News

According to SANS™ Internet Storm Center, the latest issue of its Stormcast for 11 May 2026 covers topics including New Linux Priv Escalation, PAM Backdoors, CPanel Updates, and Let’s Encrypt. The page also notes that it is a daily podcast summarising…

The Federal Communications Commission has eased some restrictions on foreign-made consumer routers and will permit vendors to continue issuing software and firmware updates for already-deployed devices in the US through at least January 2029. The decision…

The Mini Shai-Hulud worm is actively compromising legitimate npm packages by hijacking CI/CD pipelines and stealing developer secrets, and according to StepSecurity's OSS Package Security Feed the attack began with ten malicious versions of official…

According to StepSecurity's OSS Package Security Feed, the Shai-Hulud worm compromised 5 official @tanstack packages across 10 malicious versions, injecting credential-stealing malware into a popular React routing library. On May 11, 2026, at approximately…

On 11 May 2026, StepSecurity’s OSS Package Security feed flagged the latest releases of several @tanstack/* packages on npm as malicious, describing a coordinated supply-chain attack that poisoned multiple TanStack Router packages with an install-time…

Tech can't be expected to stop every threat, the piece argues, because technical controls can only do so much and must be complemented by vigilant human behaviour. It highlights four attack trends where employees become the frontline defence, with BEC…

A threat actor named Mr_Rot13 has been attributed to exploiting a recently disclosed critical cPanel flaw to deploy a backdoor codenamed Filemanager on compromised environments. The attack targets CVE-2026-41940, a vulnerability in cPanel and WebHost Manager…

The DataBreaches[.]net post, published on 11 May 2026, highlights thousands of internet-facing DICOM servers exposed by a lack of basic security measures. According to Trend Micro TrendAI analysis, the researchers identified thousands of servers belonging to…

According to Google Threat Intelligence Group (GTIG) in a report shared with The Hacker News, an unknown threat actor likely developed a zero‑day exploit with an artificial intelligence system to enable a mass vulnerability exploitation operation, marking…

A new TrickMo Android banking trojan variant, dubbed TrickMo C, has shifted its primary command-and-control transport onto The Open Network (TON) Blockchain, routing communications via the network’s .adnl identities to hinder traditional domain takedowns.…

According to Ontinue's Cyber Defense Center, a previously undocumented information stealer has been distributed through fake Claude Code installation pages that hijack Chromium browsers to bypass App-Bound Encryption and exfiltrate cookies, passwords and…

Threat actors are increasingly using AI tools to speed exploit development and drive attack orchestration, a trend underscored by new research from Google into AI-enabled cyber operations. According to Google, adversaries have leveraged large language models…

According to Google Threat Intelligence Group (GTIG), cybercriminals have used AI to identify and weaponise a zero-day vulnerability for the first time, in a campaign that aimed to bypass two-factor authentication on a popular open-source, web-based system…

In the week ending 11 May 2026, The Hacker News recapped a mix of familiar attack patterns, including poisoned downloads, cloud misconfigurations and long‑standing bugged access paths, alongside newer methods like WebSocket backdoors and skimmers. The Threat…

Korea’s child rights agency data mishandling exposes a lot of sensitive and personal information, according to DataBreaches[.]Net. The breach at the National Center for the Rights of the Child (NCRC) occurred between 30 April and 2 May, and was flagged when…

A cyber espionage operation dubbed HeartlessSoul has targeted aerospace firms and drone operators, using phishing and malvertising campaigns to deliver malware that masquerades as installers for legitimate aviation software and resources. The attackers…

Purple teaming combines red team finding attacker paths with blue team validating detections and responses, iterating so red’s output becomes blue’s input and vice versa. The piece argues that traditional purple teaming has fallen short because of friction,…

The US Federal Communications Commission has extended the deadline for owners of banned internet routers to provide security updates to US-based users by two years. In March 2026, the Commission banned the import and sale of all consumer-grade internet…

The education sector has found itself in the crosshairs of a ShinyHunters “pay or leak” extortion campaign following the compromise of Instructure, the company behind the Canvas Learning Management System. The original compromise of Instructure occurred on…