Security incidents in May 2026

Attackers have exploited Langflow CVE-2025-34291 to take over accounts and run server code when users visit malicious pages. Versions through 1.6.9 are affected. Upgrade to a current stable release and apply Langflow’s CORS and cookie guidance.

Attackers used a flaw in Trend Micro Apex One’s on-premise server to distribute malicious code to managed computers. They first need server administrator access. Ask IT to update the server and agents to the latest supported build.

CISA listed an exploited DirectX flaw affecting old Windows 2000, XP and Server 2003 systems. Malicious QuickTime files can run code. Microsoft fixed it in 2009; have a technician check legacy computers for MS09-028 and move them to supported Windows.

CISA listed two 2010 Internet Explorer flaws (CVE-2010-0249, CVE-2010-0806) as exploited on 20 May 2026. Microsoft fixed both in 2010. Anyone still running unpatched old Windows with IE should update or stop using it; IE is end-of-life.

Two Microsoft Defender flaws were used in attacks: one lets someone already on a PC take full control, the other can stop Defender working. Fixes shipped by automatic update in May. Check Defender's engine is 1.1.26040.8 or later and platform 4.18.26040.7 or later.

CISA listed a 2009 Adobe Acrobat and Reader flaw (CVE-2009-3459) as exploited on 20 May 2026. It was fixed in 2009, in versions 7.1.4, 8.1.7 and 9.2. Anyone on a current, updated Acrobat or Reader is not affected; very old copies should be removed.

CISA says attackers are using CVE-2008-4250, a 2008 Windows Server service flaw that lets a crafted network request run code. Microsoft fixed it in 2008. Machines that are fully updated are covered; old unpatched Windows (XP, 2000, 2003) are the risk. Update or retire them.

Attackers used LiteSpeed’s cPanel plugin to turn an ordinary hosting account into full server control. Website owners should ask their host to update the plugin and check for compromise. Updating the WordPress cache plugin does not address this flaw.

Attackers are targeting Drupal websites using PostgreSQL. CVE-2026-9082 can expose data and sometimes allow server takeover without signing in. Website owners should ask their administrator to install the latest supported Drupal release urgently.

Attackers used malicious emails to compromise people reading mail through vulnerable Exchange Outlook Web Access servers. Fixes are available. Ask your email administrator to install current Exchange updates and check for persistent mailbox access.

Attackers used CVE-2026-20182 to gain privileged access to Cisco Catalyst SD-WAN business networks without credentials. Fixes cover Controller, Manager and Validator. Ask IT to preserve logs, update every control component and check for compromise.

Attackers are using a GlobalProtect VPN flaw to enter business networks without valid credentials, including for ransomware. Ask IT to install the correct PAN-OS fix, confirm Prisma Access upgrades and investigate suspicious VPN connections.

Attackers targeted LiteLLM AI gateways through CVE-2026-42208, which can expose database contents and managed credentials without a login. Versions 1.81.16–1.83.6 are affected. Update to 1.83.7 or later and investigate exposed installations.

Attackers with an Ivanti EPMM administrator login used CVE-2026-6973 to run code on workplace mobile-management servers. May fixes are available; ask IT to check the subsequent June advisory and apply current vendor updates.

Attackers exploited CVE-2026-0300 to take full control of Palo Alto Networks firewalls with exposed Captive Portals. Fixes are available. Ask your IT provider to update affected firewalls and investigate any previous exposure.

Copy Fail lets someone already running code on an affected Linux machine gain administrator control. Attackers are using it. Install your distribution's kernel security updates and restart; some specialist kernels still lack a fix.

Dirty Frag lets someone already running code on affected Linux computers or QNAP storage gain full administrator access. Install your Linux distributor's kernel updates and restart; update QNAP firmware. Some specialised Ubuntu kernels still await fixes.

Gravity Bridge lost about US$5.4 million and halted transfers between Ethereum and Cosmos. Later research disputes the initial stolen-key theory. Recovery and a safe restart remain unconfirmed; avoid new deposits and check any exposure with your custodian.

DxSale's old 2021 v1 liquidity lockers on BNB Chain were drained of about US$7.3M across 1,400+ pools after ownership passed to an attacker. No recovery or compensation confirmed. Projects with tokens locked in v1 should check their lock and contact DxSale.

