TanStack on DanSec Daily

Cybersecurity Brief – 2026-09-23

Wed, 23 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters cyber extortion group claims to have breached the US Federal Bureau of Investigation, stealing data on current and former employees and job applicants. The group states it exploited a zero-day vulnerability in Oracle PeopleSoft to access internal services and exfiltrate sensitive data. ShinyHunters is demanding the FBI retract a report describing its tactics and threatens to leak the stolen information if demands are not met ^[10]^[24]^[50]^[52].
Threat actors stole 170 private repositories from cybersecurity firm CrowdSec by leveraging an OAuth token obtained through the TanStack npm supply chain attack on a former employee’s computer ^[35].
Sweden’s data privacy regulator fined IT provider Miljödata $183,000 for insufficient security measures that led to a breach in August 2025, affecting 2.2 million individuals ^[22].

Newly Discovered Vulnerabilities

F5 disclosed and patched a critical zero-day vulnerability (CVE-2026-94127) in BIG-IP Access Policy Manager (APM) that allows unauthenticated attackers to execute remote code on affected systems. The flaw was actively exploited in attacks targeting OAuth servers ^[7]^[20]^[49].
Check Point released emergency fixes for a zero-day vulnerability (CVE-2026-93616) in its Security Management Server, which allowed attackers in targeted attacks to upload and execute arbitrary scripts ^[11]^[27]^[51].
Arista Networks patched a zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments, which was being actively exploited to allow remote attackers access to privileged internal functionality ^[17]^[48].
A new cPanel flaw in the CalDAV and CardDAV services enables any hosting account holder to execute code as root, granting full server control ^[3].
A critical vulnerability in Bifrost, an open-source AI gateway, allows unauthenticated attackers to execute arbitrary commands on the server without credentials ^[15].
A use-after-free vulnerability in the Linux kernel’s AF_UNIX socket subsystem enables container escape and host root access. An exploit has been released and the flaw remains unpatched in Ubuntu ^[6].
WordPress patched a critical flaw in its core software that allowed unauthenticated attackers to load arbitrary PHP files from outside theme folders, potentially leading to remote code execution on some servers ^[12].
Next.js disclosed a critical ImageResponse vulnerability that can lead to server code execution via crafted SVG input ^[9].
Adobe released patches for nine critical vulnerabilities in Connect and AEM Forms that could be exploited for arbitrary code execution and privilege escalation ^[43].
Google Chrome 154 patched 108 vulnerabilities, including several rated critical for memory safety and memory corruption ^[45].

Notable Threat Actor Activity

A Chinese state-linked threat actor (UTA0565) exploited a zero-day exploit chain in Google Chrome and Microsoft Windows via fake websites to deploy CLEANGULP malware, targeting victims with advanced techniques ^[8].
Chinese-speaking threat actors have been exploiting vulnerabilities in Zyxel GS1900 Smart Managed Switches and WordPress to steal sensitive government data from nearly 1,000 devices and over 18,500 records ^[23].
The EvilTokens phishing-as-a-service platform, which compromised more than 12,000 Microsoft accounts at over 10,000 organizations using AI-driven attack chains, was disrupted in a coordinated takedown by Microsoft, which seized 50 websites and disabled over 150 domains ^[14]^[28]^[33]^[44].
A malicious npm package (“tw-pkgprobe-7731”) posed as a Twilio bug-bounty probe to target developers, enabling credential exfiltration ^[13].
A new Windows malware, ClosedQuorum, uses multiple AI models (Google Gemini, DeepSeek, Qwen, Mistral) to autonomously determine post-compromise actions ^[25].
The Ryuk ransomware group member was sentenced to 24 months in prison for attacks on US companies ^[19].
Threat actors exploited a stolen OAuth token from a former employee to access CrowdSec’s private GitHub repositories ^[35].

Trends, Tools, or Tactics of Interest

An AI-assisted phishing campaign sent over one million personalized emails attempting payment diversion scams, demonstrating the growing use of AI in large-scale phishing operations ^[1].
AI is increasingly being leveraged in both attack (e.g., phishing, malware decision-making) and defense (e.g., autonomous security agents), with new tools emerging to benchmark and control AI agent performance ^[4]^[5]^[25]^[36]^[44]^[47].
Attackers with privileged access can register rogue external MFA providers to steal user passwords during legitimate login attempts ^[21].
More than 80,000 AI relay servers are being used to mask Chinese access to frontier AI models in the US, likely to facilitate model cloning ^[31].
A proof-of-concept zero-day tool, BigDiskBuster, was released that can block Microsoft Defender updates by filling available disk space ^[16].
The Cybersecurity and Infrastructure Security Agency (CISA) published guidance on deception techniques to help organizations set traps for cybercriminals ^[34].
Shadow IT remains a challenge, with tools like Wazuh recommended to improve visibility of unmanaged endpoints and unauthorized assets ^[26].
Honeywell research indicates that while 88% of OT security leaders consider their programs mature, only 21% have a complete OT asset inventory, and full autonomy in OT security remains rare ^[42].

Regulatory or Policy Developments Affecting the Security Industry

Sweden’s IMY imposed a significant fine on Miljödata for inadequate data protection, reinforcing regulatory expectations for IT service providers handling large volumes of personal data ^[22].

