Security Roundup Covers Router Exploitation, CISA Credential Exposure and Gas Station Intrusions

May 22, 2026 · Original article ↗

Summary

A weekly roundup covers suspected intrusions into gas-station tank monitors, exposed CISA contractor credentials, a Huawei router flaw linked to a telecom outage, Four-Faith router botnet exploitation, and other security developments.

Key points

US officials suspect Iranian hackers accessed gas-station tank-monitor systems through unprotected internet-connected devices. The attackers could alter display readings, not fuel levels; no physical damage or safety incidents were reported.
A CISA contractor left a public GitHub repository exposing AWS GovCloud administrative keys and plaintext passwords for internal systems. CISA said there was no evidence of unauthorized access to sensitive data.
POST Luxembourg confirmed a July 2025 telecom outage lasting over three hours was caused by a Huawei router flaw. The disruption affected landline, 4G and 5G services and emergency communications; patch status is unclear.
CrowdSec tracked mass exploitation of CVE-2024-9643, an authentication bypass in Four-Faith F3x36 industrial routers, with compromised devices being added to botnets.
Anthropic added threat-intelligence sharing to its Mythos platform. In tests across more than 50 repositories, Cloudflare reported the model could build exploit chains and working proofs of concept, but also found high false-positive rates and inconsistent refusals.
A five-year operation dubbed Patriot Bait used an AI-assisted fake persona for influence activity and financial fraud targeting US audiences; the operator targeted credentials and cryptocurrency wallets.
Researcher Chinmohan Nayak reported that Open WebUI CVE-2026-45401 allows SSRF through redirect-chain handling, potentially exposing internal resources and cloud metadata endpoints.
CISA launched an online form for researchers, vendors and industry partners to nominate known exploited vulnerabilities for review and possible inclusion in its catalog.

Article Details

Event Type: Weekly cybersecurity news roundup covering suspected intrusions, exposed credentials, vulnerability exploitation, security research, and policy updates.
Impact: US officials believe Iranian hackers breached internet-connected gas station tank-monitoring systems across multiple states and altered display readings, but not actual fuel volumes; no physical damage or safety incidents were reported. A CISA contractor's public GitHub repository exposed administrative keys for multiple AWS GovCloud accounts and plaintext passwords for internal CISA systems, though CISA said there was no evidence of unauthorized access to sensitive data so far. A Huawei enterprise router vulnerability caused a Luxembourg telecom outage affecting landline, 4G, and 5G services for over three hours and disrupting emergency communications for hundreds of thousands of residents; patch status is unclear. Attackers have been exploiting a Four-Faith router authentication bypass and incorporating compromised devices into botnets. The roundup also reports an Open WebUI SSRF vulnerability that can expose internal resources, including cloud metadata endpoints.