Verizon 2026 DBIR: Vulnerability Exploitation Surpasses Stolen Credentials as Top Breach Vector for First Time
Summary The 2026 Verizon Data Breach Investigations Report (DBIR), published today, reveals a watershed moment in cybersecurity: for the first time in the report’s 19-year history, vulnerability exploitation has overtaken…
“Copy Fail” Linux Kernel Zero-Day (CVE-2026-31431) Grants Root Access on Kernels Dating Back to 2017
Summary A critical Linux kernel zero-day vulnerability dubbed “Copy Fail” (CVE-2026-31431) has been disclosed, affecting Linux distributions running kernel versions released since 2017. The flaw allows an unprivileged local user…
Sapient Intelligence Launches HRM-Text — A Brain-Inspired 1B Parameter Model Trained on 1,000x Fewer Tokens Than Traditional LLMs
Summary Israeli AGI research company Sapient Intelligence has launched HRM-Text, an open-source 1-billion-parameter reasoning language model that takes a fundamentally different approach to AI architecture. Instead of the standard Transformer’s…
Microsoft May 2026 Patch Tuesday: 118 Fixes Including Critical Netlogon RCE (CVSS 9.8) and DNS Client Flaw
Summary Microsoft’s May 2026 Patch Tuesday addresses 118 vulnerabilities across its product ecosystem, with 16 rated critical and 102 rated important. The update includes fixes for remote code execution, privilege…
“Chaotic Eclipse” Drops Three Windows Zero-Days in Vendetta Against Microsoft — YellowKey, GreenPlasma, and MiniPlasma All Exploited in the Wild
Summary A disgruntled security researcher operating under the aliases “Chaotic Eclipse” and “Nightmare Eclipse” has publicly released proof-of-concept exploits for three separate Windows zero-day vulnerabilities in a coordinated campaign timed…
ShinyHunters Breach Canvas LMS — Nearly 9,000 Schools Hit in One of the Largest Education Data Thefts Ever
Summary The notorious ShinyHunters threat group has pulled off what security experts are calling one of the most significant education-related data thefts ever recorded. The attack targeted Instructure’s Canvas learning…
Malicious Google Ads Push Fake Claude Installers Delivering MacSync Infostealer — Hosted on Claude.ai Itself
A sophisticated malvertising campaign dubbed “InstallFix” is actively leveraging Google Ads and, remarkably, legitimate Claude.ai shared chats to distribute the MacSync infostealer to macOS users and credential-stealing trojans to Windows…
Grafana Labs Discloses GitHub Breach — Attacker Stole Codebase via CI/CD Pipeline Exploit, Then Attempted Extortion
Grafana Labs disclosed on May 16, 2026, that a threat actor infiltrated its GitHub environment by exploiting a misconfigured CI/CD pipeline, stealing a privileged token, downloading the company’s private codebase,…
OpenAI Launches $4 Billion “DeployCo” Venture to Embed AI Engineers Directly Into Enterprise Operations
OpenAI has launched the OpenAI Deployment Company (“DeployCo”), a majority-owned subsidiary backed by over $4 billion in initial investment and valued at $10 billion pre-money. The venture’s mission is to…
“Fragnesia” Linux Kernel LPE (CVE-2026-46300) Grants Root via Page-Cache Corruption — PoC Released
A new high-severity local privilege escalation vulnerability in the Linux kernel, dubbed “Fragnesia” and tracked as CVE-2026-46300 (CVSS 7.8), has been publicly disclosed along with a working proof-of-concept exploit. Discovered…