Major Incidents or Breaches

  • GitHub confirmed that approximately 3,800 internal repositories were breached after an employee installed a malicious Visual Studio Code extension. The threat actor TeamPCP has claimed responsibility for accessing around 4,000 repositories containing private code, and GitHub is actively investigating the incident [6][12][14].
  • Grafana Labs disclosed a breach involving its source code repositories, attributed to a supply-chain attack via a compromised npm package (TanStack). The company stated that customer production systems and operations were not affected [5].
  • 7-Eleven confirmed a data breach following a cyberattack claimed by the ShinyHunters extortion group. The incident affected the company’s systems last month [23].
  • NYC Health + Hospitals reported a significant breach via a third-party vendor compromise, exposing sensitive data including biometrics, medical diagnoses, and bank details of at least 1.8 million individuals [46].
  • The US FBI reported that Americans lost over $388 million to scams involving cryptocurrency ATMs in 2025 [18].

Newly Discovered Vulnerabilities

  • A critical, unauthenticated remote code execution vulnerability was disclosed in ChromaDB for AI applications. The flaw, present in the latest Python FastAPI version, allows attackers to hijack exposed servers [15][41].
  • Proof-of-concept exploit code was released for CVE-2026-31635 (“DirtyDecrypt”), a Linux kernel vulnerability allowing local privilege escalation to root. The issue was patched in April [8][45].
  • SEPPMail Secure E-Mail Gateway was found to have critical vulnerabilities that could enable remote code execution and interception of mail traffic [11].
  • Microsoft released mitigations for the “YellowKey” Windows BitLocker zero-day vulnerability, which allows attackers to gain access to protected drives [13].
  • Drupal announced an urgent core security release for all supported branches, addressing a highly critical vulnerability that may be exploited within hours or days of disclosure [10][38].

Notable Threat Actor Activity

  • The TeamPCP threat actor claimed responsibility for breaching thousands of GitHub internal repositories [6][14].
  • The ShinyHunters gang was confirmed to have breached 7-Eleven’s systems [23].
  • A new wave of Shai-Hulud malware resulted in the publication of over 600 malicious packages to the npm registry, continuing a supply-chain attack campaign [22].
  • Researchers observed a major phishing campaign abusing Google AppSheet to relay phishing emails, compromising over 30,000 Facebook accounts [3].
  • Attackers abused the Kuse AI app’s storage and sharing features to assist in phishing campaigns [1].
  • A phishing-as-a-service platform called EvilTokens bypassed MFA by leveraging OAuth consent, compromising over 340 Microsoft 365 organizations in five countries within five weeks [9].
  • A threat actor exploited Microsoft’s Self-Service Password Reset feature in attacks against Microsoft 365 and Azure environments to steal data [19].
  • Attackers are increasingly abusing the legacy Windows MSHTA utility to deliver malware stealthily via phishing and LOLBIN-based attacks [40].
  • The SHub Reaper stealer is targeting macOS users via fake WeChat and Miro installers, using Apple script-based execution for backdoor access [32].

Trends, Tools, or Tactics of Interest

  • Verizon’s 2026 Data Breach Investigations Report (DBIR) found that vulnerability exploitation has overtaken credential abuse as the primary breach vector, now accounting for 31 percent of initial breach access. The report highlights delays in patching and increased use of AI by attackers [29][37].
  • Microsoft disrupted a malware-signing-as-a-service operation, run by the Fox Tempest group, which abused the company’s Artifact Signing service to sign malware and ransomware as legitimate software [16][39].
  • A large-scale Android ad fraud operation, dubbed Trapdoor, used 455 apps to generate 659 million daily bid requests for fraudulent advertising [7].
  • B1ack’s Stash marketplace released 4.6 million stolen credit card records for free, reportedly in response to seller misconduct [42].
  • Discord rolled out end-to-end encryption on all voice and video calls by default [17].
  • YouTube introduced “likeness detection” to combat AI deepfakes, requiring creators to provide biometric data [48].

