Threats, breaches, and defenses — what you need to know.
Microsoft faces backlash over uncoordinated zero-day disclosures that put millions at risk, while actively exploited vulnerabilities in Windows Defender and Cisco SD-WAN demand urgent patching. AI-assisted exploit development is accelerating threat timelines, outpacing traditional vulnerability scanners and creating a dangerous window for attackers before defenders can respond.
Microsoft has condemned uncoordinated zero-day disclosures that expose millions of users to immediate risk, while fresh threats emerge including Gitea container image theft and ongoing AI-assisted exploit development. Verizon's 2026 Data Breach Investigations Report highlights vulnerability exploitation as the dominant breach vector, signaling a critical shift in threat tactics that demands urgent defensive prioritization.
Microsoft confirms two actively exploited Windows Defender zero-days (CVE-2026-41091 and CVE-2026-45498) with patches expected June 3, while Gitea users face an unauthenticated remote code execution vulnerability. A critical Cisco SD-WAN flaw and Windows Server 2016 domain controller failures post-patch compound the threat landscape as organizations race to remediate.
Microsoft has rolled out a critical patch addressing a remote code execution vulnerability in SharePoint that requires no specialized conditions to exploit, while a Krebs on Security investigation reveals the ShinyHunters attack on Instructure's Canvas platform — affecting up to 275 million students — was a planned multi-month escalation, not an isolated incident. Windows Server 2016 administrators face an additional headache as a known issue in the May 2026 KB5087537 update causes domain controller lookup failures.
A large-scale supply chain attack targeting npm packages via automated mass-tagging was detected on May 22–23, with over 700 malicious package versions identified in rapid succession. Simultaneously, a critical SQL injection flaw in Ghost CMS (CVE-2026-26980) is being actively exploited in ClickFix attack campaigns. CISA added a known exploited vulnerability to its catalog on May 22, maintaining pressure on defenders to patch faster as vulnerability exploitation continues to outpace credential theft as the top breach vector.
Microsoft's out-of-band emergency patches for multiple actively exploited Defender and Exchange zero-days dominate this cycle, with security teams scrambling to apply fixes before the June 3 deadline. Meanwhile, TrendAI has patched a critical Apex One directory traversal zero-day under active exploitation, and fresh reporting confirms MuddyWater's continued use of Qilin ransomware to blur nation-state and criminal tradecraft lines.
Microsoft has patched two actively exploited Windows Defender zero-days (dubbed "UnDefend" and "RedSun") via emergency out-of-band updates, with CISA confirming active exploitation in the wild. Separately, TrendAI has rushed a patch for a directory traversal zero-day (CVE-2026-34926) in its Apex One endpoint protection platform being exploited in the wild. Meanwhile, nine HIPAA-regulated healthcare entities disclosed data breaches in May, and a long-dormant Linux kernel vulnerability (CVE-2026-46333) dating back nine years has been publicly disclosed, affecting Debian, Fedora, and Ubuntu.
Microsoft has begun rolling out emergency patches for two actively exploited Windows Defender zero-days, while threat actors are brute-forcing SonicWall VPN credentials to deploy ransomware tools. Meanwhile, Unit 42's updated analysis reveals a significant evolution in npm supply chain attack sophistication, including wormable malware and CI/CD persistence techniques — raising alarms across DevSecOps teams.
Microsoft has patched two actively exploited zero-day vulnerabilities in Windows Defender, while Unit 42 researchers have released an updated analysis of the npm supply chain threat landscape following the Shai Hulud wormable malware campaign. Meanwhile, threat actors have been observed brute-forcing SonicWall Gen6 SSL-VPN appliances to deploy ransomware tools, and the Verizon 2026 DBIR confirms ransomware now appears in 48% of all breaches — a trend with no signs of reversing.
The Verizon 2026 Data Breach Investigations Report marks a historic inflection point: vulnerability exploitation has overtaken credential theft as the leading breach vector, signaling a fundamental shift in attacker methodology. Simultaneously, two unpatched Microsoft vulnerabilities — an Exchange Server XSS zero-day (CVE-2026-42897) and a Windows privilege escalation flaw dubbed "MiniPlasma" — remain actively exploited in the wild with no permanent patches available. A compromised VS Code Marketplace extension targeting developers rounds out a pressure-packed 24 hours for defenders.
The Verizon 2026 Data Breach Investigations Report dropped today with a landmark finding: vulnerability exploitation has overtaken credential theft as the leading breach vector for the first time, marking a seismic shift in the attack landscape. Simultaneously, a newly disclosed Windows "MiniPlasma" zero-day with a public proof-of-concept grants SYSTEM privileges on fully patched systems, while the Microsoft Exchange zero-day (CVE-2026-42897) remains unpatched and actively exploited — demanding immediate attention from defenders.
