind of listing operationally annoying. Here’s the read.

Volt Typhoon at Year Three: Pre-Positioning Detection in 2026

A defender-side look at where PRC pre-positioning campaigns against critical infrastructure stand heading into 2026, what living-off-the-land actually looks like in the SIEM, and which tuning calls separate the teams that catch it from the teams that don’t.

Image-mode Linux and bootc: the hardening you stop doing, and the hardening you have to start

Image-mode RHEL and bootc move /usr to a read-only ostree commit and turn host updates into container pulls. That fixes one class of problem and creates a different one for defenders. Here is what actually changes on disk, what to detect, and where the model breaks.

Cyber Tools

HTTP/2 desync in 2026: parser differentials are still the gift that keeps giving

A defender-oriented look at where HTTP/2-to-HTTP/1.1 request smuggling sits in 2026 — the parser-differential class that keeps finding new homes, what the detection actually looks like in Splunk, and what most teams miss on the first tuning pass.

YellowKey and GreenPlasma: A USB Stick, a Transaction Log, and Why BitLocker on a Stolen Laptop Is Now a Breach Notification

Chaotic Eclipse dropped two unpatched Windows zero-days on May 13, 2026. YellowKey turns an NTFS transaction log on a USB stick into a BitLocker bypass through WinRE — physical access, no recovery key, no PIN required on TPM-only boxes. GreenPlasma is the companion privilege escalation through CTFMON. No CVEs, no patches, and a researcher who has promised more for June’s Patch Tuesday.

Token Theft After DBSC: What Identity Detection Actually Looks Like in 2026

Device Bound Session Credentials are landing in Chrome and Edge, but the gap between the protocol promise and what your SIEM sees is wider than the vendor decks suggest. A defender-oriented look at what detection actually requires right now.

Token theft after AitM phishing in Entra ID: what the SignInLogs actually show in 2026

A defender-oriented walkthrough of investigating adversary-in-the-middle token theft against Entra ID now that token protection, CAE, and device-bound sessions are widely on — what the logs actually contain, what the first detection misses, and where the artifacts live outside Entra.

Cyber Tools

ClickFix Detection Without the Fairy Tale

ClickFix initial access has been pasting PowerShell into RunMRU for two years and most detection content still treats it like a primer. Here is what the telemetry actually looks like, what tunes out, and where teams keep getting it wrong.