Cybersecurity briefing, 2026-05-26

Your incident-response automation is now part of the attack surface, not just the tool that contains it.

• Ghost SQLi Turns Sites Into Trusted Malware Launchpads
• AI Models Become Persistent Attack Operators
• Shared MachineKey Turns One LMS Bug Into Fleet Risk
• Trusted Package Channels Became the Attack Vector
• Phishing Services Now Steal Money in Real Time
• Site Member Access Can Break SharePoint
• ABB Controller Runtime Can Be Stopped Remotely
• ABB PLC Bug Leaks Old Modbus Traffic
• Trusted Registry Logins Exposed 600,000 Records
• Signed Binaries Became MuddyWater's Quiet Entry Point
• Bluetooth Convenience Leaves Shelly Display Exposed
• ABB Camera Connect Needs Its Own VLC Fix
• ABB MConfig Can Leak Plaintext Credentials
• Network Access Can Reboot ABB Zenon Systems
• Chargers Can Be Turned Into Persistent Footholds
• GitHub Actions Became a Secret-Stealing Conveyor Belt
• Fixed VNC Password Exposes BioFlo 320 Control
• Cross-Registry Package Attack Turns Ecosystems Into Trapdoors
• Tycoon 2FA Keeps Sessions After MFA Falls

Recent editions

• Monday, May 25, 2026: Ghost SQLi Turns Sites Into Trusted Malware Launchpads · 13 stories
• Sunday, May 24, 2026: Ghost SQLi Turns Sites Into Trusted Malware Launchpads · 5 stories
• Saturday, May 23, 2026: Apex One Server Can Push Malicious Code Fleet-Wide · 14 stories
• Friday, May 22, 2026: Apex One Server Can Push Malicious Code Fleet-Wide · 18 stories
• Thursday, May 21, 2026: Malicious npm Release Exposed Secrets Before CVE Appeared · 18 stories
• Wednesday, May 20, 2026: Malicious npm Release Exposed Secrets Before CVE Appeared · 19 stories
• Tuesday, May 19, 2026: Critical Manufacturing Gear Exposed by PAN-OS Flaw · 20 stories