Cybersecurity Radar — 2026-05-22

🔴 Critical Alerts

Microsoft Defender Zero-Days Actively Exploited (CVE — two flaws) Microsoft has begun rolling out security patches for two Windows Defender vulnerabilities that have been confirmed as exploited in zero-day attacks in the wild. The company started pushing fixes on May 21, 2026. All organizations running Windows Defender should apply these patches immediately; no CVE IDs or CVSS scores are publicly enumerated in the available disclosure, but active exploitation status warrants emergency treatment.

SonicWall Gen6 SSL-VPN Brute-Force Campaign Leading to Ransomware As of May 20, 2026, threat actors have been confirmed brute-forcing VPN credentials and bypassing multi-factor authentication (MFA) on SonicWall Gen6 SSL-VPN appliances to deploy tools used in ransomware attacks. Organizations using SonicWall Gen6 SSL-VPN should immediately audit VPN access logs for anomalous credential attempts, enforce strong MFA (beyond SMS), and consider restricting management interfaces to known IP ranges.

Threat Landscape

npm Supply Chain: Post-Shai Hulud Wormable Malware and CI/CD Persistence Unit 42 (Palo Alto Networks) updated its ongoing analysis of the npm supply chain threat landscape on May 21, 2026. The report examines the evolution of npm-based attacks following the discovery of the "Shai Hulud" wormable malware, detailing multi-stage attack chains, CI/CD pipeline persistence techniques, and malicious packages that can propagate autonomously through developer environments. Targeted sectors include software development, DevOps, and any organization with public-facing CI/CD infrastructure. Developers should audit all npm dependencies and use lockfiles and integrity checking tools.

ShinyHunters Escalates Against Instructure (Canvas LMS) — 8-Month Attack Pattern Revealed KrebsOnSecurity reported (May 18–19, 2026) that what was initially treated as a Penn-specific breach is now confirmed as part of a long-running campaign by the threat actor ShinyHunters against Instructure's environment, spanning at least eight months prior to a major May 2026 escalation. The attack pattern now appears to have been a deliberate multi-stage effort targeting Canvas LMS infrastructure, which serves millions of students globally. Instructure customers should review their data exposure status and check for breach notifications.

State-Backed Ransomware Actors Escalating Against OT and Critical Infrastructure Analysis published May 17, 2026 by Industrial Cyber highlights a growing convergence of state-directed cyber campaigns and criminal ransomware activity, particularly threatening operational technology (OT) environments. Iran's cyber ecosystem — described in a March 2026 Trellix assessment — is increasingly deploying affiliated groups and ransomware-style operations that blur the line between state direction and criminal profit motive. Russian groups continue targeting defense contractors while simultaneously pursuing financial gains. Critical infrastructure operators in energy, manufacturing, and defense sectors are at elevated risk.

1 sources

unit42.paloaltonetworks.com

unit42.paloaltonetworks.com

Vulnerabilities & Patches

Microsoft Defender — Two Zero-Days (CVE details pending, May 21, 2026) Two actively exploited vulnerabilities in Windows Defender received patches beginning May 21, 2026. These were zero-day exploits confirmed in attacks before patches were available. Affected product: Microsoft Windows Defender across supported Windows versions. Action: Apply patches immediately.

CVE-2026-45585 — "YellowKey" BitLocker Bypass (CVSS 6.8) Microsoft released mitigations for YellowKey, a publicly disclosed BitLocker bypass tracked as CVE-2026-45585 with a CVSS score of 6.8. The vulnerability allows attackers who can achieve certain system access to bypass BitLocker disk encryption protections. While rated medium severity, the potential for encryption bypass in combination with other exploits is significant for organizations relying on BitLocker for data-at-rest protection. Mitigations are available while a permanent patch is developed.

CVE-2026-46333 — Nine-Year-Old Linux Kernel Privilege Escalation (CVSS 5.5) Cybersecurity researchers disclosed a vulnerability in the Linux kernel that remained undetected for nine years. Tracked as CVE-2026-46333 (CVSS: 5.5), the flaw involves improper privilege management that could permit an unprivileged local user to disclose sensitive files and execute arbitrary commands as root on default installations of Debian, Fedora, and Ubuntu. Patch availability is expected via distribution update channels. Linux administrators should prioritize applying distribution security updates.