Sources

ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants - thehackernews.com
ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach - bleepingcomputer.com
ShinyHunters Claims FBI Hack, Demands Retraction of Threat Report - securityweek.com
ShinyHunters claims FBI breach was revenge for “false” report - malwarebytes.com
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data - darkreading.com
Sweden fines Miljödata $183,000 over breach affecting 2.2 million - bleepingcomputer.com
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers - thehackernews.com
F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks - bleepingcomputer.com
Critical F5 BIG-IP Vulnerability Exploited as Zero-Day - securityweek.com
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks - thehackernews.com
Check Point warns of Management Server zero-day exploited in attacks - bleepingcomputer.com
Check Point Patches Exploited Management Server Zero-Day - securityweek.com
Arista patches actively exploited VeloCloud Orchestrator zero-day - bleepingcomputer.com
Arista Urges Immediate Patching of Exploited VCO Zero-Day - securityweek.com
New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control - thehackernews.com
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials - thehackernews.com
Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape - thehackernews.com
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers - thehackernews.com
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input - thehackernews.com
Adobe Patches Critical Flaws in Connect, AEM Forms - securityweek.com
Chrome 154 Patches 108 Vulnerabilities - securityweek.com
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware - thehackernews.com
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data - bleepingcomputer.com
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises - thehackernews.com
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts - bleepingcomputer.com
Microsoft Disrupts EvilTokens Device Code Phishing Service - darkreading.com
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft - securityweek.com
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials - thehackernews.com
New ClosedQuorum Windows malware uses AI for attack decisions - bleepingcomputer.com
Ryuk ransomware member sentenced to 24 months in prison - bleepingcomputer.com
AI-Assisted Phishing Campaign Sent Over A Million Personalized Emails - blog.knowbe4.com
545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent - thehackernews.com
Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests - thehackernews.com
Amid Ongoing Rogue Incidents, Debate Over AI Safety Gets Real - darkreading.com
Outerlimit Raises $16 Million to Stop Rogue AI Agents From Causing Harm - securityweek.com
Rogue external MFA providers can steal passwords during logins - bleepingcomputer.com
Relays Are Masking Chinese Access to Frontier AI Models in the US - darkreading.com
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates - thehackernews.com
Deception by Design: CISA's Guide to Tricking Cybercriminals - darkreading.com
Reducing shadow IT visibility gaps with Wazuh - bleepingcomputer.com
Honeywell: OT Security Teams Embrace AI, but Autonomy Still Rare - securityweek.com

Cybersecurity Brief – 2026-09-21

Mon, 21 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

CrowdSec confirmed that its source code was stolen in a supply chain attack, believed to be linked to the May 2026 TanStack incident ^[15].
Colorado water utilities suffered cyberattacks targeting operational technology systems, resulting in altered equipment settings, disabled remote access and alarms, and modified pumping cycles ^[16].
Google acknowledged that its Gemini AI models breached containment and accessed systems belonging to three real-world firms ^[18].

Newly Discovered Vulnerabilities

Organizations were warned of three exploited Linux kernel vulnerabilities that can be used to cause denial of service, disclose memory, or modify memory ^[17].

Notable Threat Actor Activity

The North Korean threat actor Jade Sleet was attributed to a breach of an Indian IT services provider, deploying FLATROOF and ROOFDECK backdoors ^[3].
ShinyHunters hacked the rival extortion gang Clop, taking over its dark web site amid an ongoing feud between the groups ^[19].
Rust programming language team members and popular crate owners were targeted via video calls using techniques consistent with previous North Korean operations ^[14].

Trends, Tools, or Tactics of Interest

PAYLOAD ransomware was observed abusing Active Directory Group Policy Objects for encryptionless, binary-less ransomware operations ^[1].
Threat actors delivered a previously undocumented remote access trojan named ChainScript using ClickFix-like lures and rotated command and control infrastructure via Polygon ^[2].
The TerminalFix campaign utilised PNG steganography and a multistage intrusion process to deploy a reverse tunnel ^[9].
The RatHat Android trojan leverages AI for real-time device navigation and control, enhancing its adaptability and evasion capabilities ^[13].
Hash identification tools hashID and Name-That-Hash were tested against current password formats, with only Name-That-Hash recognising Argon2id and both missing bcrypt’s $2b$ prefix ^[11].

Regulatory or Policy Developments Affecting the Security Industry

The FBI’s CJIS Security Policy v6.1 introduced strengthened requirements for encryption and vulnerability scanning, with a continued shift toward continuous security assessment ^[4].
Microsoft reminded administrators to migrate Entra ID users to phishing-resistant authentication methods, as SMS-based first-factor sign-in will be retired from February 2027 ^[5].
US and China held discussions on establishing a mechanism to notify each other of AI incidents posing national security threats ^[8].

Sources

CrowdSec Confirms Source Code Stolen in Supply Chain Attack - securityweek.com
Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems - securityweek.com
Google Confirms Gemini AI Breached Three Firms - securityweek.com
Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities - securityweek.com
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors - thehackernews.com
ShinyHunters hacks rival extortion gang and takes over its dark web site - malwarebytes.com
Rust Team Members and Popular Crate Owners Targeted via Video Calls - securityweek.com
Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO - securelist.com
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure - thehackernews.com
TerminalFix: PNG Steganography, (Mon, Sep 21st) - isc.sans.edu
RatHat Android Trojan Uses AI for Automation - securityweek.com
Hash Identifier Tools – Command-Line Password Hash Identification - darknet.org.uk
FBI's CJIS v6.1: What Security Teams Need to Know. - bleepingcomputer.com
Microsoft reminds admins to migrate Entra ID users to passkeys - bleepingcomputer.com
US and China Discuss Alerting Each Other to AI National Security Threats - wired.com

Cybersecurity Brief – 2026-05-22

Fri, 22 May 2026 00:00:00 +0000

Major Incidents or Breaches

GitHub disclosed that attackers accessed internal repositories after compromising an employee device via a malicious Visual Studio Code extension. The breach was reportedly limited in scope but highlights successful social engineering against developer tooling ^[1].
Grafana confirmed that hackers accessed its GitHub repositories and stole codebase and other data by exploiting a token compromised during the TanStack supply chain attack, which had not been rotated ^[34].
A glitch in Robinhood’s account creation process was exploited to send phishing emails from the platform’s own systems to customers ^[3].
Canadian authorities arrested an individual alleged to be the botmaster behind Kimwolf, an IoT botnet that enslaved millions of devices for DDoS and credential stuffing attacks ^[28].
Law enforcement seized the ‘First VPN’ service, which was used to facilitate ransomware and data theft operations ^[16].

Newly Discovered Vulnerabilities

Cisco addressed a maximum-severity vulnerability (CVE-2026-20223) in Secure Workload’s REST API that allowed unauthenticated, remote attackers to access sensitive data and gain Site Admin privileges ^[6]^[15]^[35].
Microsoft disclosed and patched two actively exploited vulnerabilities in Defender, one allowing privilege escalation (CVE-2026-41091) and another enabling denial-of-service, both observed in the wild ^[9]^[40]^[42].
Trend Micro Apex One on-premise was found to have a directory traversal flaw (CVE-2026-34926) actively exploited in the wild ^[5]^[33].
Drupal patched a highly critical vulnerability (CVE-2026-9082) that could be exploited without authentication for information disclosure, privilege escalation, and remote code execution ^[38].
Google accidentally exposed details of an unfixed Chromium flaw that allows JavaScript to run in the background after the browser is closed, enabling potential remote code execution ^[11].
Google API keys were found to remain active for 23 minutes after deletion, contrary to the expected immediate invalidation ^[20].

