These news items are automatically aggregated from industry sources and are not individually reviewed. Any inaccuracies are unintentional — let us know and we'll correct or remove it.
Attackers compromised four widely-used Laravel localisation packages on Packagist, rewriting Git tags across more than 700 versions to inject a 5,900-line PHP credential stealer that exfiltrates cloud keys, CI tokens, SSH material, and browser data on every request.
CVE-2026-42897 is an Outlook Web Access cross-site scripting vulnerability in on-premises Exchange Server that is being exploited in the wild via crafted emails. CISA added it to the Known Exploited Vulnerabilities catalog with a May 29 remediation deadline for federal agencies. No permanent patch exists yet.
A cooling system failure at an AWS Northern Virginia data centre caused a multi-hour outage in Availability Zone use1-az4 in early May 2026. Coinbase, FanDuel, and CME Group were among the platforms disrupted. Amazon later confirmed overheating as the root cause.
A compromised TanStack npm package gave attackers access to Grafana Labs’ GitHub environment, allowing them to download the company’s full codebase. Grafana received an extortion demand and refused to pay. The same supply chain attack also hit OpenAI and Mistral AI.
Ubiquiti has patched five vulnerabilities in UniFi OS, three of them rated maximum severity with CVSS scores of 10. All three allow unauthenticated remote attackers to take full control of affected devices. Censys tracks nearly 100,000 internet-exposed UniFi OS endpoints.
A CVSS 9.3 buffer overflow in Palo Alto Networks PAN-OS allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls. The vulnerability was added to CISA’s Known Exploited Vulnerabilities catalogue on May 6 following confirmed in-the-wild attacks.
Google’s Threat Intelligence Group confirmed that criminal hackers used a large language model to develop a working zero-day exploit targeting a logic flaw in a widely deployed open-source authentication tool, marking the first verified case of AI-generated exploit code used in an active attack.
Meta discontinued the opt-in end-to-end encryption feature for Instagram DMs on May 8, 2026, citing low adoption. The change means Meta now has technical access to the content of all Instagram direct messages, and the timing relative to the US Take It Down Act is drawing scrutiny from privacy researchers.
Apple has confirmed its Worldwide Developers Conference keynote for June 8, 2026. Expected announcements include iOS 27, macOS 27, a significant Siri overhaul, and expanded Apple Intelligence capabilities. Businesses with iOS apps or Apple-integrated services should begin preparation now.
Google’s developer conference delivered Gemini 3.5 Flash, the CodeMender AI security agent, expanded SynthID watermarking, and a universal agentic commerce layer. Here is what the announcements mean for businesses building on Google’s ecosystem.
Our team of experts is ready to help you with your infrastructure challenges. We’ll give you honest and personal treatment. Get in touch to learn more.
Get in touch!