CIRCLE WITH A DOT

Automated vulnerability intel, using Hermes AI https://threat-modeling.com/vulnerability-intelligence-report-may-21-2026/

GitHub ~3,800 internal repos compromised through a malicious VS Code extension https://www.secureblink.com/cyber-security-news/3-800-git-hub-repos-breached-via-poisoned-vs-code-extension-by-team-pcp

Iran Wants to Tax the Internet Flowing Through the Strait of Hormuz While Restricting Its Own Citizens Online https://irannewswire.org/iran-tax-the-internet-strait-of-hormuz/

When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax https://blog.doyensec.com/2026/05/19/cfitsio-weaponized-filenames.html

We audited 12K n8n templates: most have critical vulnerabilities https://blog.aironclaw.com/n8n-12k-templates-critical-vulnerabilities/

Sleeping Agent: Silent persistent C2 through Web Push https://bountyy.fi/blog/sleeping-agent-web-push

ShinyHunters Stole 275 Million Student Records. The Ransom Deadline Is May 12. https://www.hitechies.com/shinyhunters-canvas-instructure-breach-2026/

AudioHijack: adversarial audio attacks on generative voice models transfer from open weights to Microsoft and Mistral production systems https://spectrum.ieee.org/voice-ai-audio-attacks

Autonomous AI Penetration Testing with Consent-First Ethical Framework — Research Paper + Working Implementation https://doi.org/10.5281/zenodo.19562302

Apple Maildrop lets you rewrite the filename, size, and icon on any icloud.com attachment link — no signature, no validation — reported July 2023, still live https://stuart-thomas.com/research/maildrop-spoofed-params/

A stealth approach to Process Injection - EntryPoint Hijacking https://ipurple.team/2026/05/13/entrypoint-hijacking/

The Algorithm Goes to War: Inside the AI Cyberweapon Revolution That Governments Cannot Stop https://novarapress.net/ai-cyberwar-autonomous-agents-cybersecurity/

Copy Fail (CVE-2026-31431): A Technical Deep Dive https://github.com/fraynal/articles/tree/main/copy.fail

Technical Analysis of EagleSpy V6.0 (CraxsRAT Rebrand) Distributed Through Odysee and Telegram https://odysee.com/@justicerat:e?r=3DBgjCS94gefoVr7FdzLsSAwTyHFU8V8

Needle crypto-stealer C2 analysis: API key embedded in plain text inside the Rust malware unlocked 1,932 victims and the operator's withdrawal config https://beelzebub.ai/blog/needle-c2-crypto-stealer-analysis/

Honey Tokens: Bait Credentials That Catch Breaches https://infisical.com/blog/infisical-honey-tokens

CVE-2026-42511 Breakdown: RCE in FreeBSD https://aisle.com/blog/aisle-discovers-cve-2026-42511-a-21-year-old-freebsd-remote-command-execution-vulnerability#the-vulnerability

Salesforce pentesting novel techniques- how to be an apex predator https://www.reco.ai/blog/salesforce-experience-site-pentest-apex-predator

The Danger of Multi-SSO AWS Cognito User Pools https://blog.doyensec.com/2026/05/05/cloudsectidbits-masso-cognito-sso.html

Acoustic Keystroke Recovery - Reconstructing Typed Text from a Laptop Microphone (Full Guide, 85% success rate) https://pwn.guide/free/hardware/keystroke-recovery