Major Incidents or Breaches

  • Grafana Labs disclosed that hackers stole its source code by breaching its GitHub environment using a stolen access token [19].
  • 7-Eleven confirmed a data breach after the ShinyHunters group demanded ransom, with attackers claiming theft of over 600,000 Salesforce records containing personal and corporate data [34].
  • Several large-scale healthcare data breaches in the US were reported, impacting hundreds of thousands to millions of individuals [32].
  • Vodafone, a major international telecom, sustained a cyberattack, as highlighted in recent threat intelligence reporting [37].
  • A CISA contractor publicly exposed highly privileged AWS GovCloud credentials on GitHub until the past weekend [28].
  • INTERPOL’s Operation Ramz led to the arrest of over 200 individuals and the seizure of 53 malware and phishing servers across the Middle East and North Africa, disrupting regional cybercrime networks [8][15].

Newly Discovered Vulnerabilities

  • A zero-day cross-site scripting vulnerability in Microsoft Exchange (CVE-2026-42897) is under active exploitation, with no patch currently available. The flaw allows attackers to compromise Outlook Web Access (OWA) mailboxes [21][9].
  • Four vulnerabilities in the OpenClaw AI agent framework, collectively known as “Claw Chain,” have been patched. These flaws allowed attackers to steal credentials, escalate privileges, escape sandboxes, and maintain persistence [22][33].
  • Universal Robots PolyScope 5 is affected by a critical OS command injection vulnerability (CVE-2026-8153), which could allow attackers to compromise industrial robot fleets [31].
  • Ivanti, Fortinet, SAP, VMware, and n8n released security updates addressing remote code execution, SQL injection, and privilege escalation vulnerabilities [12].
  • A Windows privilege escalation zero-day, dubbed MiniPlasma, enables SYSTEM-level access on fully patched systems. A proof-of-concept exploit has been released [13][35].

Notable Threat Actor Activity

  • The ShinyHunters group claimed responsibility for the 7-Eleven data breach, demanding ransom and exposing sensitive Salesforce records [34].
  • The Mini Shai-Hulud campaign compromised npm packages in the @antv ecosystem, distributing infostealers and DDoS malware via supply chain attacks [7][14][18][23][36].
  • Threat actors compromised the popular GitHub Actions workflow “actions-cool/issues-helper” to steal CI/CD credentials through a supply chain attack [6].
  • The TeamPCP group continues its supply chain campaign, including a confirmed compromise of the Checkmarx Jenkins plugin and the emergence of a self-spreading npm worm [30].
  • A new SHub macOS infostealer variant was observed spoofing Apple security updates using AppleScript to install a backdoor [16].

Trends, Tools, or Tactics of Interest

  • Multiple software supply chain attacks have targeted developer workstations and development tools, including compromised VS Code extensions, malicious npm packages, and hijacked GitHub Actions workflows [5][6][7][11][14][18][23][30][36].
  • The release and subsequent adoption of the Shai-Hulud worm source code have accelerated the spread of self-replicating malware targeting npm developers [14][18][23][36].
  • AI agents are increasingly being used to discover and exploit obscure vulnerabilities, while the proliferation of AI-generated code introduces new risks for defenders [4][25].
  • There is a documented increase in mobile malware, with new versions of SparkCat and Triada identified as notable threats in Q1 2026 [1].
  • Social engineering and phishing remain highly profitable for attackers, with Americans losing $2.1 billion to social media scams in 2025 [3].
  • Shadow AI tool usage by employees is widespread, prompting recommendations for practical AI governance to manage associated risks [17].
  • Microsoft Edge will change its handling of saved passwords so they are no longer stored in plaintext memory throughout the browser session [38].

Regulatory or Policy Developments Affecting the Security Industry

  • INTERPOL’s Operation Ramz represents a significant international law enforcement effort targeting cybercrime infrastructure and actors in the MENA region [8][15].
  • The exposure of AWS GovCloud credentials by a CISA contractor raises concerns about government cloud security practices [28].

Sources#

  1. Grafana says stolen GitHub token let hackers steal codebase - bleepingcomputer.com
  2. 7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand - securityweek.com
  3. Millions Impacted Across Several US Healthcare Data Breaches - securityweek.com
  4. 18th May – Threat Intelligence Report - research.checkpoint.com
  5. CISA Admin Leaked AWS GovCloud Keys on Github - krebsonsecurity.com
  6. INTERPOL Operation Ramz Disrupts MENA Cybercrime Networks with 201 Arrests - thehackernews.com
  7. INTERPOL ‘Operation Ramz’ seizes 53 malware, phishing servers - bleepingcomputer.com
  8. Microsoft Exchange Zero-Day Under Attack, No Patch Available - darkreading.com
  9. ⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More - thehackernews.com
  10. 'Claw Chain' Vulnerabilities Threaten OpenClaw Deployments - darkreading.com
  11. ‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery - securityweek.com
  12. Critical Vulnerability Exposes Industrial Robot Fleets to Hacking - securityweek.com
  13. Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws - thehackernews.com
  14. MiniPlasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems - thehackernews.com
  15. Researcher Drops MiniPlasma Windows Exploit for Unpatched 2020 CVE - securityweek.com
  16. Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account - thehackernews.com
  17. Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware - thehackernews.com
  18. Leaked Shai-Hulud malware fuels new npm infostealer campaign - bleepingcomputer.com
  19. Shai-Hulud Worm Clones Spread After Code Release - darkreading.com
  20. First Shai-Hulud Worm Clones Emerge - securityweek.com
  21. Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials - thehackernews.com
  22. TeamPCP Supply Chain Campaign: Activity Through 2026-05-17, (Mon, May 18th) - isc.sans.edu
  23. SHub macOS infostealer variant spoofs Apple security updates - bleepingcomputer.com
  24. Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer - thehackernews.com
  25. Developer Workstations Are Now Part of the Software Supply Chain - thehackernews.com
  26. What Is an Al Agent in Cybersecurity? - blog.knowbe4.com
  27. The Boring Stuff Is Dangerous Now - darkreading.com
  28. IT threat evolution in Q1 2026. Mobile statistics - securelist.com
  29. FTC: Americans Lost $2.1 Billion to Social Media Scams Last Year - blog.knowbe4.com
  30. 5 Steps to Managing Shadow AI Tools Without Slowing Down Employees - bleepingcomputer.com
  31. Microsoft is changing Edge’s plaintext password behavior - malwarebytes.com