CISA has confirmed active exploitation of a Microsoft Exchange Server zero-day (CVE-2026-42897), with Forbes reporting just 16 hours ago that emergency mitigation must be enabled immediately. Meanwhile, Cisco has patched a critical Catalyst SD-WAN Controller authentication bypass flaw (CVE-2026-20182) that was already exploited in the wild, and Fortinet has disclosed two new critical vulnerabilities affecting FortiAuthenticator and FortiSandbox. State-backed ransomware groups are escalating attacks on operational technology and critical infrastructure, blurring the line between geopolitical warfare and financially motivated cybercrime.
CISA has added the Cisco Catalyst SD-WAN Controller authentication bypass flaw (CVE-2026-20182) to its Known Exploited Vulnerabilities catalog, mandating federal action as active exploitation continues. Simultaneously, the Microsoft Exchange Server zero-day (CVE-2026-42897) remains unpatched and under active attack, with Forbes urging administrators to enable emergency mitigation immediately. A new analysis highlights escalating state-backed ransomware targeting operational technology and critical infrastructure, signaling a dangerous convergence of criminal and geopolitical cyber operations.
CISA has added two critical actively-exploited vulnerabilities to its Known Exploited Vulnerabilities catalog this week — a Microsoft Exchange Server zero-day (CVE-2026-42897) with a federal remediation deadline of May 29, and a Cisco Catalyst SD-WAN authentication bypass (CVE-2026-20182) — both demanding immediate action from network defenders. Meanwhile, CYFIRMA's fresh April 2026 ransomware tracking report reveals a rapidly industrializing criminal ecosystem that recorded 801 victims last month alone, as a new batch of Windows zero-days targeting BitLocker and CTFMON escalation remain unpatched.
Microsoft has disclosed a high-severity zero-day vulnerability in on-premises Exchange Server being actively exploited in the wild, allowing attackers to execute arbitrary code via cross-site scripting on Outlook Web Access — with no permanent patch yet available. Meanwhile, Cisco confirmed a critical Catalyst SD-WAN Controller authentication bypass flaw (CVE-2026-20182) has been exploited in zero-day attacks, now added to CISA's Known Exploited Vulnerabilities catalog. The dual disclosure of unpatched, actively exploited flaws across two major enterprise platforms makes this a critical 24-hour period for security teams.
Two unpatched Windows zero-days dubbed "YellowKey" and "GreenPlasma" — enabling BitLocker bypass and privilege escalation — were publicly dropped by an angry researcher just hours after Microsoft's May Patch Tuesday, putting millions of Windows 11 and Server systems at immediate risk. Meanwhile, Foxconn confirmed a ransomware attack affecting North American facilities, and the broader threat landscape continues to consolidate around fewer, higher-impact groups claiming 2,122 victims in Q1 2026 alone.
Two unpatched Windows zero-days — dubbed YellowKey and GreenPlasma — went public with proof-of-concept exploits, threatening BitLocker-protected systems and enabling privilege escalation across unpatched Windows environments. Meanwhile, Microsoft's May 2026 Patch Tuesday delivered fixes for 120+ vulnerabilities including a critical zero-click Outlook flaw (CVE-2026-40361), and global cyberattacks rebounded sharply in April with ransomware expanding and GenAI-assisted threats surging, according to Check Point Research.
Microsoft's May 2026 Patch Tuesday dropped 120+ CVE fixes with no zero-days — a notable first since June 2024 — making it a critical window for organizations to deploy updates. Meanwhile, education platform giant Instructure reportedly reached a ransom settlement with ShinyHunters to suppress the leak of 3.65TB of stolen Canvas data, and Kaspersky's latest research reveals ransomware actors are increasingly pivoting from encryption to pure data theft and EDR-killing tactics.
Check Point Research's fresh Q1 2026 ransomware data reveals 2,122 victims across 70+ active leak sites, with Qilin, The Gentlemen, and LockBit dominating the landscape — even as a new report from Cybersecurity Dive exposes that disclosed incidents represent only a fraction of actual attacks. Meanwhile, the ransomware consolidation trend is reshaping baseline risk expectations heading into mid-2026.
A compromised OAuth token has been confirmed as the root cause of a recent breach at Vercel, highlighting a systemic vulnerability in modern SaaS authentication. Meanwhile, Iran-linked APT group MuddyWater continues active operations, masquerading intrusions as Chaos ransomware attacks to obscure attribution. The Linux "Dirty Frag" kernel zero-day (CVE-2026-43284/CVE-2026-43500) remains a critical unpatched threat, with Cloudflare now detailing its own detection and mitigation response.
Create custom signals on any topic. AI curates and delivers 24/7.
Create SignalPowered by
