Stay updated with the latest cybersecurity developments! This roundup highlights critical incidents, vulnerabilities, supply chain attacks, and industry responses amid rapidly evolving threats in May 2026. From educational platform disruptions to open-source ecosystem compromises, these stories underscore the need for proactive defense, rapid patching, and supply chain vigilance.
1. Instructure Reaches Ransom Agreement with ShinyHunters to Halt 3.65TB Canvas Data Leak
Published: May 12, 2026
Instructure, the company behind the widely used Canvas learning management system, struck a deal with the ShinyHunters extortion group following a major breach affecting thousands of schools and universities. The attackers stole 3.65TB of data (including student names, emails, IDs, and messages) from nearly 9,000 institutions, leading to outages during final exams. Instructure confirmed the data was returned and destroyed, with no further customer extortion expected. U.S. lawmakers are now seeking testimony on the incident.
2. RubyGems Suspends New Signups After Major Malicious Package Attack
Published: May 12, 2026
RubyGems, the primary package repository for Ruby, temporarily disabled new account registrations following a “major malicious attack” involving hundreds of malicious packages (over 500 reported). Some packages carried exploits, though the primary target appeared to be the platform itself rather than widespread user compromise. The incident highlights ongoing risks to open-source supply chains; cleanup is underway, and spam activity has reportedly stopped.
3. Mini Shai-Hulud Supply Chain Attack Compromises TanStack, Mistral AI, and More npm/PyPI Packages
Published: May 12, 2026
Threat actors (linked to TeamPCP) forked repositories and poisoned packages from TanStack, Mistral AI, UiPath, Guardrails AI, and others, publishing over 400 malicious versions. The self-spreading worm included obfuscated credential stealers targeting CI secrets, cloud providers, and wallets. Affected packages have been deprecated; users should rotate credentials and review dependencies.
4. New Critical Exim BDAT Vulnerability (CVE-2026-45185) Could Enable Remote Code Execution
Published: May 12-13, 2026
Exim released updates for a use-after-free flaw in BDAT message handling (when using GnuTLS) that could lead to heap corruption and potential code execution. The vulnerability is triggered by specific TLS close sequences followed by cleartext data. Email server administrators should patch immediately.
5. Microsoft May 2026 Patch Tuesday Addresses 120-137 Vulnerabilities
Published: May 12-13, 2026
Microsoft’s latest updates fix dozens of flaws across Windows, Azure, Dynamics 365, and more, including a critical zero-click Outlook vulnerability. No zero-days were exploited in the wild this cycle, but organizations should prioritize deployment. AI tools helped discover some issues internally.
6. Fortinet and Ivanti Patch Critical RCE Flaws
Published: May 12, 2026
Fortinet addressed severe remote code execution vulnerabilities in FortiSandbox and FortiAuthenticator. Ivanti warned of an exploited zero-day in Endpoint Manager Mobile (EPMM). Immediate patching is recommended to prevent arbitrary code execution and data exposure.
7. Foxconn Confirms Cyberattack on North American Factories by Nitrogen Ransomware
Published: May 13, 2026
Electronics giant Foxconn reported a ransomware incident affecting North American operations, with the Nitrogen group claiming responsibility and alleging 8TB of data theft. Systems are being restored; the attack highlights risks to global manufacturing supply chains.
8. Google Detects AI-Generated Zero-Day Exploit; New TrickMo Android Trojan Variant Emerges
Published: May 11-12, 2026
Google Threat Intelligence identified hackers using AI to develop a zero-day for a web admin tool. Separately, a new TrickMo banking trojan variant leverages TON C2 and SOCKS5 for network pivoting, targeting users in Europe.
Read more (Google story) and related coverage.
Stay Vigilant
Cyber threats continue to target education, supply chains, open-source ecosystems, and critical infrastructure with increasing sophistication, including AI assistance and extortion tactics. Organizations should prioritize patching, supply chain security (e.g., dependency pinning and SBOMs), multi-factor authentication, and incident response planning. Consider tools for automated vulnerability scanning and monitoring. Subscribe for daily/weekly updates and maintain strong backups—never pay ransoms without expert guidance. Stay safe online!