docs: add Hacker Wars - May 19, 2026

Author: ps1dr3x

content/bulletin/2026-05-19.md

@@ -0,0 +1,64 @@
+---
+title: "Hacker Wars - May 19, 2026"
+date: 2026-05-19T08:00:00+02:00
+draft: false
+author: "sig9"
+type: "bulletin"
+feature_image: "/images/bulletin/hacker-wars-2026-05-19.png"
+---
+
+_Your daily dose of infosec chaos_
+
+---
+
+Tuesday's serving of security nightmares is here, and it's a mixed bag of supply chain attacks, government-grade credential leaks, and robots that apparently don't know how to say no to arbitrary commands. Grab your coffee and let's dive in.
+
+---
+
+### CISA Contractor Leaks AWS GovCloud Keys on GitHub
+
+A contractor for CISA - yes, the US government's cybersecurity agency - accidentally pushed AWS GovCloud credentials to a public GitHub repo. The exposed keys granted access to highly privileged accounts and a swath of internal CISA systems. You really can't make this stuff up.
+
+**What to do:** Rotate any AWS keys that may have been exposed, audit your GitHub repos for accidental credential commits, and enable secret scanning on all repositories.
+
+---
+
+### GitHub Actions Supply Chain Attack Steals CI/CD Credentials
+
+Threat actors compromised the popular actions-cool/issues-helper GitHub Action, rewriting all existing tags to point to a malicious commit. The poisoned workflow harvested CI/CD secrets and exfiltrated them to an attacker-controlled server. If your pipelines use this action, assume your secrets are gone.
+
+**What to do:** Audit your GitHub Actions workflows for dependencies on actions-cool/issues-helper, rotate all CI/CD secrets, and pin your actions to specific commit SHAs instead of tags.
+
+---
+
+### Critical Flaw Exposes Industrial Robot Fleets to Remote Hacking
+
+CVE-2026-8153 is a critical OS command injection vulnerability in Universal Robots PolyScope 5, the software powering fleets of industrial robots worldwide. An attacker could exploit this to execute arbitrary commands on robot controllers - which is exactly as terrifying as it sounds when heavy machinery is involved.
+
+**What to do:** Apply vendor patches immediately, segment industrial robot networks from corporate and internet-facing systems, and monitor for unusual command execution on robot controllers.
+
+---
+
+### SHub macOS Infostealer Now Spoofs Apple Security Updates
+
+A new variant of the SHub infostealer targets macOS users by displaying a convincing fake Apple security update dialog via AppleScript. Once the user clicks through, it installs a backdoor and starts siphoning credentials. Social engineering meets malware, macOS edition.
+
+**What to do:** Only install macOS updates through System Settings, never from pop-up dialogs. Deploy endpoint detection on macOS devices and educate users about this attack vector.
+
+---
+
+### INTERPOL Operation Ramz Takes Down 200 Cybercriminals
+
+In a refreshing change of pace, INTERPOL's Operation Ramz resulted in the seizure of 53 malware and phishing servers and over 200 arrests across the Middle East and North Africa. The operation targeted cybercriminals running phishing campaigns and distributing malware. Sometimes the good guys do win.
+
+**What to do:** No action needed - just enjoy this one. Consider it a palate cleanser between the doom and gloom.
+
+---
+
+Catch you tomorrow. In the meantime, go check your attack surface.
+
+---
+
+_Brought to you by sig9_ - sig9.ch | _Protecting the unseen, securing the unknown_
+
+*This bulletin is provided for informational purposes. Contact us for tailored security analysis.*