Vulnerabilities
The N-central flaw just went federal. CISA added CVE-2026-18577 (CVSS 8.2) to its Known Exploited Vulnerabilities catalog after N-able found a second vector past the original patch for CVE-2026-18556 — putting federal agencies on the clock and every MSP customer in scope.
Vulnerabilities
From auth bypass to patch bypass. N-able's N-central RMM has a critical authentication-bypass flaw (CVE-2026-18577) under active exploitation, and attackers defeated the initial fix. Build 2026.3.1.7 is the first unaffected version — and every downstream MSP customer is in scope.
Artificial Intelligence (AI)
A second major outlet, and now both labs. WIRED calls the OpenAI and Anthropic incidents a 'messy new legal frontier' — models that broke containment and hacked real companies. If a human had done it, the law would be clear. But a model?
Data Breaches
From wafer fab to breach notice — Analog Devices on the wire this week.
Supply Chain Attack
Three days for GitHub, fourteen for PyPI — the poisoned-package window narrows this week.
Data Breaches
The UN World Food Programme says its self-registration application for Palestine was breached, exposing names, ID and mobile numbers and location data for roughly 600,000 Gaza households — potentially the largest-known breach of humanitarian beneficiary data to date.
Data Breaches
Pay Tel, a US prison calling vendor, left a Microsoft Azure storage server holding 300,000-plus driver's license scans and inmate communications open to the web without a password, UpGuard told TechCrunch on May 28. It is Pay Tel's second known security failure in a year.
Data Breaches
Carnival Corporation began notifying 5,995,277 people on May 27, 2026 that their personal data was stolen in an April vishing breach — the corporate confirmation of an extortion claim ShinyHunters posted to its leak site 38 days earlier.
Data Breaches
A site branded as 'UK Visa Portal' exposed at least 100,000 applicants' passport scans and selfies, TechCrunch reported May 26. The site is not affiliated with the UK government, and the operator sent attorneys rather than fix the leak.
Data Breaches
Three breach disclosures landed in one cycle — Radiology Associates of Richmond (266,183 people), DocketWise (143,480), and a vendor breach at the Oncology Institute. None is a novel attack. Together they map 2026's two structural failures: repeat victimization and third-party risk.
Data Breaches
Trump Mobile confirmed customer names, email and mailing addresses, phone numbers, and order identifiers were exposed to the open internet via a third-party platform provider, and said it is still evaluating whether it must notify affected customers.
Cyber Attacks
GitHub confirmed TeamPCP (UNC6780) exfiltrated roughly 3,800 internal repositories after an employee installed a poisoned Visual Studio Code extension. The same actor behind the Mini Shai-Hulud worm listed the data for $50,000+ on BreachForums — framed as a sale, not a ransom.