This week of Cybersecurity Weekly Report May 25–31, 2026 was defined by three converging forces: a landmark shift in breach entry vectors confirmed by the 2026 Verizon DBIR, a wave of high-profile software supply chain compromises targeting developer infrastructure, and active exploitation of critical flaws in enterprise platforms.
For the first time in 19 years of DBIR history, vulnerability exploitation not stolen credentials became the leading cause of data breaches, accounting for 31% of all incidents. Meanwhile, GitHub confirmed a significant internal breach triggered by a poisoned VS Code extension, and threat actors weaponized critical flaws in Palo Alto GlobalProtect, Ghost CMS, Microsoft SharePoint, and Fortinet EMS.
The week also reinforced AI’s growing role in both offensive and defensive operations, with multiple threat actors demonstrating LLM-assisted post-exploitation and AI-powered phishing campaigns. For security teams, the message was blunt: the patch window has collapsed from months to hours, and developer tooling is now front-line attack surface.
Major incidents in this Cybersecurity Weekly Report
GitHub – Developer Platform / Software Supply Chain
- Attack Type: Supply chain compromise via malicious VS Code extension (Nx Console, 2.2 million installs)
- A poisoned version of the verified Nx Console extension was live on the VS Code Marketplace for just 18 minutes. A GitHub employee had it installed. Attackers exfiltrated approximately 3,800 to 4,000 private internal repositories and silently stole credentials from 1Password, Anthropic Claude Code, npm, GitHub, and AWS.
- The extension was weaponized using a GitHub token stolen weeks earlier during the TeamPCP threat actor’s TanStack npm supply chain campaign.
- Response: GitHub confirmed the breach, revoked compromised tokens, and stated that customer-facing repositories were not affected. The stolen data was advertised on a cybercrime forum.
- Impact: Significant reputational damage for both GitHub and the VS Code extension marketplace ecosystem. The incident raises urgent questions about trusted publisher verification and extension integrity at scale. Read more
7-Eleven – Retail / Global Convenience Chain
- Attack Type: Unauthorized system access targeting franchisee document infrastructure
- ShinyHunters claimed responsibility and stated it extracted more than 600,000 Salesforce records containing personal and corporate data belonging to franchisees and their contacts.
- Response: 7-Eleven confirmed unauthorized access and is offering identity protection services to affected individuals. Scope of corporate exposure is still under assessment.
- Impact: The breach affects a global franchise network. Salesforce record exposure carries downstream risk for franchisee partners and B2B contacts. ShinyHunters continues to be one of the most active threat actors targeting customer data repositories. Read more
Grafana Labs – Open-Source Observability / DevOps Infrastructure
- Attack Type: Credential compromise via stolen GitHub token
- Attackers used a compromised GitHub token to access portions of Grafana’s internal source code. The company detected the intrusion and confirmed it refused to pay any ransom demand.
- Response: Grafana Labs stated no customer data was exposed and no service disruption occurred. The incident was contained.
- Impact: Source code exposure in observability platforms carries long-term risk – attackers who study internal logic can identify undisclosed vulnerabilities or craft targeted exploits for deployed Grafana instances. Read more
Ghost CMS Sites (Harvard, Oxford, DuckDuckGo blogs confirmed)
- Attack Type: Mass exploitation of unauthenticated SQL injection – CVE-2026-26980 (CVSS 9.4) combined with ClickFix social engineering against blog readers
- Malicious JavaScript injected into compromised CMS pages displayed fake error prompts instructing readers to execute terminal commands, enabling endpoint compromise.
- Response: Ghost released emergency patch version 5.120.1. Self-hosted operators must run
ghost updateimmediately and audit page source code for unauthorized scripts. - Impact: The campaign redirects trust from high-authority domains against their own readers a particularly dangerous vector because institutional URLs bypass user suspicion filters. Read more
This week’s incidents share a common thread attackers are targeting the trusted middle layer, whether developer tooling, franchisee platforms, or observability infrastructure. Rather than breaching end targets directly, threat actors compromise the trusted tools and tokens that organizations depend on daily, creating a persistent access channel that is significantly harder to detect than perimeter intrusions.