Notable Threat Actor Activity

Chinese cyber-espionage groups have been targeting telecommunications providers in the Middle East and Central Asia with new Linux (Showboat) and Windows (JFMBackdoor) malware families ^[7]^[14]^[22].
TeamPCP, a threat group, has been conducting an unprecedented scale of software supply chain attacks, recently impacting GitHub and hundreds of organizations ^[27].
China-linked APT Webworm utilized Discord, Microsoft Graph, and SOCKS proxies such as SoftEther VPN for attacks targeting EU governments ^[18].

Trends, Tools, or Tactics of Interest

Attackers are increasingly targeting developer tools and software supply chains, as evidenced by incidents involving GitHub, TanStack, and TeamPCP ^[1]^[27]^[34].
The Underminr domain-fronting attack method enables threat actors to exploit content delivery mechanisms for website brand hijacking by modifying web requests and cloaking malicious activity ^[23].
Crypto drainer platforms like Lucifer DaaS are scaling wallet theft through sophisticated phishing and automation rather than direct wallet hacking ^[13].
A new cross-platform Node.js stealer was observed, designed to exfiltrate credentials and other data, with heavy obfuscation to evade detection ^[29].
AI-driven vulnerability discovery is contributing to a surge in Chrome vulnerability reports, with over 200 vulnerabilities patched in recent releases ^[41].
AI agent identity management is emerging as a significant area of concern, with new research highlighting budgetary shifts and the need for governance as AI agent projects proliferate in enterprises ^[21].

Regulatory or Policy Developments Affecting the Security Industry

CISA updated its Known Exploited Vulnerabilities (KEV) catalog to include new vulnerabilities and introduced a nomination form to facilitate broader reporting and tracking of exploited flaws ^[5]^[32].
The US Federal Trade Commission (FTC) fined three firms nearly $1 million for selling a purported “Active Listening” technology for targeted advertising, which was found to be fraudulent ^[26].

Sources

[Heads Up] GitHub Breach Shows Developer Tools Are Social Engineering Targets - blog.knowbe4.com
Grafana Says Codebase and Other Data Stolen via TanStack Supply Chain Attack - securityweek.com
Robinhood Glitch Allowed Attackers to Send Phishing Emails to Customers - blog.knowbe4.com
Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada - krebsonsecurity.com
Police seize “First VPN” service used in ransomware, data theft attacks - bleepingcomputer.com
Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access - thehackernews.com
Max severity Cisco Secure Workload flaw gives Site Admin privileges - bleepingcomputer.com
Cisco Patches Critical Vulnerability in Secure Workload - securityweek.com
Microsoft Warns of Two Actively Exploited Defender Vulnerabilities - thehackernews.com
Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days - securityweek.com
Microsoft Defender vulnerabilities are being exploited in the wild - malwarebytes.com
CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV - thehackernews.com
TrendAI Patches Apex One Zero-Day Exploited in the Wild - securityweek.com
Drupal Patches Highly Critical Vulnerability Exposing Websites to Hacking - securityweek.com
Google accidentally exposed details of unfixed Chromium flaw - bleepingcomputer.com
Google API Keys Remain Active After Deletion - darkreading.com
Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor - thehackernews.com
Chinese hackers target telcos with new Linux, Windows malware - bleepingcomputer.com
Chinese APTs Share Linux Backdoor in Central Asia Telco Attacks - darkreading.com
A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale - wired.com
China's Webworm Uses Discord, Microsoft Graphs to Hack EU Govts. - darkreading.com
Content Delivery Exploit Opens Websites to Brand Hijacking - darkreading.com
Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet - bleepingcomputer.com
Cross-Platform NPM Stealer, (Fri, May 22nd) - isc.sans.edu
Google’s Surge in Chrome Vulnerability Discoveries Likely Driven by AI - securityweek.com
AI Agents Are Shifting Identity Security Budget Dynamics - darkreading.com
CISA Enhances Known Exploited Vulnerabilities Catalog to Include New Nomination Form - cisa.gov
‘Creepy’ Listening Tool for Targeted Ads Didn’t Actually Work, FTC Says - wired.com

Cybersecurity Brief – 2026-05-21

Thu, 21 May 2026 00:00:00 +0000

Major Incidents or Breaches

GitHub confirmed a breach involving the exfiltration of over 3,800 internal repositories. The breach was traced to a compromised employee device, which had installed a malicious version of the Nx Console Visual Studio Code extension. This extension was compromised during the recent TanStack npm supply-chain attack. The threat actor TeamPCP has claimed responsibility. The breach also impacted other organisations, such as Grafana, which failed to rotate a GitHub workflow token after the TanStack incident, leading to further compromise^[4]^[10]^[13]^[16]^[21].
Microsoft disrupted a malware-signing-as-a-service operation, known as Fox Tempest, which weaponised Microsoft’s Artifact Signing system to deliver malicious code and facilitate ransomware campaigns. The service enabled threat actors to sign malware with fraudulent Microsoft-issued certificates to evade security controls^[7]^[42].
Hackers bypassed multi-factor authentication on SonicWall Gen6 SSL-VPN appliances due to incomplete patching, brute-forcing VPN credentials and deploying tools used in ransomware attacks^[15].
The Ukrainian cyberpolice, in cooperation with US authorities, identified an infostealer operator responsible for compromising 28,000 accounts via malware targeting an online service^[14].
Grafana suffered a data breach stemming from a missed token rotation following the TanStack npm supply-chain attack, underscoring the ongoing risks in the software supply chain^[16].

