Karakurt Negotiator Gets 8.5 Years in First U.S. Conviction
May 6, 2026
Deniss Zolotarjovs, Karakurt’s “cold case” extortion negotiator, received an 8.5-year U.S. federal prison sentence — the first conviction of a
News
Karakurt Negotiator Gets 8.5 Years in First U.S. Conviction
Deniss Zolotarjovs, Karakurt's "cold case" extortion negotiator, received an 8.5-year U.S. federal prison sentence — the first conviction of a Karakurt gang member — linked ...
Microsoft: AiTM Phishing Hit 35,000 Users in 26 Countries
Microsoft disclosed an AiTM phishing campaign targeting 35,000 users in 13,000 organizations across 26 countries between April 14–16, 2026, bypassing MFA by stealing authenticated session ...
Palo Alto CVE-2026-0300 Under Active Attack — Patch Due May 13
Palo Alto Networks disclosed CVE-2026-0300 on May 6, 2026 — a CVSS 9.3 unauthenticated buffer overflow in PAN-OS Captive Portal actively exploited in the wild. ...
cPanel CVE-2026-41940 Exploited Within 24 Hours, Ransomware Deployed
CVE-2026-41940, a critical cPanel authentication bypass, is being actively exploited by multiple actors deploying ransomware and C2 tools against governments and MSPs across five countries.
Kaspersky: DAEMON Tools Backdoored in Supply Chain Attack
Kaspersky discovered DAEMON Tools versions 12.5.0.2421–12.5.0.2434 were backdoored on the official site for one month, infecting thousands across 100+ countries with a first-stage backdoor and ...
ShinyHunters Claims 280 Million Canvas Records Lifted from Instructure
ShinyHunters claims 280 million records stolen from Instructure's Canvas LMS across 8,809 schools and universities in a breach disclosed May 5, 2026.
MOVEit Is Back in the Crosshairs: CVSS 9.8 Flaw in Automation
Progress Software patched a CVSS 9.8 authentication bypass in MOVEit Automation — the same product line that fueled the catastrophic Cl0p ransomware campaign in 2023.
HR Emails Are the New Phishing Bait — And MFA Won’t Save You
An adversary-in-the-middle phishing campaign hit 35,000 workers across 13,000 organizations in 48 hours, using fake HR emails to bypass MFA and steal Microsoft tokens.
SimpleHelp and ScreenConnect: The IT Tools That Became a Backdoor
VENOMOUS#HELPER spent 13 months inside 80+ organizations using legitimate RMM software — SimpleHelp and ScreenConnect — as undetected persistent access channels.
11 Million Downloads, One Poisoned Version: PyTorch’s Close Call
Attackers compromised PyTorch Lightning 2.6.3 on PyPI with ShaiWorm credential stealer, targeting cloud API keys, browser credentials, and AWS/Azure/GCP tokens.
Microsoft: AiTM Phishing Hit 35,000 Users in 26 Countries
May 6, 2026
Microsoft disclosed an AiTM phishing campaign targeting 35,000 users in 13,000 organizations across 26 countries between April 14–16, 2026, bypassing
Palo Alto CVE-2026-0300 Under Active Attack — Patch Due May 13
May 6, 2026
Palo Alto Networks disclosed CVE-2026-0300 on May 6, 2026 — a CVSS 9.3 unauthenticated buffer overflow in PAN-OS Captive Portal
cPanel CVE-2026-41940 Exploited Within 24 Hours, Ransomware Deployed
May 6, 2026
CVE-2026-41940, a critical cPanel authentication bypass, is being actively exploited by multiple actors deploying ransomware and C2 tools against governments
Kaspersky: DAEMON Tools Backdoored in Supply Chain Attack
May 6, 2026
Kaspersky discovered DAEMON Tools versions 12.5.0.2421–12.5.0.2434 were backdoored on the official site for one month, infecting thousands across 100+ countries
ShinyHunters Claims 280 Million Canvas Records Lifted from Instructure
May 6, 2026
ShinyHunters claims 280 million records stolen from Instructure’s Canvas LMS across 8,809 schools and universities in a breach disclosed May
MOVEit Is Back in the Crosshairs: CVSS 9.8 Flaw in Automation
May 5, 2026
Progress Software patched a CVSS 9.8 authentication bypass in MOVEit Automation — the same product line that fueled the catastrophic
HR Emails Are the New Phishing Bait — And MFA Won’t Save You
May 5, 2026
An adversary-in-the-middle phishing campaign hit 35,000 workers across 13,000 organizations in 48 hours, using fake HR emails to bypass MFA
SimpleHelp and ScreenConnect: The IT Tools That Became a Backdoor
May 5, 2026
VENOMOUS#HELPER spent 13 months inside 80+ organizations using legitimate RMM software — SimpleHelp and ScreenConnect — as undetected persistent access
11 Million Downloads, One Poisoned Version: PyTorch’s Close Call
May 5, 2026
Attackers compromised PyTorch Lightning 2.6.3 on PyPI with ShaiWorm credential stealer, targeting cloud API keys, browser credentials, and AWS/Azure/GCP tokens.
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.