Cybersecurity Brief – 2026-05-17

Major Incidents or Breaches

Grafana disclosed that an unauthorized party obtained a token granting access to its GitHub environment, resulting in the download of its codebase and an extortion attempt against the company ^[1].
Instructure’s Canvas platform was impacted by a ransomware incident, which has now concluded ^[6].
OpenAI workers were affected by a supply chain attack, though specifics regarding the method or scope were not detailed ^[6].

Newly Discovered Vulnerabilities

A critical vulnerability in the Funnel Builder plugin for WordPress is under active exploitation, enabling attackers to inject malicious JavaScript into WooCommerce checkouts for skimming payment information ^[2].
Proof-of-concept code has been published for a critical vulnerability in NGINX Plus and NGINX open source, which was introduced in 2008 and only recently patched ^[7].
A security researcher alleged that Microsoft quietly fixed a critical Azure Backup for AKS vulnerability without issuing a CVE, after initially rejecting the report. Microsoft disputes these claims ^[3].

Notable Threat Actor Activity

The Russian threat group Secret Blizzard has evolved the Kazuar backdoor into a modular peer-to-peer botnet, enhancing its capabilities for long-term persistence, stealth operations, and data collection ^[4].
An alleged darknet market kingpin was arrested, though further operational details were not provided ^[6].

Trends, Tools, or Tactics of Interest

AI agents are increasingly being used to discover and exploit obscure vulnerabilities, while the surge in AI-generated code is contributing to a growing attack surface and new security challenges for defenders ^[5].