Latest CyberSec News by @thecyberpicker

Grafana confirmed a GitHub token breach that exposed source code, but said no customer data or systems were affected. Grafana Labs confirmed a security incident after the extortion group Coinbase Cartel listed it on a leak site and claimed data theft on May 15. The breach was triggered by a compromised token that gave attackers […]

Operation Ramz led to 201 arrests across 13 MENA countries, disrupting phishing, malware, and fraud networks.

Today Microsoft is announcing a major step forward in AI-powered cyber defense: a new multi-model agentic scanning harness (codenamed MDASH).

Read how built-in security helps keep small and medium businesses running, protect customer trust, and support growth in a new Microsoft whitepaper.

The Shai-Hulud malware leaked last week is now used in new attacks on the Node Package Manager (npm) index, as infected packages emerged over the weekend.

ORLANDO — Companies are pulling AI agents into their daily operations through a dozen side doors. Related: SaaS and AI agents converge One of them was in focus at KB4-CON, KnowBe4’s annual customer conference at the Marriott World Center here last week. The Clearwater, Fla.-based cybersecurity training vendor used the conference to lay out a

This week’s top cyber threats, attacks, breaches, malware, and urgent security updates.

En marge de la publication de Linux 7.1-rc4, Linus Torvalds, créateur du noyau Linux, s'est penché sur un sujet qui cristallise les craintes de la communauté open source face à l'essor de l'IA : l'inondation de signalements de bugs. C'est un défi immense, soulevé depuis des mois par de nombreux mainteneurs de projets

Grafana Labs disclosed that hackers have downloaded its source code after breaching its GitHub environment using a stolen access token.

Phishing links exposed in 40 seconds across U.S. sectors, helping SOCs cut MTTR by 21 minutes and triage 94% faster.

A hotel check-in system exposed over 1 million passports, IDs, and selfies online due to a misconfigured cloud storage bucket.

7-Eleven confirmed a breach after ShinyHunters claimed theft of over 600,000 Salesforce records and franchisee data.

Explores cloud risks—misconfigurations, IAM failures, and cross-domain threats—and how AI-powered tools can reduce cloud risk.

This week in cybersecurity from the editors at Cybercrime Magazine

The report presents key trends and statistics on malware that targeted personal computers running Windows and macOS, as well as Internet of Things (IoT) devices, during Q1 2026.

This report contains mobile threat statistics for Q1 2026, along with noteworthy discoveries and quarterly trends: new versions of SparkCat and Triada.

Ivanti, Fortinet, SAP, VMware, and n8n fix 11 flaws, including 9.6 bugs, reducing RCE, auth bypass, and escalation risks.

3 campaigns hit npm, PyPI, and Docker Hub in 48 hours, exposing secrets from developer and CI/CD environments.

A critical NGINX flaw (CVE-2026-42945) is actively exploited, allowing crashes or possible code execution via malicious HTTP requests.

It’s nasty, but it requires physical access to the computer: The exploit, named YellowKey, was published earlier this week by a researcher who goes by the alias Nightmare-Eclipse. It reliably bypasses default Windows 11 deployments of BitLocker, the full-volume encryption protection Microsoft provides to make disk contents off-limits to anyone without the decryption key, which is stored in a secured piece of hardware known as a trusted platform module (TPM). BitLocker is a mandatory protection for many organizations, including those that contract with governments...

Microsoft has finally brought back the resizable taskbar and Start menu to Windows 11 in the latest preview version rolling out to Insiders in the Experimental channel.

Saved passwords in Microsoft Edge will no longer sit in plaintext memory for the entire browser session after a researcher raised concerns.

4 malicious npm packages with 3,006 downloads spread stealers and Phantom Bot, forcing removals and secret rotation.

The Canvas breach exposed a fatal flaw in enterprise security: a total reliance on platform availability over data protection. Learn why identity governance and cryptographic resilience are the only ways to reduce the blast radius of the next inevitable SaaS attack.

Dans une publication LinkedIn, le 17 mai 2026, l'éditeur d'outils de monitoring et de visualisation de données Grafana Labs a révélé que son environnement GitHub a été compromis par un acteur non identifié, qui a réussi à mettre la main sur un token permettant d'accéder à l'ensemble de ses dépôts de code. Que faire ?

MiniPlasma: a Windows SYSTEM privilege escalation believed patched in 2020 is still fully working on every patched Windows 11.

MiniPlasma revives a 2020 Windows cldflt.sys flaw, enabling SYSTEM access on May 2026 patched Windows 11 systems.