Miasma Worm Hits Microsoft, Cisco & Android Zero-Days Exploited, and FBI Network Breached by State-Sponsored Hackers

The new report covers May 2026, showing a 3% overall increase in ransomware attacks to 661 incidents. The education sector was severely impacted with a 54% surge. Qilin continues to be the most active group, responsible for 97 attacks, alongside The Gentlemen and DragonForce. Notably, 115 terabytes of data were exfiltrated. The US remains the top target. New groups like Play and Genesis showed significant activity increases. The article also provides new hunting hints and detection strategies, including specific command-line patterns and process names for data exfiltration.

An autonomous AI agent from depthfirst has discovered 21 zero-day vulnerabilities in the widely used FFmpeg multimedia library, some existing for nearly two decades. Nine of these flaws have been assigned CVEs, posing a significant supply chain risk. Concurrently, Google Chrome 149 released a record 429 security patches, including a critical sandbox escape (CVE-2026-10881, CVSS 9.6). These events provide concrete evidence of the accelerating pace of AI-driven vulnerability discovery, validating concerns about the 'Agentic Era' and increasing pressure on defenders to manage a growing influx of bugs.

Palo Alto Networks' Unit 42 has officially confirmed active exploitation of CVE-2026-0257, a critical authentication bypass vulnerability in PAN-OS GlobalProtect. The new report highlights the increased threat level due to the public release of a Proof-of-Concept (PoC) exploit, which significantly raises the risk of widespread attacks. Unit 42 reiterates the critical impact of the flaw, even without observed lateral movement, as it provides an initial foothold for attackers. The update also provides enhanced guidance for detection, response, and threat hunting, including monitoring for suspicious host IDs and device names, and leveraging Cortex Xpanse for asset identification.

New information clarifies that CVE-2026-20245 affects 'Cisco Catalyst SD-WAN Manager' and requires an 'authenticated attacker with administrative privileges (netadmin)' to exploit, correcting the previous understanding of it being unauthenticated. The vulnerability was reported by Mandiant and impacts all deployment types. While no direct patch is available, Cisco recommends upgrading to a version that addresses CVE-2026-20182 (an authentication bypass) to make exploitation of CVE-2026-20245 more difficult. This is the seventh SD-WAN zero-day from Cisco in 2026.

The actively exploited Android zero-day, CVE-2025-48595, is now confirmed to be an integer overflow vulnerability in the Android Framework, carrying a high CVSS score of 8.4. This flaw allows for local privilege escalation without user interaction, affecting Android versions 14, 15, 16, and 16 QPR2. A significant development is CISA's addition of this CVE to its Known Exploited Vulnerabilities (KEV) catalog, which mandates federal agencies to patch by June 5, 2026. This highlights the critical nature and active threat posed by the vulnerability, reinforcing the urgency for all users to apply the June 2026 security update.