New vulnerabilities & patches
1,CVE-2026-0257 | Palo Alto Networks | PAN-OS GlobalProtect | CVSS: 7.8 | Exploited: Yes – An authentication bypass flaw in the GlobalProtect portal and gateway that allows attackers to sidestep authentication and establish unauthorized VPN connections. Exploitation requires override cookies and a specific certificate configuration to be in place. Palo Alto confirmed active exploitation in the wild on May 29.
[PATCH] Apply the available PAN-OS update immediately and review all GlobalProtect configurations for override cookie usage. Organizations should treat exposed GlobalProtect endpoints as potentially compromised until patched.
2. CVE-2026-35616 | Fortinet | FortiClient EMS | CVSS: 9.1 | Exploited: Yes – A critical pre-authentication API access bypass in FortiClient Endpoint Management Server. Attackers exploited this flaw to push credential-stealing malware across managed endpoints. Arctic Wolf reported the payload was disguised as a legitimate Fortinet update and executed silently via PowerShell.
[PATCH] Fixed in FortiClient EMS 7.4.7 and later. Organizations using FortiClient EMS must upgrade immediately. Review endpoint update logs for unauthorized PowerShell activity.
3.CVE-2026-32201 | Microsoft | SharePoint Server | CVSS: 8.8 | Exploited: Yes – A deserialization remote code execution vulnerability that any authenticated user can trigger. Active exploitation was observed against more than 1,300 internet-exposed on-premises SharePoint servers even though a patch has been available for 44 days.
[PATCH] Apply SharePoint SE CU3, KB5002659 (2016), or KB5002658 (2019).
4.CVE-2026-45659 | Microsoft | SharePoint Server | CVSS: 8.8 | Exploited: No – A newly disclosed RCE via deserialization, published in Microsoft’s May Patch Tuesday cycle. Exploitable by any authenticated user.
[PATCH] Apply May Patch Tuesday updates immediately.
5.CVE-2026-41091 | Microsoft | Windows Defender (Malware Protection Engine) | Exploited: Yes – A local privilege escalation flaw in the Malware Protection Engine. Microsoft released fixes automatically through standard Defender update channels.
[PATCH] Verify that automatic Defender updates are running and confirm component versions are current.
6.CVE-2026-26980 | Ghost Foundation | Ghost CMS | CVSS: 9.4 | Exploited: Yes – Unauthenticated SQL injection in Ghost CMS’s Content API. Mass exploitation campaign confirmed.
[PATCH] Update to Ghost 5.120.1 via ghost update. Audit all pages for injected JavaScript.
7.CVE-2026-39987 | Marimo | Marimo Notebooks (all versions through 0.20.4) | CVSS: Critical | Exploited: Yes – Pre-authentication remote code execution in internet-facing Marimo notebook instances.
[PATCH] Upgrade beyond version 0.20.4. Remove public-facing Marimo notebook exposure unless strictly required.
Priority Action: Security teams should treat every CVE on CISA’s KEV catalog as an active incident with a 72-hour remediation deadline. The 2026 Verizon DBIR confirms only 26% of KEV-listed CVEs were patched in 2025, with a median patching time of 43 days – that 43-day window is when attackers are inside your environment.
Ransomware activity in this Cybersecurity Weekly Report
Nitrogen Ransomware – Foxconn (Electronics Manufacturing)
The Nitrogen ransomware group’s high-profile breach of Foxconn’s North American facilities continued to generate significant industry attention this week as details of the stolen data became clearer. The group claims to have exfiltrated 8 terabytes of data across more than 11 million files from plants in Wisconsin and Texas. The stolen data allegedly includes assembly instructions, data center topology diagrams, and hardware schematics tied to Apple, Intel, Google, Dell, and NVIDIA. Foxconn confirmed the attack and stated affected factories are resuming normal production, but has not addressed the ransom demand or confirmed the scope of data exposure.