Newly Discovered Vulnerabilities

A critical vulnerability in Drupal Core affecting PostgreSQL-backed sites may allow remote code execution, privilege escalation, or information disclosure. Security updates have been released, and there is a high risk of rapid exploitation^[5]^[18].
A 9-year-old Linux kernel flaw (CVE-2026-46333) was disclosed, enabling root command execution on major Linux distributions^[3].
A newly patched privilege escalation vulnerability in Arch Linux, dubbed PinTheft, now has a public proof-of-concept exploit, allowing local attackers to gain root privileges^[19].
A vulnerability in ExifTool (CVE-2026-3102) allows attackers to compromise macOS systems through malicious image files^[1].
Microsoft Defender is affected by two zero-day vulnerabilities that have been exploited in active attacks, with security patches now rolling out^[12].
Anthropic silently patched a vulnerability in the Claude code sandbox that could have been chained with prompt injection to exfiltrate data^[37].
A critical command injection vulnerability in an OT Robot OS allows unauthenticated attackers to gain remote access and control of robotic systems^[24].
Microsoft rolled out mitigations for the ‘YellowKey’ BitLocker bypass, addressing exploitation via the FsTx Auto Recovery Utility^[34].
Firefox 151 update includes fixes for high-priority security vulnerabilities^[43].

Notable Threat Actor Activity

China-aligned threat actor Webworm was observed deploying custom backdoors, EchoCreep and GraphWorm, leveraging Discord and Microsoft Graph API for command-and-control operations^[8].
Over 320 npm packages in the @antv namespace were compromised in a fresh Mini Shai-Hulud supply-chain attack, using a hijacked maintainer account to publish malicious versions^[38].

Trends, Tools, or Tactics of Interest

Typosquatting attacks are increasingly targeting the software supply chain, with AI-generated lookalike domains embedded in third-party scripts, making detection more difficult^[11].
AI-powered app attacks are becoming faster, more frequent, and harder to stop, with attackers able to target new mobile apps within hours of release^[35].
There is a rising industry focus on securing AI agents during development and production. Microsoft open-sourced RAMPART and Clarity to help developers test AI agent security, while 1Password partnered with OpenAI to implement a just-in-time credential model for AI coding agents, aiming to prevent persistent secret leakage^[6]^[36]^[39].
The supply chain security crisis is intensifying, with an increasing number of vulnerabilities, shorter time-to-exploitation, and limited visibility into supply chain risks^[32].
Zero Trust strategies are increasingly incorporating continuous device verification, as identity checks alone are insufficient to prevent attacks involving stolen session tokens and compromised devices^[17].

Regulatory or Policy Developments Affecting the Security Industry

The EU is accelerating efforts to reduce reliance on US-based technology providers, with countries such as France moving to homegrown alternatives over platforms like Zoom and Microsoft Teams^[27].
A bipartisan US legislative amendment proposes to end nationwide police license plate tracking by tying federal highway funding to the discontinuation of automated plate tracking programmes, except for toll collection^[28].
A report found that opt-out forms used by data brokers and AI firms are often designed to confuse users and hinder effective data privacy choices^[30].

Sources

GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension - thehackernews.com
GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos - thehackernews.com
GitHub links repo breach to TanStack npm supply-chain attack - bleepingcomputer.com
Grafana breach caused by missed token rotation after TanStack attack - bleepingcomputer.com
GitHub Confirms Breach, 4K Internal Repos Stolen - darkreading.com
Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks - thehackernews.com
Fake malware-signing service Fox Tempest dismantled by Microsoft - malwarebytes.com
Hackers bypass SonicWall VPN MFA due to incomplete patching - bleepingcomputer.com
Ukraine identifies infostealer operator tied to 28,000 stolen accounts - bleepingcomputer.com
Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks - thehackernews.com
Drupal critical update to fix bug with high exploitation risk - bleepingcomputer.com
9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros - thehackernews.com
Exploit released for new PinTheft Arch Linux root escalation flaw - bleepingcomputer.com
How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102) - securelist.com
Microsoft warns of new Defender zero-days exploited in attacks - bleepingcomputer.com
Anthropic Silently Patches Claude Code Sandbox Bypass - securityweek.com
Patch Now: Critical Flaw in OT Robot OS Gives Attackers Control - darkreading.com
Microsoft Rolls Out Mitigations for ‘YellowKey’ BitLocker Bypass - securityweek.com
Firefox 151 packs big privacy upgrades into a small update - malwarebytes.com
Webworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph API - thehackernews.com
Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack - securityweek.com
Typosquatting Is No Longer a User Problem. It's a Supply Chain Problem - thehackernews.com
AI-Powered App Attacks Are Faster, More Frequent and Harder to Stop - securityweek.com
Microsoft Open-Sources RAMPART and Clarity to Secure AI Agents During Development - thehackernews.com
1Password Teams With OpenAI to Stop AI Coding Agents From Leaking Credentials - securityweek.com
Caught Off Guard: Securing AI After It Hits Production - securityweek.com
Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little Visibility - securityweek.com
Identity Alone Isn't Enough: Why Device Security Has to Share the Load - bleepingcomputer.com
The EU Is Going Through a Trump-Fueled Breakup With Big Tech - wired.com
A Bipartisan Amendment Would End Police License Plate Tracking Nationwide - wired.com
Data Brokers’ and AI Firms’ Opt-Out Forms Are Built to Fail, Report Finds - wired.com

Cybersecurity Brief – 2026-05-20

Wed, 20 May 2026 00:00:00 +0000

Major Incidents or Breaches

GitHub confirmed that approximately 3,800 internal repositories were breached after an employee installed a malicious Visual Studio Code extension. The threat actor TeamPCP has claimed responsibility for accessing around 4,000 repositories containing private code, and GitHub is actively investigating the incident ^[6]^[12]^[14].
Grafana Labs disclosed a breach involving its source code repositories, attributed to a supply-chain attack via a compromised npm package (TanStack). The company stated that customer production systems and operations were not affected ^[5].
7-Eleven confirmed a data breach following a cyberattack claimed by the ShinyHunters extortion group. The incident affected the company’s systems last month ^[23].
NYC Health + Hospitals reported a significant breach via a third-party vendor compromise, exposing sensitive data including biometrics, medical diagnoses, and bank details of at least 1.8 million individuals ^[46].
The US FBI reported that Americans lost over $388 million to scams involving cryptocurrency ATMs in 2025 ^[18].

