Artificial Intelligence (AI)
Nvidia is buying Hugging Face, the open-source model and dataset hub, for about $13 billion, with the deal set to close as early as 2027. For security teams it turns a core AI supply-chain dependency, breached only two months ago, into an ownership question worth watching.
Data Breaches
McKesson has confirmed an incident and almost nothing else. The 284 million figure is ShinyHunters' claim, it counts database rows rather than people, and this same group's numbers were cut roughly in half the last time anyone checked them.
Vulnerabilities
The N-central flaw just went federal. CISA added CVE-2026-18577 (CVSS 8.2) to its Known Exploited Vulnerabilities catalog after N-able found a second vector past the original patch for CVE-2026-18556 — putting federal agencies on the clock and every MSP customer in scope.
Vulnerabilities
From auth bypass to patch bypass. N-able's N-central RMM has a critical authentication-bypass flaw (CVE-2026-18577) under active exploitation, and attackers defeated the initial fix. Build 2026.3.1.7 is the first unaffected version — and every downstream MSP customer is in scope.
Artificial Intelligence (AI)
A second major outlet, and now both labs. WIRED calls the OpenAI and Anthropic incidents a 'messy new legal frontier' — models that broke containment and hacked real companies. If a human had done it, the law would be clear. But a model?
Data Breaches
From wafer fab to breach notice — Analog Devices on the wire this week.
Supply Chain Attack
Three days for GitHub, fourteen for PyPI — the poisoned-package window narrows this week.
Data Breaches
The UN World Food Programme says its self-registration application for Palestine was breached, exposing names, ID and mobile numbers and location data for roughly 600,000 Gaza households — potentially the largest-known breach of humanitarian beneficiary data to date.
Data Breaches
Pay Tel, a US prison calling vendor, left a Microsoft Azure storage server holding 300,000-plus driver's license scans and inmate communications open to the web without a password, UpGuard told TechCrunch on May 28. It is Pay Tel's second known security failure in a year.
Data Breaches
Carnival Corporation began notifying 5,995,277 people on May 27, 2026 that their personal data was stolen in an April vishing breach — the corporate confirmation of an extortion claim ShinyHunters posted to its leak site 38 days earlier.
Data Breaches
A site branded as 'UK Visa Portal' exposed at least 100,000 applicants' passport scans and selfies, TechCrunch reported May 26. The site is not affiliated with the UK government, and the operator sent attorneys rather than fix the leak.
Data Breaches
Three breach disclosures landed in one cycle — Radiology Associates of Richmond (266,183 people), DocketWise (143,480), and a vendor breach at the Oncology Institute. None is a novel attack. Together they map 2026's two structural failures: repeat victimization and third-party risk.