Find what you’re looking for

Microsoft's May 2026 Patch Tuesday: A Comprehensive Security Update

In May 2026, Microsoft released its Patch Tuesday updates addressing 120 security vulnerabilities, including 17 classified as 'Critical.' Notably, this release marked the first in nearly two years without any zero-day vulnerabilities being disclosed or exploited. The critical flaws encompassed remote code execution and elevation of privilege vulnerabilities across various Microsoft products, including Office, Word, and Excel. The absence of zero-day vulnerabilities in this release is a positive development; however, the high number of critical vulnerabilities underscores the ongoing need for organizations to promptly evaluate and deploy these updates to mitigate potential security risks. ([computerweekly.com](https://www.computerweekly.com/news/366642908/Microsoft-releases-rare-zero-day-free-Patch-Tuesday-update?utm_source=openai))

Critical RCE Vulnerabilities in Fortinet's FortiSandbox and FortiAuthenticator: Immediate Action Required

In May 2026, Fortinet disclosed critical remote code execution (RCE) vulnerabilities in its FortiSandbox and FortiAuthenticator products. These flaws, identified as CVE-2026-44277 and CVE-2026-26083, could allow unauthenticated attackers to execute arbitrary code or commands on unpatched systems via crafted HTTP requests. FortiAuthenticator versions 6.5.7, 6.6.9, and 8.0.3, and FortiSandbox versions 4.4.9 and above, have been patched to address these issues. Organizations using these products are urged to update immediately to mitigate potential exploitation risks. The disclosure underscores the persistent targeting of Fortinet products by threat actors, often leveraging such vulnerabilities in ransomware and cyber-espionage campaigns. This incident highlights the critical importance of timely patch management and continuous monitoring to defend against evolving cyber threats.

Signal Phishing Attacks 2026: A Wake-Up Call for Cybersecurity

In early 2026, Russian state-sponsored hackers launched a sophisticated phishing campaign targeting high-profile Signal and WhatsApp users, including government officials, military personnel, and journalists. The attackers impersonated official support accounts, deceiving victims into sharing verification codes or scanning QR codes, thereby granting unauthorized access to their accounts and sensitive communications. This campaign exploited social engineering tactics rather than technical vulnerabilities, highlighting the persistent threat posed by human-centric attack vectors. In response, Signal introduced enhanced in-app security features to combat such phishing and social engineering attempts. These measures include displaying 'Name not verified' warnings for new contacts, prompting users to confirm new requests while reminding them that Signal will never ask for registration codes or PINs, and providing enriched safety tips. These proactive steps aim to bolster user awareness and resilience against evolving social engineering threats.

Instructure Canvas 2026 Cyberattacks: A Wake-Up Call for Educational Cybersecurity

In April and May 2026, Instructure's Canvas learning management system suffered two significant cyberattacks orchestrated by the ShinyHunters extortion group. The initial breach on April 29 led to the theft of personal information—including names, email addresses, student ID numbers, and user communications—from approximately 275 million individuals across nearly 9,000 educational institutions. Shortly after, on May 7, ShinyHunters executed a second attack, defacing Canvas login portals with ransom messages, disrupting access during critical final exams. Instructure responded by revoking compromised credentials, implementing security patches, and engaging forensic experts to investigate the incidents. ([apnews.com](https://apnews.com/article/3d55b9399ae87d49276f354e1c34c180?utm_source=openai)) These breaches underscore the escalating threats faced by educational institutions, particularly during pivotal academic periods. The incidents highlight the necessity for robust cybersecurity measures, proactive threat detection, and comprehensive incident response plans to safeguard sensitive student and staff data against increasingly sophisticated cybercriminal activities. ([apnews.com](https://apnews.com/article/209a51692f043a959459dbe37fb34e4b?utm_source=openai))

UK Water Supplier Fined $1.3M for Massive Data Breach

In May 2026, the UK's Information Commissioner's Office (ICO) fined South Staffordshire Water Plc and its parent company £963,900 ($1.3 million) following a cyberattack that exposed the personal data of 663,887 customers and employees. The breach originated in September 2020 through a phishing email, allowing attackers to install malware that remained undetected for 20 months. Between May and July 2022, the attackers escalated privileges, gaining domain administrator access. The breach was discovered in July 2022 after IT performance issues prompted an investigation. The compromised data included full names, addresses, email addresses, phone numbers, dates of birth, customer account credentials, bank account details, and employee HR data such as National Insurance numbers. This incident underscores the critical importance of robust cybersecurity measures, especially in essential service sectors. The prolonged undetected presence of malware highlights the need for continuous monitoring and rapid response capabilities to mitigate potential threats effectively.

Exim BDAT Vulnerability (CVE-2026-45185) Puts GnuTLS Configurations at Risk of Remote Code Execution

In May 2026, a critical vulnerability identified as CVE-2026-45185, also known as Dead.Letter, was discovered in Exim's Mail Transfer Agent (MTA) software. This use-after-free flaw affects versions 4.97 through 4.99.2 when configured with GnuTLS for TLS connections. The vulnerability is triggered during BDAT message body handling when a client sends a TLS close_notify alert before completing the body transfer, followed by a final byte in cleartext on the same TCP connection. This sequence can lead to heap corruption, potentially allowing remote code execution. The issue was reported by Federico Kirschbaum of XBOW on May 1, 2026, and has been addressed in Exim version 4.99.3. Users are strongly advised to upgrade immediately, as no mitigations are available for this vulnerability. This incident underscores the critical importance of timely software updates and vigilant monitoring of open-source components. The exploitation of such vulnerabilities can lead to severe security breaches, emphasizing the need for robust security practices and proactive vulnerability management in IT infrastructures.