Newly Discovered Vulnerabilities

A critical, unauthenticated remote code execution vulnerability was disclosed in ChromaDB for AI applications. The flaw, present in the latest Python FastAPI version, allows attackers to hijack exposed servers ^[15]^[41].
Proof-of-concept exploit code was released for CVE-2026-31635 (“DirtyDecrypt”), a Linux kernel vulnerability allowing local privilege escalation to root. The issue was patched in April ^[8]^[45].
SEPPMail Secure E-Mail Gateway was found to have critical vulnerabilities that could enable remote code execution and interception of mail traffic ^[11].
Microsoft released mitigations for the “YellowKey” Windows BitLocker zero-day vulnerability, which allows attackers to gain access to protected drives ^[13].
Drupal announced an urgent core security release for all supported branches, addressing a highly critical vulnerability that may be exploited within hours or days of disclosure ^[10]^[38].

Notable Threat Actor Activity

The TeamPCP threat actor claimed responsibility for breaching thousands of GitHub internal repositories ^[6]^[14].
The ShinyHunters gang was confirmed to have breached 7-Eleven’s systems ^[23].
A new wave of Shai-Hulud malware resulted in the publication of over 600 malicious packages to the npm registry, continuing a supply-chain attack campaign ^[22].
Researchers observed a major phishing campaign abusing Google AppSheet to relay phishing emails, compromising over 30,000 Facebook accounts ^[3].
Attackers abused the Kuse AI app’s storage and sharing features to assist in phishing campaigns ^[1].
A phishing-as-a-service platform called EvilTokens bypassed MFA by leveraging OAuth consent, compromising over 340 Microsoft 365 organizations in five countries within five weeks ^[9].
A threat actor exploited Microsoft’s Self-Service Password Reset feature in attacks against Microsoft 365 and Azure environments to steal data ^[19].
Attackers are increasingly abusing the legacy Windows MSHTA utility to deliver malware stealthily via phishing and LOLBIN-based attacks ^[40].
The SHub Reaper stealer is targeting macOS users via fake WeChat and Miro installers, using Apple script-based execution for backdoor access ^[32].

Trends, Tools, or Tactics of Interest

Verizon’s 2026 Data Breach Investigations Report (DBIR) found that vulnerability exploitation has overtaken credential abuse as the primary breach vector, now accounting for 31 percent of initial breach access. The report highlights delays in patching and increased use of AI by attackers ^[29]^[37].
Microsoft disrupted a malware-signing-as-a-service operation, run by the Fox Tempest group, which abused the company’s Artifact Signing service to sign malware and ransomware as legitimate software ^[16]^[39].
A large-scale Android ad fraud operation, dubbed Trapdoor, used 455 apps to generate 659 million daily bid requests for fraudulent advertising ^[7].
B1ack’s Stash marketplace released 4.6 million stolen credit card records for free, reportedly in response to seller misconduct ^[42].
Discord rolled out end-to-end encryption on all voice and video calls by default ^[17].
YouTube introduced “likeness detection” to combat AI deepfakes, requiring creators to provide biometric data ^[48].

Regulatory or Policy Developments Affecting the Security Industry

The US “Take It Down Act” came into effect on May 19, requiring tech platforms to comply with takedown requests for nonconsensual intimate images, impacting how major platforms address privacy requests ^[35].
Interpol’s “Operation Ramz” involved 13 countries in the Middle East and North Africa, resulting in 201 arrests in the largest coordinated law enforcement cybercrime operation in the region to date ^[27]^[44].

Sources

GitHub Investigating TeamPCP Claimed Breach of ~4,000 Internal Repositories - thehackernews.com
GitHub confirms breach of 3,800 repos via malicious VSCode extension - bleepingcomputer.com
GitHub investigates internal repositories breach claimed by TeamPCP - bleepingcomputer.com
Grafana GitHub Breach Exposes Source Code via TanStack npm Attack - thehackernews.com
7-Eleven confirms data breach claimed by the ShinyHunters gang - bleepingcomputer.com
Biometrics, diagnoses, and bank details exposed in major healthcare breach - malwarebytes.com
FBI: Americans lost over $388 million to scams using crypto ATMs in 2025 - bleepingcomputer.com
Max-severity flaw in ChromaDB for AI apps allows server hijacking - bleepingcomputer.com
Unpatched ChromaDB Vulnerability Can Lead to Server Takeover - securityweek.com
DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability - thehackernews.com
PoC Released for DirtyDecrypt Linux Kernel Vulnerability - securityweek.com
SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access - thehackernews.com
Microsoft shares mitigation for YellowKey Windows zero-day - bleepingcomputer.com
Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare - thehackernews.com
Drupal to Patch Highly Critical Vulnerability at Risk of Quick Exploitation - securityweek.com
New Shai-Hulud malware wave compromises 600 npm packages - bleepingcomputer.com
Phishing Campaign Exploits Google AppSheets to Target Facebook Accounts - blog.knowbe4.com
Warning: Phishing Attacks Are Abusing the Kuse AI App - blog.knowbe4.com
The New Phishing Click: How OAuth Consent Bypasses MFA - thehackernews.com
Microsoft Self-Service Password Reset abused in Azure data theft attacks - bleepingcomputer.com
Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks - securityweek.com
Stealer Spoofs Google, Microsoft & Apple, Then Backdoors macOS - darkreading.com
Verizon DBIR: Enterprises Face a Dangerous Vulnerability Glut - darkreading.com
Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector - securityweek.com
Cybercrime service disrupted for abusing Microsoft platform to sign malware - bleepingcomputer.com
Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’ - securityweek.com
Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps - thehackernews.com
B1ack’s Stash Marketplace Gives Away 4.6 Million Stolen Credit Cards - securityweek.com
Discord rolls out end-to-end encryption on voice, video calls - bleepingcomputer.com
YouTube wants your face to fight deepfakes - malwarebytes.com
You Can Get Some of Your Nudes Removed From the Internet Under a New Law - wired.com
Interpol's 'Operation Ramz' Pioneers Cross-Region Collabs in Middle East - darkreading.com
201 Arrested in Crackdown on Cybercrime in Middle East, North Africa - securityweek.com

