Cybersecurity briefing, 2026-05-26

Your incident-response automation is now part of the attack surface, not just the tool that contains it.

• Ghost SQLi turns sites into trusted malware launchpads
• AI models become persistent attack operators
• Shared MachineKey turns one LMS bug into fleet risk
• Trusted package channels became the attack vector
• Phishing services now steal money in real time
• Site Member access can break SharePoint
• ABB controller runtime can be stopped remotely
• ABB PLC bug leaks old Modbus traffic
• Trusted registry logins exposed 600,000 records
• Signed binaries became MuddyWater's quiet entry point
• Bluetooth convenience leaves Shelly Display exposed
• ABB Camera Connect needs its own VLC fix
• ABB MConfig can leak plaintext credentials
• Network access can reboot ABB zenon systems
• Chargers can be turned into persistent footholds
• GitHub Actions became a secret-stealing conveyor belt
• Fixed VNC password exposes BioFlo 320 control
• Cross-registry package attack turns ecosystems into trapdoors
• Tycoon 2FA keeps sessions after MFA falls

Recent editions

• Monday, May 25, 2026: Trusted package channels became the attack vector · 13 stories
• Sunday, May 24, 2026: Shared cPanel hosts face root compromise risk · 5 stories
• Saturday, May 23, 2026: Apex One server can push malicious code fleet-wide · 14 stories
• Friday, May 22, 2026: Cloud Atlas builds redundant paths into government networks · 18 stories
• Thursday, May 21, 2026: Malicious npm release exposed secrets before CVE appeared · 18 stories
• Wednesday, May 20, 2026: Critical manufacturing gear exposed by PAN-OS flaw · 19 stories
• Tuesday, May 19, 2026: React Server Components face hour-scale ransomware risk · 20 stories