Cybersecurity Radar — 2026-06-01

🔴 Critical Alerts

CVE-2026-35616: Critical Pre-Authentication API Access Bypass
A critical vulnerability with a CVSS score of 9.1 affecting API access controls was observed in active exploitation during May 2026. The flaw enables privilege escalation through unauthenticated API access, allowing attackers to bypass initial authentication layers. Organizations should immediately audit API access logs, enforce multi-factor authentication on API endpoints, and apply vendor patches as they become available. Treat this as a priority-one remediation item.

FIFA 2026 World Cup Phishing Campaign – FBI Warning
The FBI has warned of fake websites impersonating FIFA ahead of the 2026 World Cup, designed to steal personal and financial information, sell counterfeit tickets and hospitality packages, and distribute malware. The campaign exploits anticipation around the event to target fans globally. Users should verify ticket purchases only through official FIFA.com channels and avoid clicking links in unsolicited emails. Organizations managing ticketing platforms should implement DMARC/SPF authentication and monitor for lookalike domains.

1 sources

rswebsols.com

rswebsols.com

Threat Landscape

State-Backed Ransomware Blurs Criminal-Political Lines
A March 2026 Trellix assessment documented Iranian cyber ecosystem sophistication, with state-affiliated groups conducting ransomware-style operations that merge state-directed campaigns with criminal profit motives. Simultaneously, Russian ransomware gangs operate with apparent state approval while targeting defense contractors and critical infrastructure—creating a hybrid threat model where geopolitical objectives and financial gain become indistinguishable. This trend significantly raises the stakes for organizations in defense, energy, and critical sectors.

Ransomware Group Qilin Leads Public Attack Tally
Analysis of 2026 ransomware activity identified 30 distinct ransomware groups linked to publicly disclosed attacks, with Qilin responsible for eight incidents, making it the most prolific group in the recorded period. Healthcare remained the most targeted sector. This concentration of activity within a smaller group of established threat actors suggests consolidation in the ransomware landscape and increased sophistication within leading gangs.

Agent Tesla and OTP Phishing Dominate May 2026 Attack Mix
May 2026 saw significant volume in fake invitations, Agent Tesla malware delivery, one-time password (OTP) phishing, fileless malware, and remote monitoring tool (RMM) abuse targeting businesses. These attacks emphasize credential theft as the primary attack vector, with adversaries focusing on MFA bypass techniques.

1 sources

any.run

any.run

Vulnerabilities & Patches

Exchange Server Zero-Day CVE-2026-42897 Actively Exploited
Microsoft confirmed that CVE-2026-42897, a zero-day flaw in on-premises Exchange Server versions 2016, 2019, and Subscription Edition, is under active exploitation. CISA validated in-the-wild attacks. Microsoft has released mitigation steps pending permanent patches. All affected Exchange Server operators must apply mitigations immediately and monitor authentication logs for suspicious activity.

Cisco SD-WAN Controller Authentication Bypass – CVE-2026-20182
Cisco disclosed a critical Catalyst SD-WAN Controller authentication bypass vulnerability (CVE-2026-20182) being exploited in zero-day attacks to grant attackers administrative privileges on compromised devices. Organizations operating Cisco SD-WAN infrastructure must prioritize patching and restrict administrative console access to trusted networks.

cPanel Zero-Day CVE-2026-41940 Exploited for Months
A critical cPanel vulnerability (CVE-2026-41940) was exploited by attackers for months before a patch was released. The flaw affects web hosting account management systems. All cPanel users should verify patch deployment and audit account access logs for unauthorized access during the pre-patch window.

Breaches & Incidents

Instructure ShinyHunters Campaign: 8-Month Planned Escalation
Instructure, the maker of Canvas learning management system, faced a sustained attack campaign by the ShinyHunters threat group lasting at least eight months before a May 2026 escalation. The incident reveals a long-term reconnaissance and compromise pattern, with attackers establishing persistence and gradually expanding access. Organizations using Canvas should review access logs from late 2025 onward and enforce password resets for high-privilege accounts.

University of Mississippi Medical Center Ransomware Attack – February 2026
A ransomware attack on UMMC forced closure of all 35 clinic locations statewide, shut down the EPIC electronic medical records system, and forced clinicians to revert to pen-and-paper documentation. The incident underscores ransomware's physical-world consequences on healthcare delivery.

Industry & Policy

Microsoft Warns Against Public Zero-Day Disclosure
Microsoft issued guidance cautioning against early public disclosure of zero-day vulnerability details before vendor coordination. The company argues that public releases give attackers a window to exploit flaws before patches ship—a concern validated by the CVE-2026-42897 Exchange Server exploitation. Industry consensus is shifting toward coordinated disclosure practices with 90-day vendor grace periods before public release.

Cognent Launches AI-Powered Zero Day Response Platform
Cognent released Zero Day Response and Autonomous Remediation capabilities designed to accelerate vulnerability detection and reduce the gap between discovery and confirmed remediation. The tools address enterprise frustration with exploit-to-patch delays. This represents growing market investment in automated incident response.

What to Watch

• Google Chrome Patch Surge: Chrome May 2026 updates included 127 security flaws—a dramatic spike from prior monthly volumes—signaling increasing browser vulnerability density.
• Critical Infrastructure Nation-State Targeting: Intelligence suggests intensifying state-backed reconnaissance against OT/ICS systems in energy and water sectors ahead of 2026 geopolitical flashpoints.
• Exchange Server Patch Deadline: Permanent patches for CVE-2026-42897 are pending; organizations in mitigation mode should establish a firm deadline for permanent patch deployment within 30 days.

Reader Action Items

1. Audit API Security: Identify all unauthenticated or weakly authenticated API endpoints in your environment and enforce mutual TLS, OAuth 2.0, or API key rotation every 90 days to defend against CVE-2026-35616-class attacks.

2. Activate Zero-Day Response Playbooks: Review and test your incident response procedures for zero-day exploitation scenarios—especially for Exchange Server, SD-WAN controllers, and cPanel installations. Establish 24/7 monitoring for suspicious authentication and administrative activity.

3. Deploy FBI/CISA Threat Intelligence: Subscribe to CISA alerts and FBI notifications for World Cup phishing campaigns; block known phishing domains at DNS/proxy layers and conduct user security awareness training on ticket scams and lookalike domains within the next two weeks.

Sources:

• The Hacker News
• BleepingComputer
• SecurityWeek
• Krebs on Security
• Industrial Cyber
• CSIS Significant Cyber Incidents
• Help Net Security
• Cybersecurity News