The Week Defender Was The Privilege Escalation
Defender zero-days and a nine-year Linux kernel bug both handed attackers SYSTEM. See what cybersecurity teams should change this week.
May 2026
Your Users Searched For Help. They Got Implants.
TamperedChef and the npm Shai-Hulud lineage prove search results and package registries now ship malware. Here's the cybersecurity playbook that holds up.
One Teenager Ran 28,000 Stolen Accounts Alone
One Odesa teenager allegedly harvested 28,000 accounts with off-the-shelf infostealers. Here's why your stack misses it, and what to fix now.
One Workflow Token Beat Grafana’s Incident Response
Grafana rotated tokens after TanStack and still got breached. Here's the cybersecurity lesson on token inventory. Tighten yours before you need it.
GitHub Got Breached Through A Single Laptop
GitHub lost 3,800 repos to a poisoned VS Code extension on one employee laptop. Here's the cybersecurity fix every dev shop needs now.
One Zero-Day. A Whole Country Offline.
Luxembourg's whole telecom network died from one Huawei zero-day. Verizon says patching got 34% slower. See what to fix first.
Signed Malware Has a Subscription Now
Microsoft disrupted Fox Tempest's malware-signing-as-a-service. Here's what it means for your cybersecurity trust model, and how to adjust.
Two Million Developers Installed the Backdoor Themselves
A compromised VS Code extension reached 2.2M developer machines. See what the Nx Console and TeamPCP incidents demand from your cybersecurity playbook now.
They Skipped The Malware. The Cloud Fell Anyway.
Storm-2949 breached a cloud tenant with zero malware. Your EDR never saw it. See what to harden this week before the next stolen token lands.
Even CISA Forgot to Check Its Own GitHub
CISA's own contractor pushed GovCloud keys to public GitHub. Here's why your secret scanner won't save you and what to fix this week.