Cybersecurity briefing — 2026-05-26

Your incident-response automation is now part of the attack surface, not just the tool that contains it.

• Ghost SQLi Turns Sites Into Trusted Malware Launchpads
• AI Models Become Persistent Attack Operators
• Shared MachineKey Turns One LMS Bug Into Fleet Risk
• Trusted Package Channels Became the Attack Vector
• Phishing Services Now Steal Money in Real Time
• Site Member Access Can Break SharePoint
• ABB Controller Runtime Can Be Stopped Remotely
• ABB PLC Bug Leaks Old Modbus Traffic
• Trusted Registry Logins Exposed 600,000 Records
• Signed Binaries Became MuddyWater's Quiet Entry Point
• Bluetooth Convenience Leaves Shelly Display Exposed
• ABB Camera Connect Needs Its Own VLC Fix
• ABB MConfig Can Leak Plaintext Credentials
• Network Access Can Reboot ABB Zenon Systems
• Chargers Can Be Turned Into Persistent Footholds
• GitHub Actions Became a Secret-Stealing Conveyor Belt
• Fixed VNC Password Exposes BioFlo 320 Control
• Cross-Registry Package Attack Turns Ecosystems Into Trapdoors
• Tycoon 2FA Keeps Sessions After MFA Falls