Nitrogen employs classic double-extortion tactics: encrypting files and simultaneously exfiltrating them to create two separate extortion levers. The group first emerged in 2023 using ALPHV infrastructure and later incorporated stolen Conti code to build custom tooling targeting Windows and VMware server environments.
Ransomware Landscape – Broader Activity
The week saw ransomware groups continuing to leverage RaaS (Ransomware-as-a-Service) recruitment and data leak site operations as primary pressure mechanisms. Check Point Research released data showing a 124% surge in hacktivism and ransomware incidents across Germany, Austria, and Switzerland during 2025. Law enforcement did not announce any major takedowns or arrests during this specific week.
The manufacturing sector’s reliance on operational continuity creates a high-leverage extortion environment for ransomware groups.
Threat intelligence
GREYVIBE – Russia-Linked APT
WithSecure detailed a previously undocumented Russian-speaking threat actor designated GREYVIBE, active since at least August 2025 and assessed to be aligned with Kremlin intelligence interests.
- T1566.002 – Spear-Phishing Link
- T1027 – Obfuscated Files or Information
Nimbus Manticore – IRGC-Linked
- T1608.006 – SEO Poisoning / Search Engine Manipulation
- T1059.001 – Command and Scripting Interpreter: PowerShell
Storm-2949
CyberProof intelligence flagged an ongoing cloud-focused intrusion campaign by Storm-2949, leveraging social engineering against Microsoft Entra ID Self-Service Password Reset workflows.
ChatGPhish – AI Attack Surface Research
Permiso Security disclosed a technique called ChatGPhish that abuses ChatGPT’s implicit trust in Markdown links and images sourced from third-party pages it summarizes.
Industry news
Verizon 2026 Data Breach Investigations Report
The 19th annual Verizon DBIR delivered a watershed finding: vulnerability exploitation (31%) has overtaken credential theft (13%) as the primary breach entry vector for the first time in the report’s 19-year history.
CISA KEV Activity
CISA maintained active catalog management this week, with ongoing additions tied to Palo Alto GlobalProtect (CVE-2026-0257) and Fortinet FortiClient EMS (CVE-2026-35616).
AI Threat Landscape – Check Point March-April Digest
Check Point Research released its March–April 2026 AI Threat Landscape digest during this week. The report confirms that AI-driven attacks have entered routine criminal use.
LLM-Assisted Post-Exploitation – Marimo/Sysdig Case Study
Sysdig published research documenting the first confirmed case of an LLM agent used operationally for post-exploitation.
Tool updates
Metasploit Framework
The Metasploit community and Rapid7 maintained active module development this week, with expected additions targeting newly disclosed CVEs in the SharePoint and Palo Alto GlobalProtect vulnerability classes.
Ghost CMS 5.120.1
Ghost released an emergency patch release addressing CVE-2026-26980. The update is available via the ghost update CLI command.
Fortinet FortiClient EMS 7.4.7
Fortinet released a patched version of FortiClient EMS addressing the critical CVE-2026-35616 authentication bypass.
Kali365 – Threat Intelligence Note (Adversarial Tool)
The FBI issued a warning about Kali365, a Phishing-as-a-Service kit distributed primarily through Telegram.
Looking ahead
- SharePoint Exploitation Escalation – With two active CVEs (CVE-2026-32201 and CVE-2026-45659) both affecting on-premises SharePoint.
- Supply Chain – npm / VS Code Extension Ecosystem – The TeamPCP TanStack campaign has not been fully neutralized.
- AI-Accelerated Exploitation Operationalization – The Marimo LLM post-exploitation case and the Check Point AI threat digest both point to a rapidly maturing adversarial AI capability set.
Upcoming Events
- Microsoft June Patch Tuesday is expected during the second week of June.
- Security teams should allocate remediation bandwidth in advance of the June patch cycle.