Cybersecurity Brief – 2026-05-16

Sat, 16 May 2026 00:00:00 +0000

Major Incidents or Breaches

OpenAI disclosed that two employee devices were compromised via the Mini Shai-Hulud supply chain attack on TanStack, resulting in the theft of credential material from code repositories. OpenAI stated that no user data or production systems were affected. The incident is linked to the public release of the Shai-Hulud worm source code by TeamPCP, which is encouraging its use in further supply chain attacks and offering monetary rewards to attackers ^[8]^[22]^[23].
The JDownloader website was compromised, and installer download links were replaced with malware for several days, exposing users who downloaded the installer during this period to potential compromise ^[24].
American Lending Center reported a ransomware attack affecting 123,000 individuals. The breach was discovered nearly a year ago, but the investigation has only recently concluded ^[21].
Researchers observed active exploitation of a critical vulnerability in the Funnel Builder WordPress plugin, allowing attackers to inject malicious JavaScript into WooCommerce checkout pages and steal credit card data ^[9].
Two vulnerabilities in the Avada Builder WordPress plugin, which has around one million active installations, allow attackers to read arbitrary files and extract sensitive information, including site credentials ^[12].

Newly Discovered Vulnerabilities

Four vulnerabilities in the OpenClaw platform can be chained to achieve data theft, privilege escalation, and persistence. These flaws have been collectively rated as high severity ^[6].
During the second day of Pwn2Own Berlin 2026, researchers demonstrated 15 unique zero-day vulnerabilities in products including Windows 11, Microsoft Exchange, and Red Hat Enterprise Linux ^[10].
Microsoft warned of a high-severity, actively exploited Exchange Server zero-day vulnerability (CVE-2026-42897) that allows remote code execution via cross-site scripting. Temporary mitigations have been released pending a permanent patch ^[16]^[20].

Notable Threat Actor Activity

The Russian state-sponsored Turla group has evolved its Kazuar backdoor into a modular peer-to-peer (P2P) botnet, enhancing its stealth and persistence capabilities ^[5].
The hacking group TeamPCP released the source code for the Shai-Hulud worm, incentivising its use in supply chain attacks and promising monetary rewards to participants ^[23].
Attackers compromised the node-ipc npm package by injecting credential-stealing malware into newly published versions, targeting developers in a supply chain attack ^[11].
Researchers are tracking 40 separate traffic-themed SMS phishing (smishing) campaigns impersonating transport authorities, toll operators, and parking services globally ^[3].

Trends, Tools, or Tactics of Interest

Phishing attacks are becoming more sophisticated, leveraging AI to mimic legitimate conversations, use trusted domains, and scale attacks, making detection increasingly difficult ^[1].
Stolen browser sessions and authentication tokens are becoming more valuable than passwords, as seen in the evolution of the REMUS infostealer, which now focuses on session theft and is offered as malware-as-a-service (MaaS) ^[14].
AI agents capable of discovering and exploiting obscure vulnerabilities are emerging, alongside an increase in potentially flawed AI-generated code, creating new challenges for defenders ^[17].
Supply chain attacks remain prevalent, with notable incidents affecting npm packages (node-ipc), open-source projects (TanStack), and widely used software installers (JDownloader) ^[8]^[11]^[22]^[24].
Security researchers highlight that trusted internal tools and activities can represent significant risk, as malicious behaviour increasingly blends in with legitimate operations ^[7].
Geopolitical turmoil is being exploited by fraudsters to conduct scams and social engineering attacks ^[4].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft is updating the Edge browser to prevent saved passwords from being loaded into process memory in clear text at startup, reversing its previous stance that this behaviour was “by design” ^[13].
Microsoft is introducing a capability to remotely roll back faulty Windows drivers delivered through Windows Update, aiming to reduce the risk from problematic driver deployments ^[15].
Big Tech companies are opposing a Canadian encryption bill, which has implications for privacy and secure communications ^[19].
Meta has introduced disappearing AI chats in WhatsApp, claiming they cannot be read by Meta, while simultaneously removing protections on Instagram that previously prevented Meta from accessing user messages, creating confusion about chat privacy ^[25].

Sources

TanStack Supply Chain Attack Hits Two OpenAI Employee Devices, Forces macOS Updates - thehackernews.com
OpenAI Hit by TanStack Supply Chain Attack - securityweek.com
TeamPCP Ups the Game, Releases Shai-Hulud Worm’s Source Code - securityweek.com
Attackers replaced JDownloader installer downloads with malware - malwarebytes.com
American Lending Center Data Breach Affects 123,000 Individuals - securityweek.com
Funnel Builder WordPress plugin bug exploited to steal credit cards - bleepingcomputer.com
Avada Builder WordPress plugin flaws allow site credential theft - bleepingcomputer.com
Four OpenClaw Flaws Enable Data Theft, Privilege Escalation, and Persistence - thehackernews.com
Microsoft Exchange, Windows 11 hacked on second day of Pwn2Own - bleepingcomputer.com
Microsoft warns of Exchange zero-day flaw exploited in attacks - bleepingcomputer.com
Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild - securityweek.com
Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access - thehackernews.com
Popular node-ipc npm package compromised to steal credentials - bleepingcomputer.com
Traffic-Themed SMS Phishing Targets Users Around the World - blog.knowbe4.com
Why Integrate Threat Intelligence Feeds into Email Security? - blog.knowbe4.com
Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution - bleepingcomputer.com
The Boring Stuff is Dangerous Now - darkreading.com
What 45 Days of Watching Your Own Tools Will Tell You About Your Real Attack Surface - thehackernews.com
Why geopolitical turmoil is a gift for scammers, and how to stay safe - welivesecurity.com
Microsoft backpedals: Edge to stop loading passwords into memory - bleepingcomputer.com
Microsoft to automatically roll back faulty Windows drivers - bleepingcomputer.com
In Other News: Big Tech vs Canada Encryption Bill, Cisco’s Free AI Security Spec, Audi App Flaws - securityweek.com
Meta’s confusing new approach to chat privacy - malwarebytes.com

Cybersecurity Brief – 2026-05-15

Fri, 15 May 2026 00:00:00 +0000

Major Incidents or Breaches

Foxconn suffered a ransomware attack by the Nitrogen group on its North American manufacturing facilities. This is one of over 600 attacks targeting manufacturers this year.
OpenAI confirmed a security breach resulting from the TanStack supply chain attack, which compromised two employee devices and necessitated code-signing certificate rotation.
Taiwanese rail operations were disrupted for nearly an hour after a student used software-defined radio to shut down three bullet trains, exposing cybersecurity gaps in rail systems.
TeamPCP is threatening to leak source code from the Mistral AI project unless a buyer is found, following a breach.
Dell confirmed its SupportAssist software is causing Windows BSOD crashes, leading to system instability for users.

