ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity breaches news, analysis, and intelligence.
Dutch police arrested a 35-year-old man for hacking AFC Ajax, exposing data on hundreds of thousands of supporters. The breach compromised names, addresses, emails, and payment information.
Russian-linked GreyVibe leverages ChatGPT and Gemini to automate phishing and malware. Active since August 2025, the threat group demonstrates how state actors industrialize AI for social engineering at scale.
MyPillow is listed on a ransomware gang's dark web site with claims of stolen customer data and an extortion countdown. CEO Mike Lindell denies the breach, calling it a political attack. The legitimacy of the threat remains unverified.
Social engineering attack exposes 6M Carnival customers' data in the fourth breach since 2019. ShinyHunters stole names, addresses, DOBs, and IDs; Carnival offers 24 months of credit monitoring. (195 characters)
Three critical flaws emerged this week: Claude plugin API interception, Azure RBAC privilege escalation, and Kali365 MFA bypass—exposing systemic weaknesses in cloud security most organizations depend on.
Nearly half of enterprise employees use AI, but power users drive most sensitive data exposure—often through ungoverned shadow tools. This concentration creates a visibility gap that leaves organizations blind to data exfiltration, IP theft, and compliance violations.
Carnival Corporation confirmed a data breach affecting nearly 6 million customers following a social engineering attack in April 2026, with notifications sent May 28—the latest in a series of major security incidents for the cruise industry.
Romanian hacker Catalin Dragomir was sentenced to 56 months for breaching Oregon's state network and selling unauthorized access to 10+ U.S. organizations for $250,000 in damages, highlighting persistent threats to government infrastructure.
TeamPCP orchestrated Shai-Hulud worm attacks on open source via supply chain compromises. The group's success reveals not advanced tradecraft but systemic fragility in development infrastructure.
Modern SOCs must shift from fortress defense to real-time threat visibility and rapid investigation. Attackers exploit intelligence gaps to move silently through legitimate processes; success requires continuous threat intelligence and contextual enrichment.
Dutch police arrested a hacker on May 26 for breaching AFC Ajax, exposing 300,000+ supporter accounts. The attack exploited insecure APIs and weak authentication, compromising personal data and ticket systems.
Charter Communications confirmed a data breach after threat group ShinyHunters stole customer information and demanded ransom. When the company refused to pay, ShinyHunters began releasing the stolen data publicly, affecting millions of Americans.
Iranian threat group MuddyWater escalated espionage across nine countries in Q1 2026, compromising organizations with sophisticated DLL side-loading attacks using legitimate software binaries to evade detection.
A ShinyHunters attack exposed 185,000 7-Eleven customers through vulnerable Salesforce systems, stealing names, addresses, emails, and dates of birth. The data was publicly released after the group's ransom demand went unpaid, highlighting SaaS platforms as prime targets for sophisticated extortion
AI-powered DDoS attacks now evolve in real time, mimicking legitimate traffic and evading defenses. Unlike scripted attacks, these autonomous threats self-optimize based on defensive responses.
Prompt bombing floods users with repeated MFA push notifications to wear them down into approving unauthorized logins. The attack succeeds because notifications lack contextual details (location, app identity, device info) and exploit human fatigue, especially when combined with social engineering.
AI-powered DDoS attacks now automate reconnaissance, optimize attack timing, and evade detection in real-time. This fundamental shift renders traditional defenses ineffective, requiring organizations to rethink their security strategies.
Microsoft Defender auto-isolates compromised endpoints while preserving Defender connection, blocking lateral movement. This automated response counters attackers' ransomware spread tactics that rely on network traversal.
Iranian threat actors deployed MiniFast/MiniJunk V2 malware combining phishing and SEO poisoning to target critical infrastructure sectors. The sophisticated campaign uses encrypted command-and-control channels and supply-chain tactics, suggesting state-sponsored intentions aligned with February 202
7-Eleven confirmed a breach affecting 185,000+ customers in April 2026 after the ShinyHunters extortion gang infiltrated its systems, exposing names, addresses, and contact details from loyalty programs and transactions. The threat actors demanded ransom and threatened to publicly release the stolen
Critical Ghost CMS vulnerability compromised 700+ sites including Harvard and Oxford. Attackers gained unauthorized admin access, enabling malware injection and data theft.
Radiology Associates of Richmond's July 2025 breach exposed 266,183 patients' SSNs, medical records, and financial data, undetected 9 months. This is the provider's second major breach in 2 years.
Oncology Institute (100+ clinics) confirms patient data breach via third-party vendor compromise. Breach reported November 2025 but only confirmed May 2026, highlighting healthcare's supply-chain vulnerability.
NDR platforms historically flooded SOCs with thousands of noisy alerts that analysts struggled to triage. Agentic AI is changing this by automating alert prioritization, enabling teams to act on genuine threats faster while reducing analyst burnout.
Laravel Lang packages were hijacked via rewritten GitHub tags distributing credential-stealing malware across 4 repositories, affecting 233–700 versions. Attackers exploited tag rewrites instead of publishing new versions to evade detection systems.
Laravel-Lang package supply chain attack delivered credential-stealing malware via 700+ malicious versions. Backdoor executes on every PHP request, affecting thousands of production applications globally.
Chinese APT Webworm targets EU governments using Discord for command-and-control and Microsoft Graph for reconnaissance, employing encrypted tunnels to evade detection. The campaign uses spear-phishing to establish persistent access in diplomatic and defense networks.
A 23-year-old Canadian faces extradition for operating Kimwolf, a DDoS botnet with 2 million infected devices and record 31.4 Tbps attacks. It exploited residential proxies to evade detection.
Grafana disclosed that attackers accessed its GitHub repos using a security token exposed in the earlier TanStack supply chain attack. Failure to rotate the compromised credentials led to theft of proprietary code and internal data, illustrating how supply chain compromises cascade across dependent
Chinese APT Webworm compromised European government networks by weaponizing Discord for command-and-control, abusing Microsoft Graph APIs to exfiltrate data, and using SOCKS proxies to evade detection.