Exchange Zero-Day Mid-Patch-Cycle, YellowKey Drops BitLocker, Kazuar Goes P2P, and Mini Shai-Hulud Hits OpenAI

News

Microsoft Exchange Server Zero-Day CVE-2026-42897 Exploited in the Wild via Crafted Email

A brand-new Exchange OWA spoofing flaw dropped 48 hours after a supposedly clean Patch Tuesday, and it is already being actively exploited. On-prem Exchange 2016, 2019, and SE users need to run the EOMT script or enable the Emergency Mitigation Service right now since there is no permanent patch yet.

OpenAI Confirms Employees Hit in Mini Shai-Hulud Supply Chain Attack, Rotating Code-Signing Certificates

The TanStack Mini Shai-Hulud worm hit two OpenAI employee machines and exfiltrated limited credential material including code-signing certs, forcing the company to rotate all signing keys and warn macOS users to update before June 12 or get blocked by Gatekeeper. This is the first major enterprise disclosure tied to the TeamPCP worm campaign that hit 170-plus npm and PyPI packages.

RubyGems Suspends New Account Sign-Ups After 500-Plus Malicious Packages Flood the Registry

RubyGems had to pull the emergency brake on new registrations this week after a bot-driven campaign pushed over 500 malicious packages in two days, the first such lockdown in the registry's history. The incident ran in parallel with GemStuffer using the registry as a data dead-drop for scraped UK government portal content, signaling that attackers are probing open-source registries as covert infrastructure not just delivery channels.

Vulnerability

YellowKey and GreenPlasma: Disgruntled Researcher Drops Unpatched Windows BitLocker Bypass and SYSTEM Escalation PoCs

Chaotic Eclipse released working PoC code one day after May Patch Tuesday, timing the drop to maximize the gap before a fix can ship. YellowKey defeats TPM-only BitLocker via WinRE abuse, and GreenPlasma abuses CTFMON to reach SYSTEM from an unprivileged account. Neither has a patch or CVE assignment yet.

Threat Intelligence

Microsoft Reveals Kazuar Evolved Into Modular P2P Botnet With Leader Election and Near-Zero Network Noise

Microsoft's full teardown of Turla's Kazuar shows it has moved from a traditional backdoor into a three-module P2P ecosystem where only a single elected leader talks to the C2, keeping the rest of the botnet silent and detection-evasive. The payload is device-bound on delivery, making early catch almost impossible without behavioral detection of named pipe activity and encrypted working directory writes.

Turla's FSB-Linked Kazuar Backdoor Rearchitected as Stealth P2P Botnet Targeting European Government and Defense

The Hacker News writeup adds context to the Microsoft deep-dive, specifically the Pelmeni dropper chain, the HTTP/WebSocket/EWS multi-transport fallback, and the government and diplomatic sector targeting in Europe and Central Asia. Good companion read for defenders building detections since the IOC list and hunting guidance are summarized here.

Analysis

Mini Shai-Hulud Worm: How TeamPCP Chained GitHub Actions, Cache Poisoning, and OIDC Token Theft to Hit 518M-Download Packages

The full technical breakdown of how TanStack, Mistral AI, UiPath, and Guardrails AI were all compromised through a three-step GitHub Actions chain that ended with the CI pipeline publishing malicious packages under the project's own trusted OIDC identity. The wiper payload that triggers on token revocation is the detail defenders need to know: do not rotate npm tokens before isolating the runner.

Chaotic Eclipse Pattern: Previous PoC BlueHammer Was Exploited Within Four Days of Disclosure

SecurityWeek adds the critical context that this is not a one-off: the same researcher's last drop, BlueHammer, was weaponized in under four days. That baseline means the clock is already running on YellowKey and GreenPlasma, and enterprise teams should treat physical-access laptop scenarios as elevated risk immediately rather than waiting for a CVE.