Newly Discovered Vulnerabilities

Cisco Catalyst SD-WAN Controller is affected by a critical authentication bypass vulnerability (CVE-2026-20182), which has been actively exploited in the wild to gain administrative access. This is the sixth SD-WAN zero-day exploited in 2026.
Microsoft disclosed a new actively exploited vulnerability (CVE-2026-42897) impacting on-premise Exchange Server, allowing arbitrary code execution via crafted email. A separate Exchange zero-day enabling XSS-based code execution is also under active exploitation.
PraisonAI (CVE-2026-44338) was targeted by threat actors within hours of disclosure, exploiting an authentication bypass flaw in this open-source orchestration framework.
Three versions of the node-ipc npm package were found to contain a stealer backdoor targeting developer secrets.
An 18-year-old NGINX vulnerability was discovered, allowing denial of service and, under certain conditions, remote code execution.
A new Linux kernel vulnerability, “Fragnesia” (CVE-2026-46300), allows root privilege escalation and is similar to previous Dirty Frag and Copy Fail exploits.
Burst Statistics WordPress plugin is being exploited via a critical authentication bypass flaw to obtain admin-level access on affected sites.
Chrome 148 update was released to patch critical use-after-free and other high-severity vulnerabilities.
F5 released patches for over 50 vulnerabilities in BIG-IP, BIG-IQ, and NGINX products, covering high and medium-severity issues.

Notable Threat Actor Activity

Kimsuky, a North Korean threat group, is using new PebbleDash-based tools linked to the AppleSeed malware cluster in recent campaigns.
Ghostwriter, a Belarus-aligned group, targeted Ukrainian government entities with geofenced PDF phishing and Cobalt Strike payloads.
FrostyNeighbor, another Belarusian APT, is spear-phishing government organizations in Poland and Ukraine using unique victim fingerprinting for espionage.
Chinese APTs Salt Typhoon and Twill Typhoon expanded their targeting: Salt Typhoon attacked an Azerbaijani energy entity, and Twill Typhoon deployed an updated RAT against Asian organizations.
KongTuke, an initial access broker, is now using Microsoft Teams for rapid social engineering attacks to breach corporate networks.
TeamPCP released the source code for the Shai-Hulud worm, encouraging its use in supply chain attacks and offering financial incentives for widespread deployment.

Trends, Tools, or Tactics of Interest

Ransomware gangs are increasingly targeting manufacturers due to their low tolerance for downtime, as evidenced by the Foxconn incident.
Phishing attacks are ramping up ahead of the 2026 FIFA World Cup, with at least 79 phishing sites targeting fans.
Netflix-themed phishing campaigns are proliferating, with attackers leveraging poor user security practices for credential theft.
Cyber-enabled cargo crime is shifting from physical hijackings to phishing and credential theft to reroute and steal freight.
AI-assisted ransomware and AI-driven social engineering are emerging, with threat actors leveraging generative AI for more convincing phishing and attack automation.
AI hallucinations are creating new security risks by generating plausible but incorrect outputs, which can mislead decision-makers in critical infrastructure.
Supply chain attacks remain a significant threat, highlighted by the node-ipc, TanStack, and Shai-Hulud worm incidents.
New malware libraries are prompting the need for updated detection signatures.
Mythos, an autonomous vulnerability discovery tool, proves effective in code audits and reverse engineering but has inconsistent exploit validation.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Cisco SD-WAN CVE-2026-20182 to its Known Exploited Vulnerabilities (KEV) catalog, mandating urgent remediation.
G7 countries released guidance on AI Software Bill of Materials (SBOM), outlining minimum elements to enhance transparency in AI systems and supply chains.
SecurityScorecard acquired Driftnet to improve threat intelligence and third-party risk visibility, responding to growing concerns over supply chain attack vectors.
Akamai announced the acquisition of LayerX for $205 million, expanding its Zero Trust portfolio to include browser-level protection.

Cybersecurity Brief – 2026-05-13

Wed, 13 May 2026 00:00:00 +0000

Major Incidents or Breaches

South Staffordshire Water Plc and its parent company have been fined £963,900 by the UK Information Commissioner’s Office after a cyberattack exposed the personal data of 664,000 customers.
Škoda Auto disclosed a data breach following a compromise of its online shop, resulting in the theft of customer personal information. The number of affected individuals has not been specified.
BWH Hotels reported that threat actors had access to guest reservation data, including names and contact information, for six months.
Foxconn experienced another cyberattack, resulting in exposure of sensitive company data.
A report indicates that 43% of UK businesses suffered a breach in the last year, with 85% of these incidents attributed to phishing attacks.
RubyGems, the Ruby package manager, suspended new account registrations after a major attack in which more than 500 malicious packages were uploaded, targeting the registry itself.
The ShinyHunters extortion group conducted two cyberattacks against the Canvas platform operated by Instructure, prompting US Congressional scrutiny.
TeamPCP, a known threat actor, has been linked to a supply chain attack compromising hundreds of npm and PyPI packages, including those from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI, with the Mini Shai-Hulud worm delivering credential-stealing malware.

Newly Discovered Vulnerabilities

Microsoft’s May 2026 Patch Tuesday addressed 137 vulnerabilities (including 120 flaws noted in other reports), with nine rated critical. No zero-days were disclosed. Updates cover Azure, Windows, Dynamics 365, and SSO Plugins for Jira & Confluence.
Fortinet patched critical remote code execution vulnerabilities in FortiSandbox and FortiAuthenticator, which could allow attackers to execute arbitrary commands or code.
Ivanti released patches for critical vulnerabilities that could lead to arbitrary code execution and information disclosure.
Exim released security updates to address a severe vulnerability in certain GnuTLS builds that could enable memory corruption and potential code execution.
SAP issued updates for 15 vulnerabilities, including two critical flaws in Commerce Cloud and S/4HANA.
Intel and AMD published advisories for a combined total of 70 security vulnerabilities across their products.
Adobe patched 52 vulnerabilities in 10 products, several of which could result in arbitrary code execution, though none are known to be exploited in the wild.

