Weekly News - GitHub, Grafana Labs breaches traced back to TanStack supply chain compromise

Attackers are exploiting critical NGINX vulnerability - View in browser  Weekly cybersecurity news May 26, 2026 Identity discovery: the overlooked lever in strategic risk reduction Most identity security programs were designed for a world that no longer exists. Identity discovery uncovers new blind spots: the place where breaches begin. Get your report now. Latest articles: $20 per zero-day is already the WordPress plugin reality Deleted Google API keys keep working for up to 23 minutes, researchers warn Suspected KimWolf botnet admin arrested over DDoS-for-hire operation Proton Pass adds monitored credential sharing for AI agents CISA’s new KEV nomination form opens reporting to vendors and researchers Microsoft 365 users targeted by new phishing threat that bypasses MFA Meet Fractal, an OS made for microarchitecture reverse engineering Downtime has become a $600 billion business problem The new economics of fraud: Cheaper, faster, more convincing New infosec products of the week: May 22, 2026 Microsoft open-sources tools for designing and testing AI agents Authorities dismantle First VPN, used by ransomware actors GitHub, Grafana Labs breaches traced back to TanStack supply chain compromise Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-2026-45498) Why AI changed the threat model for travel technology Most dark web activity revolves around a handful of topics AI red teaming agents change how LLMs get tested Product showcase: Bitdefender Mobile Security for iOS protects privacy where scams begin Cyber threats push SMBs to spend more on security Webworm APT targets European government organizations with new backdoors Verizon DBIR: Vulnerability exploitation is the dominant initial access vector FBI: $388 million lost in crypto ATM scams in 2026 TeamPCP breached GitHub’s internal codebase via poisoned VS Code extension Microsoft provides mitigation for “YellowKey” BitLocker bypass flaw (CVE-2026-45585) Communicating cyber risk in dollars boards understand CVE Lite CLI: Open-source dependency vulnerability scanner When your AI assistant has the keys to production 7 hard truths security pros should know: 2026 DevOps Threats Report PureLogs infostealer is stealing credentials worldwide Canonical ships Ubuntu Core 26 with 15 years of security maintenance New macOS infostealer impersonates Apple, Microsoft, and Google in a single attack chain The end of unencrypted Discord calls is here Public Instagram posts provide raw material for AI phishing campaigns Earbud sensors can authenticate users by their heartbeat, study finds AI infrastructure is cracking under sovereignty demands Cybersecurity jobs available right now: May 19, 2026 AI is drowning software maintainers in junk security reports Game over for 74 suspected scammers after Dutch cops plastered their faces on billboards Attackers are exploiting critical NGINX vulnerability (CVE-2026-42945) Attackers accessed, downloaded code from Grafana Labs’ GitHub 201 arrested in INTERPOL disruption of phishing and fraud networks The AI backdoor your security stack is not built to see Lyrie: Open-source autonomous pentesting agent AI shrinks vulnerability exploitation window to hours Product showcase: McAfee + ChatGPT integration turns doubt into a scam check When ransomware hits, confidence doesn’t restore endpoints Debian 13.5 point release lands with security fixes, bug patches Video: What happens when your identity provider becomes the kill chain Industry news: Keepnet contributes voice and SMS phishing data to the 2026 Verizon DBIR Kore.ai unveils AI-native platform for enterprise multiagent systems Versa extends zero trust principles to AI agents and MCP workflows GitLab 19.0 adds AI workflows, secrets management, and self-hosted model support Virtru centers file collaboration around data-level protection ASAPP expands adversarial testing for enterprise AI systems Tenable Hexa AI automates remediation across attack surfaces Riverbed introduces new Aternity tools for autonomous IT operations Forward launches Predict to test network changes before deployment CTERA brings AI insights and automation for unstructured data Terra adds continuous network exploitation validation to its platform NanoCo lands $12 million seed funding, launches enterprise assistant built on NanoClaw ArmorCode gives security teams AI workers for exposure and remediation Novata uses AI to map risk across portfolios and supply chains Trust3 AI focuses on AI agent risks with MCP Security layer Encryption Consulting launches CertSecure Manager v3.3 with zero-touch certificate renewals Darwinium updates mobile SDKs to detect remote access scam activity Selector extends AI-driven observability into multi-cloud environments LaunchDarkly adds real-time controls for AI agents in production Babel Street targets AI-driven threats with new agentic investigation capabilities iProov brings identity verification to video meetings to reduce fraud risks Egnyte unveils Email Capture and AI features to unify fragmented data SmartBear expands ReadyAPI with AI-powered API testing capabilities Copyright © 2026 Help Net Security, All rights reserved. You are receiving Help Net Security daily security news because you opted in at our web site located on www.helpnetsecurity.com. Our mailing address is: Help Net Security Astus d.o.o. Kastav 51215 Croatia Add us to your address book No longer interested in receiving these emails? Unsubscribe Missed an issue? Access our past newsletters here: Archive