Regulatory or Policy Developments Affecting the Security Industry

  • The US “Take It Down Act” came into effect on May 19, requiring tech platforms to comply with takedown requests for nonconsensual intimate images, impacting how major platforms address privacy requests [35].
  • Interpol’s “Operation Ramz” involved 13 countries in the Middle East and North Africa, resulting in 201 arrests in the largest coordinated law enforcement cybercrime operation in the region to date [27][44].

[1]: blog.knowbe4.com [3]: blog.knowbe4.com [5]: thehackernews.com [6]: thehackernews.com [7]: thehackernews.com [8]: thehackernews.com [9]: thehackernews.com [10]: thehackernews.com [11]: thehackernews.com [12]: bleepingcomputer.com [13]: bleepingcomputer.com [14]: bleepingcomputer.com [15]: bleepingcomputer.com [16]: bleepingcomputer.com [17]: bleepingcomputer.com [18]: bleepingcomputer.com [19]: bleepingcomputer.com [22]: bleepingcomputer.com [23]: bleepingcomputer.com [27]: darkreading.com [29]: darkreading.com [32]: darkreading.com [35]: wired.com [37]: securityweek.com [38]: securityweek.com [39]: securityweek.com [40]: securityweek.com [41]: securityweek.com [42]: securityweek.com [44]: securityweek.com [45]: securityweek.com [46]: malwarebytes.com [48]: malwarebytes.com

Sources#

  1. GitHub Investigating TeamPCP Claimed Breach of ~4,000 Internal Repositories - thehackernews.com
  2. GitHub confirms breach of 3,800 repos via malicious VSCode extension - bleepingcomputer.com
  3. GitHub investigates internal repositories breach claimed by TeamPCP - bleepingcomputer.com
  4. Grafana GitHub Breach Exposes Source Code via TanStack npm Attack - thehackernews.com
  5. 7-Eleven confirms data breach claimed by the ShinyHunters gang - bleepingcomputer.com
  6. Biometrics, diagnoses, and bank details exposed in major healthcare breach - malwarebytes.com
  7. FBI: Americans lost over $388 million to scams using crypto ATMs in 2025 - bleepingcomputer.com
  8. Max-severity flaw in ChromaDB for AI apps allows server hijacking - bleepingcomputer.com
  9. Unpatched ChromaDB Vulnerability Can Lead to Server Takeover - securityweek.com
  10. DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability - thehackernews.com
  11. PoC Released for DirtyDecrypt Linux Kernel Vulnerability - securityweek.com
  12. SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access - thehackernews.com
  13. Microsoft shares mitigation for YellowKey Windows zero-day - bleepingcomputer.com
  14. Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare - thehackernews.com
  15. Drupal to Patch Highly Critical Vulnerability at Risk of Quick Exploitation - securityweek.com
  16. New Shai-Hulud malware wave compromises 600 npm packages - bleepingcomputer.com
  17. Phishing Campaign Exploits Google AppSheets to Target Facebook Accounts - blog.knowbe4.com
  18. Warning: Phishing Attacks Are Abusing the Kuse AI App - blog.knowbe4.com
  19. The New Phishing Click: How OAuth Consent Bypasses MFA - thehackernews.com
  20. Microsoft Self-Service Password Reset abused in Azure data theft attacks - bleepingcomputer.com
  21. Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks - securityweek.com
  22. Stealer Spoofs Google, Microsoft & Apple, Then Backdoors macOS - darkreading.com
  23. Verizon DBIR: Enterprises Face a Dangerous Vulnerability Glut - darkreading.com
  24. Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector - securityweek.com
  25. Cybercrime service disrupted for abusing Microsoft platform to sign malware - bleepingcomputer.com
  26. Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’ - securityweek.com
  27. Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps - thehackernews.com
  28. B1ack’s Stash Marketplace Gives Away 4.6 Million Stolen Credit Cards - securityweek.com
  29. Discord rolls out end-to-end encryption on voice, video calls - bleepingcomputer.com
  30. YouTube wants your face to fight deepfakes - malwarebytes.com
  31. You Can Get Some of Your Nudes Removed From the Internet Under a New Law - wired.com
  32. Interpol's 'Operation Ramz' Pioneers Cross-Region Collabs in Middle East - darkreading.com
  33. 201 Arrested in Crackdown on Cybercrime in Middle East, North Africa - securityweek.com