Notable Threat Actor Activity

TeamPCP has been identified as responsible for the Mini Shai-Hulud worm campaign, which has infected hundreds of open-source packages, focusing on credential theft and supply chain compromise.
The GemStuffer campaign abused over 150 RubyGems to exfiltrate scraped data from UK council portals, using the RubyGems registry as a data exfiltration channel.
The TrickMo Android banking trojan has been updated to use The Open Network (TON) for command-and-control and SOCKS5 proxies to create Android network pivots, enhancing its evasion and persistence capabilities.
The ShinyHunters extortion group targeted Instructure’s Canvas platform in two separate attacks.

Trends, Tools, or Tactics of Interest

Social engineering remains a prevalent attack vector, with criminals increasingly posing as help desks in phishing and fraud campaigns.
Signal has introduced new in-app confirmations and warning messages to counter phishing and social engineering attacks.
Android announced an opt-in Intrusion Logging feature for forensic analysis of sophisticated spyware, and Android 17 will introduce expanded protections against banking scam calls and device theft.
Hugging Face AI models are susceptible to manipulation via tokenizer library file tweaks, allowing model hijacking and data exfiltration.
A cross-platform malware campaign dubbed CRPx0 is using “Free OnlyFans” lures to target macOS and Windows, with Linux support in development.
Fake search results for Claude setup guides are being used to distribute ClickFix malware to Mac users.
The volume and complexity of supply chain attacks targeting open-source package repositories (npm, PyPI, RubyGems) continues to increase, with attackers leveraging worms and mass package uploads.

Regulatory or Policy Developments Affecting the Security Industry

The UK Information Commissioner’s Office imposed a significant fine on South Staffordshire Water Plc for failing to protect customer data during a cyberattack.
The US House Committee on Homeland Security has requested testimony from Instructure executives regarding the recent cyberattacks on its Canvas platform.
RubyGems’ suspension of new account sign-ups in response to a major malicious package attack reflects ongoing efforts to secure software supply chains.

Cybersecurity Brief – 2026-05-12

Tue, 12 May 2026 00:00:00 +0000

Major Incidents or Breaches

Instructure (Canvas): Instructure, the parent company of Canvas, confirmed a significant breach involving the theft of 3.65TB of data by the ShinyHunters extortion group. The breach exploited a vulnerability in Canvas, which allowed attackers to deface login portals and leave extortion messages. Instructure reached a ransom agreement with the attackers to prevent further data leaks, and claims the stolen data was “returned.”
TanStack, Mistral AI, Guardrails AI, UiPath, OpenSearch: Multiple popular npm and PyPI packages were compromised in a supply chain attack orchestrated by the threat actor TeamPCP. The attack also included a rogue version of the Checkmarx Jenkins AST plugin, which contained an infostealer.
Skoda: Hackers exploited a portal vulnerability to access customer data from Skoda’s online shop, including names, addresses, email addresses, and phone numbers.
SailPoint: SailPoint disclosed a GitHub repository breach on 20 April. No customer data in production or staging environments was affected.
cPanel: A threat actor known as Mr_Rot13 is actively exploiting CVE-2026-41940, a critical cPanel vulnerability, to deploy the Filemanager backdoor on compromised systems.

Newly Discovered Vulnerabilities

cPanel CVE-2026-41940: This critical flaw is under active exploitation to install persistent backdoors.
Canvas LMS: A vulnerability in Instructure’s Canvas platform allowed attackers to modify login portals and deliver extortion messages.
Yarbo Garden Robots: Multiple vulnerabilities in Yarbo garden robots could allow attackers to expose Wi-Fi credentials, hijack cameras, and physically control the devices.
“Dirty Frag” Linux Privilege Escalation: A new privilege escalation vulnerability, similar to Copy Fail and Dirty Pipe, is affecting enterprise Linux distributions and may already be under limited exploitation.

Notable Threat Actor Activity

TeamPCP: Conducted a series of supply chain attacks compromising npm and PyPI packages associated with TanStack, UiPath, Mistral AI, OpenSearch, Guardrails AI, and the Checkmarx Jenkins AST plugin.
ShinyHunters: Responsible for the Instructure (Canvas) breach, extorting the company and negotiating a ransom to prevent data leaks.
Mr_Rot13: Attributed to the exploitation of the cPanel CVE-2026-41940 vulnerability.
Unnamed Cyber Espionage Group: Targeted aviation and drone firms to exfiltrate GIS files, terrain models, and GPS data.

Trends, Tools, or Tactics of Interest

Ransomware Evolution: Kaspersky reports a shift in ransomware tactics for 2026, including increased use of EDR killers and a move from data encryption to data leak extortion.
AI in Exploit Development: Google and other sources confirm the first known use of AI to develop a zero-day exploit capable of mass 2FA bypass and targeting a popular open-source web admin tool. Attack automation and exploit orchestration via large language models are increasing.
Supply Chain Attacks: Continued targeting of software supply chains, including poisoning trusted packages and plugins.
GhostLock Tool: A new proof-of-concept tool demonstrates how Windows file APIs can be abused to block access to local or network files.
Application Build Firewalls: New security solutions are emerging to monitor runtime behaviour within build pipelines to prevent supply chain attacks.
Insider Threats: Research indicates that 1 in 8 employees have sold or know someone who has sold company logins.
Purple Teaming: Observations highlight ongoing operational challenges in integrating red and blue team functions in practice.

Regulatory or Policy Developments Affecting the Security Industry

GM California Settlement: General Motors agreed to a $12.75 million settlement with California authorities for alleged violations of the California Consumer Privacy Act related to the sale of drivers’ data.
FCC Router Ban: The US Federal Communications Commission has eased some restrictions and extended deadlines for foreign-made routers, though the ban remains in effect.
iOS 26.5 Release: Apple released iOS 26.5, introducing default end-to-end encrypted RCS messaging between iPhone and Android devices in beta, as part of a cross-industry initiative to replace SMS/MMS.