Vulnerabilities
Palo Alto Networks has confirmed that attackers are actively exploiting CVE-2026-0257, an authentication-bypass flaw in PAN-OS GlobalProtect that lets them set up VPN sessions on internet-facing firewalls with no credentials. Rapid7 has observed successful intrusions.
Vulnerabilities
A new Linux kernel LPE called CIFSwitch lets unprivileged local users forge a cifs.spnego key description and hijack the kernel key-request mechanism, getting cifs.upcall to run attacker-controlled NSS code as root. PoC is public; CVE assignment is pending.
Vulnerabilities
Arctic Wolf says threat actors are exploiting the patched FortiClient EMS flaw CVE-2026-35616 to deploy EKZ, a previously unreported credential stealer disguised as a Fortinet endpoint update and pushed across managed endpoints through the EMS management pathway itself.
Cybersecurity 101
A clear guide to how attackers use artificial intelligence — for phishing, malware, deepfakes, and attacks on AI systems — and how organizations can defend.
Data Breaches
Charter Communications, the parent of Spectrum, confirmed a cybersecurity incident on May 26-27, 2026 after ShinyHunters claimed 42 million customer records via the same vishing-to-Microsoft-Entra-to-Salesforce playbook documented across the 2026 cluster at ADT, Amtrak, Odido, and Vimeo.
Vulnerabilities
Rapid7 Labs disclosed an unpatched CVSSv4 9.4 argument-injection (CWE-88) flaw in Gogs that lets any authenticated user achieve remote code execution by injecting --exec into git rebase via a malicious branch name. The second critical self-hosted-Git flaw in one week.
Cybersecurity 101
SQL injection (SQLi) is one of the oldest and most damaging web vulnerabilities — a single unguarded input field can expose an entire database. Here is how SQLi attacks work, the main types, their real-world impact, and how to prevent them.
Supply Chain Attack
CrowdStrike's Counter Adversary Operations team, with Google and the Shadowserver Foundation, executed a simultaneous takedown of all four GlassWorm command-and-control channels — Solana, BitTorrent DHT, Google Calendar, and direct servers — on May 26-27, 2026.
Vulnerabilities
A missing authorization check in Gitea's container registry let anyone on the internet pull private images from ~31,750 instances for roughly four years. Forgejo is affected too. Patch to 1.26.2 — and treat every secret baked into a reachable image as burned.
Cybersecurity 101
The Cyber Kill Chain breaks a cyberattack into seven sequential stages. This guide explains each stage, how defenders map controls to break the chain early, its limitations, and how it compares to MITRE ATT&CK and the Unified Kill Chain.
Vulnerabilities
Microsoft patched CVE-2026-45659, a CVSS 8.8 deserialization RCE in SharePoint Server. The 'authenticated' precondition is barely a precondition — any account with Site Member, the lowest SharePoint role, can trigger it. Patch this week.
Cybersecurity 101
A complete guide to DDoS attacks: how distributed denial-of-service attacks use botnets to overwhelm a target, the three attack types, the record-breaking 2026 incidents defining the hyper-volumetric era, and the defenses that absorb them.