SUPERFORTUNE AI lost about 14.98M GUA (~US$15M) on 27 May 2026 when an airdrop transfer was redirected to a lookalike address. Cause unconfirmed, no recovery reported. Holders: nothing to patch; be wary of GUA claims and always check full addresses.

An attacker used one compromised minting key to create unbacked USDR and EURR stablecoins on 23–24 May, crashing their prices. As of late October, redemption is still suspended with no resumption date or compensation scheme.

Published Charter data exposed 4.9 million unique email addresses, contact details and an employee-directory subset. Charter says its business-customer sales tools were affected. Check your email in HIBP and independently verify unexpected Spectrum messages.

More than 600,000 entries, mainly real-estate register extracts with names and personal codes, were copied from Lithuania's Centre of Registers using other institutions' logins. Residents can check the Centre's portal. No charges or named suspect found as of November 2026.

Attackers stole German hospital patients’ data through billing provider Unimed, including around 54,000 patients in Freiburg and around 30,000 in Cologne. Read your notification letter and verify unexpected hospital bills or payment requests directly.

An authentication flaw in Haveno, the protocol under Monero exchange RetoSwap, let an attacker pose as the arbitrator and take about 7,000 XMR (US$2.7M) on 20 May 2026. No recovery reported. Trading was suspended again on 17 June. Don't trade there until it relaunches.

The Verus–Ethereum bridge lost about US$11.7 million in May; roughly 75% was returned. Holders of bridged ETH, bitcoin and related investment baskets faced losses. Check restitution with Verus or your custodian before moving more funds through the bridge.

DentaQuest’s May breach exposed millions of people’s identity, insurance and health details. Affected families should confirm their exposure, take up free Kroll monitoring and consider freezing US credit files.

THORChain, a cross-chain crypto swap network, lost about US$10.7M on 15 May 2026 when an attacker who joined as a node rebuilt a vault's key. Trading resumed 23 June. No funds confirmed returned. Nothing to update; users should treat any "refund" messages as scams.

An intruder downloaded AssetMark customer files on 15 May; filings reported 570,000 people affected. Names, Social Security numbers and account numbers were potentially exposed. Check your notice, monitor accounts and consider freezing US credit files.

Reqrea’s Tabiq hotel check-in service exposed guests’ identity documents and photos through public cloud storage. Access is blocked; theft remains unconfirmed. Ask whether you were affected and beware messages requesting passwords or money.

An attacker drained TrustedVolumes’ crypto inventory through its Ethereum swap proxy. About US$2 million was reportedly returned in July; full recovery remains unconfirmed. If you have exposure through an investment manager, ask them to check it.

Attackers breached Canvas again on 7 May, disrupting final exams. Instructure says no additional data was stolen and the flaws are fixed. Students and families should ask their school whether the earlier data theft affected them.

GFN.am’s breach exposed customer identity and contact details, with passwords unaffected. NVIDIA says its own services were untouched. GFN.am customers should check official notices and watch for phishing; no device update is required.

Ransomware stole West Pharmaceutical data and disrupted manufacturing and shipping of injectable-drug packaging and devices. Global operations resumed by 20 May. There is no family device update; the extent of stolen data remains unconfirmed.

A tampered Nx Console 18.95.0 for VS Code was live for under 40 minutes on 18 May and stole credentials, keys and 1Password CLI data. It led to GitHub's internal repositories being stolen. If you ran it, update to 18.100.0+ and rotate every secret.

TeamPCP poisoned more than 160 developer packages to steal credentials. Affected developers need clean packages, machine recovery and replacement secrets. Mac users should install current OpenAI apps following precautionary certificate changes.

Selected JDownloader website downloads spread malware on 6–7 May. Clean links are restored. If you ran an affected installer, arrange a clean operating-system reinstall and change important passwords from another device.

Fake FIFA sites targeted World Cup fans through Facebook ads, stealing logins, personal details and payments. If you entered details, change your FIFA password and contact your payment provider. The tournament has ended; the campaign’s closure is unconfirmed.

Fake ChatGPT Plus billing emails led recipients to forms stealing personal and payment-card details. Microsoft observed 4,500 emails, 97% targeting South Africa. Check billing directly in ChatGPT; contact your bank immediately if you supplied card details.