Cybersecurity briefing — 2026-05-28

A free account became a platform takeover, because deleting credentials from the environment never wiped them from process memory.

• Leak Count Exceeds Carnival's Formal Notice
• Any New Gogs Account Can Take Over the Forge
• Developer Lure Becomes Supply-Chain Tampering
• Invisible Access Lingers After AI Agents Leave
• Single-Prompt Safety Scores Miss Multi-Turn Hijacks
• Pirated-Content Miner Adds Persistent Remote Access
• Free Zapier Account Reaches the Package Supply Chain
• APT Campaigns Shift to Trust Chokepoints
• npm Install Becomes a Claude Data Exfil Path
• Private Gitea Images Leaked Without Login
• Session Tokens, Not Passwords, Are the Prize
• Open Source Fixes Move Toward Paid Gatekeepers
• Default Mode Leaves ABB Door Systems Open
• Government Data Is Becoming a Resellable Abuse Asset
• Ransomware That Spreads Itself Changes Containment
• Charging Controllers Accept Trusted Code From the Wrong Place
• AI Lets Lower-Skill Spyware Scale Faster
• Shadow AI Bypasses Policy Through Trusted Access
• Old Logs Revealed the Akira Intrusion