Cybersecurity briefing, 2026-05-28

A free account became a platform takeover, because deleting credentials from the environment never wiped them from process memory.

• Leak Count Exceeds Carnival's Formal Notice
• Any New Gogs Account Can Take Over the Forge
• Developer Lure Becomes Supply-Chain Tampering
• Invisible Access Lingers After AI Agents Leave
• Single-Prompt Safety Scores Miss Multi-Turn Hijacks
• Pirated-Content Miner Adds Persistent Remote Access
• Free Zapier Account Reaches the Package Supply Chain
• APT Campaigns Shift to Trust Chokepoints
• npm Install Becomes a Claude Data Exfil Path
• Private Gitea Images Leaked Without Login
• Session Tokens, Not Passwords, Are the Prize
• Open Source Fixes Move Toward Paid Gatekeepers
• Default Mode Leaves ABB Door Systems Open
• Government Data Is Becoming a Resellable Abuse Asset
• Ransomware That Spreads Itself Changes Containment
• Charging Controllers Accept Trusted Code From the Wrong Place
• AI Blurs the Line in GREYVIBE Espionage
• Shadow AI Bypasses Policy Through Trusted Access
• Old Logs Revealed the Akira Intrusion

Recent editions

• Wednesday, May 27, 2026: Chatbot Answers Now Deliver Cryptojacking Lures · 17 stories
• Tuesday, May 26, 2026: Ghost SQLi Turns Sites Into Trusted Malware Launchpads · 19 stories
• Monday, May 25, 2026: Ghost SQLi Turns Sites Into Trusted Malware Launchpads · 13 stories
• Sunday, May 24, 2026: Ghost SQLi Turns Sites Into Trusted Malware Launchpads · 5 stories
• Saturday, May 23, 2026: Apex One Server Can Push Malicious Code Fleet-Wide · 14 stories
• Friday, May 22, 2026: Apex One Server Can Push Malicious Code Fleet-Wide · 18 stories
• Thursday, May 21, 2026: Malicious npm Release Exposed Secrets Before CVE Appeared · 18 stories