Cybersecurity Brief – 2026-05-12

Tue, 12 May 2026 00:00:00 +0000

Major Incidents or Breaches

Instructure (Canvas): Instructure, the parent company of Canvas, confirmed a significant breach involving the theft of 3.65TB of data by the ShinyHunters extortion group. The breach exploited a vulnerability in Canvas, which allowed attackers to deface login portals and leave extortion messages. Instructure reached a ransom agreement with the attackers to prevent further data leaks, and claims the stolen data was “returned.”
TanStack, Mistral AI, Guardrails AI, UiPath, OpenSearch: Multiple popular npm and PyPI packages were compromised in a supply chain attack orchestrated by the threat actor TeamPCP. The attack also included a rogue version of the Checkmarx Jenkins AST plugin, which contained an infostealer.
Skoda: Hackers exploited a portal vulnerability to access customer data from Skoda’s online shop, including names, addresses, email addresses, and phone numbers.
SailPoint: SailPoint disclosed a GitHub repository breach on 20 April. No customer data in production or staging environments was affected.
cPanel: A threat actor known as Mr_Rot13 is actively exploiting CVE-2026-41940, a critical cPanel vulnerability, to deploy the Filemanager backdoor on compromised systems.

cPanel CVE-2026-41940: This critical flaw is under active exploitation to install persistent backdoors.
Canvas LMS: A vulnerability in Instructure’s Canvas platform allowed attackers to modify login portals and deliver extortion messages.
Yarbo Garden Robots: Multiple vulnerabilities in Yarbo garden robots could allow attackers to expose Wi-Fi credentials, hijack cameras, and physically control the devices.
“Dirty Frag” Linux Privilege Escalation: A new privilege escalation vulnerability, similar to Copy Fail and Dirty Pipe, is affecting enterprise Linux distributions and may already be under limited exploitation.

TeamPCP: Conducted a series of supply chain attacks compromising npm and PyPI packages associated with TanStack, UiPath, Mistral AI, OpenSearch, Guardrails AI, and the Checkmarx Jenkins AST plugin.
ShinyHunters: Responsible for the Instructure (Canvas) breach, extorting the company and negotiating a ransom to prevent data leaks.
Mr_Rot13: Attributed to the exploitation of the cPanel CVE-2026-41940 vulnerability.
Unnamed Cyber Espionage Group: Targeted aviation and drone firms to exfiltrate GIS files, terrain models, and GPS data.

Ransomware Evolution: Kaspersky reports a shift in ransomware tactics for 2026, including increased use of EDR killers and a move from data encryption to data leak extortion.
AI in Exploit Development: Google and other sources confirm the first known use of AI to develop a zero-day exploit capable of mass 2FA bypass and targeting a popular open-source web admin tool. Attack automation and exploit orchestration via large language models are increasing.
Supply Chain Attacks: Continued targeting of software supply chains, including poisoning trusted packages and plugins.
GhostLock Tool: A new proof-of-concept tool demonstrates how Windows file APIs can be abused to block access to local or network files.
Application Build Firewalls: New security solutions are emerging to monitor runtime behaviour within build pipelines to prevent supply chain attacks.
Insider Threats: Research indicates that 1 in 8 employees have sold or know someone who has sold company logins.
Purple Teaming: Observations highlight ongoing operational challenges in integrating red and blue team functions in practice.

GM California Settlement: General Motors agreed to a $12.75 million settlement with California authorities for alleged violations of the California Consumer Privacy Act related to the sale of drivers’ data.
FCC Router Ban: The US Federal Communications Commission has eased some restrictions and extended deadlines for foreign-made routers, though the ban remains in effect.
iOS 26.5 Release: Apple released iOS 26.5, introducing default end-to-end encrypted RCS messaging between iPhone and Android devices in beta, as part of a cross-industry initiative to replace SMS/MMS.