Summaries

Week in Review: SANS Stormcast Covers Drupal Exploitation, Server Takedowns, and Supply Chain Escalation

The SANS ISC Stormcast for May 22, 2026 wraps the week's cybersecurity developments — including mass exploitation of Drupal SQLi, Dutch police seizure of cybercrime-enabling hosting, and ongoing supply chain compromise campaigns targeting package registries.

View on Graph

Summary

The Friday, May 22 edition of the SANS ISC Stormcast provides the week’s broader context rather than just a single-day snapshot. Host Johannes Ullrich highlights the Drupal core SQL injection exploitation wave as the week’s most consequential development, with CVE-2026-9082 attacks scaling rapidly across thousands of sites. The Friday format allows for connecting this event to broader trends in CMS-targeted attacks and the compressed patching timelines organizations face.

A notable story covered is the Dutch police server seizure operation — law enforcement action against hosting infrastructure that enabled cyberattack operations. While details remain limited, this enforcement action signals growing international coordination against cybercrime-enabling services, from bulletproof hosting to malware distribution infrastructure.

Supply chain compromise campaigns continued their escalation across npm, PyPI, and Packagist registries, with the TeamPCP-associated Mini Shai-Hulud worm remaining active. The Stormcast frames these not as isolated incidents but as an evolved threat model where attackers target the trust relationships in open-source supply chains rather than individual vulnerabilities.

Why It Matters

Friday Stormcast editions are particularly valuable because they synthesize a week’s worth of threats into actionable context. For teams running weekly threat briefings, the May 22 episode provides a clean triage framework: patch Drupal, investigate any anomalous Defender behavior, monitor package registry activity, and check whether any internal infrastructure relies on the seized hosting providers.

Defender Takeaways

  • Prioritize Drupal Core patching across all externally facing instances; CVE-2026-9082 exploitation is confirmed at scale with thousands of attacks observed.
  • Investigate whether any internal systems or vendors relied on the hosting infrastructure targeted by Dutch law enforcement; service disruption or C2 relocation may follow.
  • Run a dependency audit across npm, PyPI, and Packagist for packages matching indicators associated with the Mini Shai-Hulud and TeamPCP campaigns.
  • Update weekly threat briefings to include the three concurrent pressure points: CMS exploitation, law enforcement disruption effects, and supply chain integrity.
  • Review incident response plans for supply chain compromise — ensure playbooks cover the scenario where a trusted dependency becomes a vector.

Source

Title: ISC Stormcast For Friday, May 22nd, 2026 — Johannes Ullrich, SANS Internet Storm Center
URL: https://isc.sans.edu/diary/rss/33004