Breaches & Incidents

Instructure / Canvas LMS — ShinyHunters Breach Escalation (Multi-Institution Impact) KrebsOnSecurity's investigation (published approximately May 18–19, 2026) revealed that the ShinyHunters threat actor had been working against Instructure's environment for at least eight months before the dramatic May 2026 escalation. The original Penn-specific framing by national media and by Instructure as a customer-specific incident was "dramatically wrong." The breach now appears to be a multi-institution incident affecting potentially millions of students whose data resides on Canvas LMS infrastructure. Instructure had previously reached a ransom agreement, but the scope of the breach is now understood to be much broader than disclosed. Affected institutions should audit what student data may have been exposed and follow breach notification obligations.

SonicWall Gen6 SSL-VPN Ransomware Deployments (May 20, 2026) Confirmed as of May 20, 2026: threat actors successfully brute-forced VPN credentials and bypassed MFA on SonicWall Gen6 SSL-VPN appliances, then deployed ransomware tooling. The scope of affected organizations has not been quantified in available disclosures. Organizations running these appliances should treat this as an active incident if anomalous VPN access is observed.

Industry & Policy

Verizon DBIR 2026: Ransomware in 48% of Breaches, Median Ransom Payment Drops Published within the past several days, Verizon's 2026 Data Breach Investigations Report (DBIR) found that ransomware appeared in 48% of all breaches — up from 44% the prior year — while fewer companies are paying ransoms. The report also confirmed that vulnerability exploitation has overtaken credential theft as the leading breach vector, with patching delays continuing to worsen industry-wide. AI is accelerating attacker capabilities. The median ransom payment trend is declining even as ransomware frequency rises, suggesting defensive postures and the "don't pay" policy movement may be gaining traction.

CSIS Cyber Incident Tracker Updated — Qilin Attack on Die Linke Documented The Center for Strategic and International Studies (CSIS) updated its Significant Cyber Incidents tracker (updated approximately May 19, 2026), documenting the Qilin ransomware group's March 2026 attack on the German political party Die Linke, among other recent incidents. Qilin, a Russian-speaking ransomware group, threatened to publish stolen data if a ransom was not paid. The documentation underscores continued targeting of political organizations by ransomware actors.

What to Watch

• npm supply chain attacks are intensifying: Following the Shai Hulud wormable malware discovery, Unit 42 warns that attackers are evolving multi-stage techniques with CI/CD persistence. Any organization using npm packages should expect this threat surface to grow — expand software composition analysis tooling now.
• Linux kernel CVE-2026-46333 patch cycle: Distribution maintainers are releasing patches for the nine-year-old privilege escalation flaw. Monitor your Linux distribution channels (Debian, Fedora, Ubuntu) for security update releases and prioritize deployment — local privilege escalation flaws are a key post-exploitation stepping stone.
• State-sponsored/ransomware convergence accelerating: The blurring line between nation-state campaigns and criminal ransomware (particularly Iranian and Russian actors) means OT/ICS environments and defense-sector organizations face compounding threats. Expect more Shai Hulud/OT-targeting incidents in Q2–Q3 2026 as threat actors capitalize on this dual-motivation attack model.

Reader Action Items

1. Patch Windows Defender immediately: Two zero-day vulnerabilities (CVE IDs pending full disclosure) are actively exploited in the wild as of May 21, 2026. Check Windows Update or your patch management platform and deploy the Defender updates released this week without delay.

2. Audit SonicWall Gen6 SSL-VPN deployments: Review access logs for brute-force patterns, enforce hardware-token or app-based MFA (not SMS), restrict VPN management interfaces by IP allowlist, and consider emergency credential rotation for all VPN accounts. Active ransomware deployment via these appliances was confirmed May 20, 2026.

3. Inventory and lock down npm dependencies: If your organization runs CI/CD pipelines consuming npm packages, conduct an immediate audit using tools such as npm audit, Snyk, or Socket.dev. Lock dependency versions with verified lockfiles and restrict pipeline permissions to least-privilege — Unit 42's updated May 21 report confirms attackers are specifically targeting CI/CD persistence vectors.