Cyber Attacks
Foxconn confirmed a cyberattack on its North American factories. Nitrogen ransomware claims 8TB and 11M+ files including Apple, NVIDIA, Google, Intel, and Dell project documentation. Mount Pleasant AI server factory was offline for a week.
Policy & Government
California AG Bonta announced a $12.75M civil penalty against GM and OnStar for selling driver data to data brokers 2020-2024. Largest CCPA penalty ever; first data minimization enforcement.
Application Security
TeamPCP's Mini Shai-Hulud worm hit 170+ packages May 11, including TanStack, Mistral AI, and Guardrails AI. First npm worm to ship valid SLSA Build Level 3 provenance for malicious code.
Trending
Three of cybersecurity's most prominent voices used the RSA Conference in March to deliver a unified warning: AI is finding vulnerabilities faster than organizations can patch them, and the next two years will outpace anything the industry has seen.
Trending
Participants in the CyberCorps Scholarship for Service program face hundreds of thousands of dollars in potential debt as Trump administration hiring freezes have led federal agencies to rescind job and internship offers. The Trump administration has proposed cutting SFS funding by 65 percent.
Trending
More than 40 million people ask ChatGPT a healthcare-related question every day. OpenAI's ChatGPT Health and Anthropic's Claude for Healthcare are not HIPAA-compliant for consumers — and that is by design.
Trending
After more than a year of the second Trump administration, observers across the political spectrum told CyberScoop that CISA has been significantly diminished, losing roughly one-third of its personnel.
Application Security
SentinelLABS disclosed PCPJack on May 7 — a Linux cloud worm that exploits 5 CVEs across Docker, Kubernetes, Redis, MongoDB, and RayML, then evicts rival TeamPCP malware before stealing credentials. The "PCP replaced" telemetry field is the editorial differentiator.
Application Security
Schemata, a DoD contractor providing AI-powered training to US military customers, patched a zero-authorization API flaw on May 1, 2026 — 150 days after researcher Strix first disclosed it.
Cyber Attacks
A breach of GFN.am, NVIDIA's authorized GeForce NOW partner in Armenia, exposed user data including roughly 6,000 customer payment cards. ShinyHunters claimed responsibility, but BleepingComputer and Cybernews assess the claimant as a likely impersonator.
Application Security
Norwegian researcher Tom Jøran Sønstebyseter Rønning of Statnett SF demonstrated at the Palo Alto Networks Norway BIG Bite of Tech conference that Microsoft Edge keeps every saved password loaded in plaintext RAM during a browser session. Microsoft's response: by design.
Application Security
Privacy researcher Alexander Hanff documented Chrome silently downloading a 4GB Gemini Nano model to user devices without consent.