State of Ransomware in 2026: Emerging Trends and Tactics

In 2025, ransomware attacks evolved significantly, with a notable rise in 'encryption-less' extortion tactics where attackers exfiltrate sensitive data and threaten its release without encrypting files. Additionally, some ransomware groups began adopting post-quantum cryptography to secure their operations against future quantum computing threats. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/international-anti-ransomware-day-2026-kaspersky-shares-insights-into-ransomware-trends-and-tactics?utm_source=openai)) These developments underscore the increasing sophistication of ransomware operations, highlighting the need for organizations to enhance their cybersecurity measures to protect against data breaches and ensure compliance with evolving regulatory standards.

RubyGems Supply Chain Attack Highlights Open-Source Security Risks

In early May 2026, RubyGems, the primary package manager for the Ruby programming language, faced a significant supply chain attack involving the upload of hundreds of malicious packages. These packages were designed to steal sensitive information such as cloud credentials and SSH keys, and to tamper with Continuous Integration (CI) pipelines. In response, RubyGems temporarily suspended new account registrations to mitigate the threat and initiated a comprehensive investigation to identify and remove the compromised packages. This incident underscores the escalating risks associated with software supply chain attacks, particularly within open-source ecosystems. The attack highlights the necessity for robust security measures in package management systems and the importance of vigilant monitoring to detect and prevent the distribution of malicious code. Organizations are urged to implement stringent dependency controls and to stay informed about emerging threats targeting development environments.

Mini Shai-Hulud Malware Compromises TanStack npm Packages in 2026

In May 2026, the Mini Shai-Hulud malware campaign, orchestrated by the threat actor group TeamPCP, compromised hundreds of npm packages, notably within the TanStack ecosystem. The malware infiltrated developer environments and CI/CD pipelines, exfiltrating credentials and propagating itself by leveraging stolen access tokens to publish malicious package versions. This self-replicating attack underscores the vulnerabilities inherent in software supply chains and the critical need for robust security measures. The resurgence of Mini Shai-Hulud highlights an escalating trend in sophisticated supply chain attacks targeting open-source ecosystems. Organizations must prioritize securing their development pipelines, implement stringent access controls, and continuously monitor for unauthorized activities to mitigate the risks posed by such evolving threats.

Hugging Face Tokenizer.json Vulnerability: A New AI Supply Chain Threat

In May 2026, security researchers identified a vulnerability in Hugging Face's AI models, specifically within the 'tokenizer.json' file. Attackers can manipulate this file to intercept and redirect model outputs, potentially exfiltrating sensitive data such as API parameters and credentials. This supply chain attack affects models run locally using formats like SafeTensors, ONNX, and GGUF, but does not impact models executed through Hugging Face's Inference API. The compromised 'tokenizer.json' file allows threat actors to gain visibility into every URL the model accesses, posing significant security risks. This incident underscores the growing threat of supply chain attacks targeting AI infrastructure. As organizations increasingly rely on open-source AI models, ensuring the integrity of all components, including configuration files like 'tokenizer.json', becomes critical. The attack highlights the need for robust validation mechanisms and heightened vigilance when integrating third-party AI models into production environments.

Critical Vulnerability in Fuji Electric's Tellus Software: CVE-2026-8108

In May 2026, a critical vulnerability (CVE-2026-8108) was identified in Fuji Electric's Tellus software, version 5.0.2. This flaw allows attackers to escalate privileges from user to system level, potentially leading to denial of service, unauthorized file access, or deletion. The vulnerability arises from the installation process, which adds a driver to the kernel granting all users read and write permissions. Fuji Electric recommends installing Tellus with administrator privileges to mitigate this risk. This incident underscores the persistent challenges in securing industrial control systems, particularly in the critical manufacturing sector. Organizations must remain vigilant, ensuring software installations follow best practices and regularly updating systems to address emerging vulnerabilities.

ABB Automation Builder Gateway Vulnerability Exposes Industrial Control Systems

In February 2026, ABB disclosed a vulnerability (CVE-2024-41975) in its Automation Builder Gateway for Windows, affecting versions prior to 2.9.0. The gateway, by default, listens on all network adapters on port 1217, allowing unauthenticated remote access. This configuration enables attackers to scan for connected Programmable Logic Controllers (PLCs). While PLC user management typically prevents unauthorized access, if disabled, attackers could potentially interact with the PLCs. ABB addressed this issue in version 2.9.0 by restricting the gateway's default access to local connections. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-25-133-04?utm_source=openai)) This incident underscores the critical importance of secure default configurations in industrial control systems. As cyber threats targeting operational technology environments increase, organizations must ensure that default settings do not expose systems to unnecessary risks. Regularly updating software and reviewing default configurations are essential steps in mitigating such vulnerabilities.