Supply Chain Attack
CrowdStrike's Counter Adversary Operations team, with Google and the Shadowserver Foundation, executed a simultaneous takedown of all four GlassWorm command-and-control channels — Solana, BitTorrent DHT, Google Calendar, and direct servers — on May 26-27, 2026.
Supply Chain Attack
Three independently disclosed campaigns in the May 26-27 cycle treat AI tools as a single trust surface — SymJack at the agent layer, fake installers impersonating Claude and ChatGPT at the brand layer, and AI chatbot recommendations at the discovery layer.
Vulnerabilities
A missing authorization check in Gitea's container registry let anyone on the internet pull private images from ~31,750 instances for roughly four years. Forgejo is affected too. Patch to 1.26.2 — and treat every secret baked into a reachable image as burned.
Threat Actors
The FBI's May 26 FLASH alert warns that Silent Ransom Group — also tracked as Luna Moth, Chatty Spider, and UNC3753 — is now sending operatives in person to US law firms, posing as IT support and inserting USB drives to steal client data for extortion.
Nation-State Cyber Threats
Israeli firm Gambit Security says the 'Ababil of Minab' hacktivist persona that claimed the March 2026 LA Metro breach is, on its forensic evidence, a front for Iran's Ministry of Intelligence and Security. At least 700 GB was stolen, and attackers reached a rail-yard control display.
Cybersecurity 101
The Cyber Kill Chain breaks a cyberattack into seven sequential stages. This guide explains each stage, how defenders map controls to break the chain early, its limitations, and how it compares to MITRE ATT&CK and the Unified Kill Chain.
Policy & Government
India's CERT-In issued guidelines on May 26, 2026 requiring organizations to patch critical internet-exposed vulnerabilities within 12 hours, "where feasible." The cited reason is explicit: AI-driven exploitation has compressed the patch window past what conventional SLAs can survive.
Vulnerabilities
Google's Threat Intelligence Group caught attackers exploiting CVE-2026-5426, a hardcoded ASP.NET machineKey in Digital Knowledge's KnowledgeDeliver LMS, to forge ViewState payloads, drop the Godzilla web shell, and stage Cobalt Strike Beacon. The patch alone is not enough.
Nation-State Cyber Threats
Nimbus Manticore — the Iran-nexus APT The CyberSignal covered as Screening Serpens — has returned with a new backdoor codenamed MiniFast that Check Point Research assesses was developed with AI assistance, and a target set that now spans aviation, aerospace, defense, software, and telecom.
Vulnerabilities
Microsoft patched CVE-2026-45659, a CVSS 8.8 deserialization RCE in SharePoint Server. The 'authenticated' precondition is barely a precondition — any account with Site Member, the lowest SharePoint role, can trigger it. Patch this week.
Data Breaches
Lithuania's Prosecutor General's Office says more than 600,000 records were pulled from the Centre of Registers using valid Migration Department login credentials issued queries from abroad. The registry itself was not breached — an authorized third party's login was.
Cybersecurity 101
A complete guide to DDoS attacks: how distributed denial-of-service attacks use botnets to overwhelm a target, the three attack types, the record-breaking 2026 incidents defining the hyper-volumetric era, and the defenses that absorb them.