AI-Generated Zero-Day Discovered; Massive Supply Chain Attack Hits npm & PyPI; Ransomware Evolves with Post-Quantum Crypto
Summary
This reporting period for May 11-12, 2026, is marked by a watershed moment in cyber warfare: Google's discovery of the first AI-generated zero-day exploit. The cybersecurity landscape was further rocked by a massive supply chain attack, dubbed 'mini-shai-hulud', compromising over 170 npm and PyPI packages. Meanwhile, ransomware trends show a strategic shift towards post-quantum encryption and data leak extortion, with groups like ShinyHunters and Qilin demonstrating new tactics. Critical vulnerabilities in widely used enterprise software from Palo Alto Networks, JetBrains, and Ivanti underscore the persistent risk of zero-day exploitation.
Today New Articles
Ransomware Evolves in 2026: Attackers Adopt Post-Quantum Crypto and Encryptionless Extortion
Kaspersky's 2026 ransomware report reveals major tactical shifts. While the number of affected organizations has slightly decreased, the threat has intensified. Advanced groups are now deploying ransomware with post-quantum cryptography to future-proof their e...
High-Severity Flaw in JetBrains TeamCity On-Premises Allows API Exposure (CVE-2026-44413)
JetBrains has disclosed and patched a high-severity, post-authentication vulnerability (CVE-2026-44413) in its TeamCity On-Premises CI/CD server. The flaw allows any authenticated user, regardless of their permissions, to expose parts of the server API to unau...
Living Off the Land: Threat Actors Increasingly Abuse Legitimate Platforms Like Teams and GitHub
A significant 2026 trend shows threat actors are increasingly abusing trusted enterprise platforms to conduct malicious operations and evade detection. Attackers are 'living off the trusted platform' by leveraging services like Microsoft Teams for malware deli...
Critical Flaws in AI Coding Agents and Browser Extensions Expose Developer Workflows
Security researchers have uncovered critical vulnerabilities in popular open-source AI tools, highlighting new risks in developer workflows. A WebSocket hijacking flaw (CVSS 9.7) in the AI coding agent Cline's local Kanban server allowed any visited website to...
AD CS Escalation Deep Dive: How Attackers Abuse Certificate Templates for Domain Dominance
Security researchers from Unit 42 have published a detailed analysis of advanced attacks targeting Active Directory Certificate Services (AD CS). The report highlights how threat actors, from ransomware groups to state-sponsored entities, are exploiting common...
Article Updates
Ransomware Landscape Report: Qilin Leads, 'The Gentlemen' Surges in Q1 2026
Update:A new Q1 2026 report from Check Point Research reveals significant ransomware market consolidation, with top 10 groups claiming 71% of victims. LockBit 5.0 made a strong comeback with 163 victims after law enforcement disruption. Qilin remained the market lead...
QR Code Phishing Surges 146% in Q1 2026, Microsoft Warns
Update:A new report from Barracuda reinforces the escalating email threat landscape, confirming the surge in QR code phishing and highlighting AI's role in crafting hyper-realistic social engineering lures. It identifies malicious HTML attachments as another key evas...
Ivanti Discloses Third Actively Exploited EPMM Zero-Day of 2026 (CVE-2026-6973)
Update:Ivanti has officially released critical security patches for the actively exploited zero-day vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile (EPMM) platform. This RCE flaw, which allows authenticated administrators to execute arbitrary code, was c...
Landmark Discovery: Google Disrupts Campaign Using First-Ever AI-Developed Zero-Day Exploit
Update:New technical analysis of the AI-developed zero-day exploit reveals it targets a semantic logic flaw rooted in a hard-coded trust assumption, enabling 2FA bypass after an attacker obtains valid user credentials. The AI is specifically identified as a Large Lan...
Canvas LMS Breach: ShinyHunters Hacks Thousands of Schools, Disrupts Final Exams
Update:New reports confirm ShinyHunters exfiltrated an alleged 240 million records from Canvas LMS, including student ID numbers and enrolled course information, in what is now being classified as an encryptionless extortion attack. While previous reports focused on...
CRITICAL: Palo Alto Networks Firewalls Under Active Attack via Unpatched Zero-Day (CVE-2026-0300)
Update:This update provides further details on the critical CVE-2026-0300 zero-day affecting Palo Alto Networks PAN-OS firewalls. While the CVSS score is noted as 9.3 (compared to 9.8 previously), the article emphasizes the catastrophic impact, including complete fir...