Cybersecurity Brief – 2026-05-26

Tue, 26 May 2026 00:00:00 +0000

Major Incidents or Breaches

7-Eleven suffered a data breach in April resulting in the compromise of personal information belonging to over 183,000 individuals. The ShinyHunters extortion group was responsible for the attack, which targeted the systems of the convenience store chain^[7]^[25].
The Oncology Institute disclosed a data breach caused by a third-party vendor, with the specific vendor not named^[20].
Radiology Associates of Richmond experienced a data breach affecting 266,000 individuals, with threat actors stealing files containing names and protected health information^[21].
DocketWise reported a data breach impacting 143,000 people, involving the compromise of names, addresses, Social Security numbers, financial information, and medical data from third-party partner repositories^[24].

A now-patched high-severity flaw in the Digital Knowledge KnowledgeDeliver LMS was exploited as a zero-day, enabling attackers to deploy Godzilla web shells and Cobalt Strike beacons^[1].
A critical vulnerability in Ghost CMS, tracked as CVE-2026-26980, is being actively exploited to inject malicious JavaScript code for ClickFix attacks. Over 700 websites, including those of major universities and DuckDuckGo, have been compromised^[3]^[19].
Microsoft confirmed a known issue with Windows Server 2016 after the KB5087537 May 2026 security update, causing domain controller lookups to fail^[6].

The North Korea-linked Lazarus Group has deployed the RemotePE cross-platform memory-only remote access trojan (RAT) in attacks targeting financial and cryptocurrency organisations^[5].
The ShinyHunters extortion gang was identified as the actor behind the 7-Eleven breach^[7]^[25].
TeamPCP continues its supply chain campaign, operating across three package ecosystems, trojanising an officially Microsoft-published Python SDK, and reaching GitHub’s internal codebase^[17]^[18].
The FBI issued a warning regarding the Kali365 phishing-as-a-service platform, which targets Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass multifactor authentication^[9].

Attackers are increasingly exploiting supply chain weaknesses, as demonstrated by the TeamPCP campaign and the poisoning of Laravel-Lang packages to deliver malware and exfiltrate CI secrets^[17]^[18]^[23].
The AI-driven bug hunting arms race is intensifying, with attackers leveraging AI for exploit development and defenders using AI models such as Anthropic’s Mythos, which detected 23,000 potential vulnerabilities across 1,000 open-source projects, many of which are critical or high severity^[12]^[22].
There is a rise in phishing-as-a-service platforms, with Kali365 providing tools to bypass multifactor authentication protections on Microsoft 365 accounts^[9].
Recent incidents highlight the use of memory-only malware and advanced remote access trojans, as seen in Lazarus Group’s deployment of RemotePE^[5].

Dutch authorities seized 800 servers and arrested two individuals connected to hosting infrastructure used by Russian state actors for cyberattacks and influence operations^[13].