May 2026's critical rundown: an 18-year-old NGINX rewrite RCE (CVE-2026-42945) enabling unauthenticated code execution, Microsoft's 138-flaw Patch Tuesday with 16 bugs found by its own MDASH AI, an Exim BDAT flaw, a BitLocker zero-day PoC fixed only on Windows 11, and the 150-package GemStuffer RubyGems campaign.
May 2026 is defined by AI-powered attacks (Claude workspace npm stealers, Grandoreiro phishing), an exploited 0-day flood (NGINX CVE-2026-42945, Defender, DirtyDecrypt), the GitHub breach and Megalodon CI/CD poisoning, and OAuth consent phishing that sidesteps MFA. Defense strategies inside.
Three AI-adjacent CVEs hit CISA's KEV catalog in one month: the LiteLLM proxy auth bypass exposing every prompt your org ever sent, a Linux kernel privesc reaching GPU training clusters, and PAN-OS as the beachhead. Living off the LLM, explained.
What a SIEM really costs over three years: Splunk vs Sentinel vs Elastic compared across eight TCO layers, with a 100 GB/day worked example, seven hidden costs, and the RFP questions that expose the real price.
Three versions of node-ipc (10.1.1-10.1.3) shipped a stealer backdoor - CVE-2026-44338 - harvesting SSH keys, AWS credentials and .npmrc from 1.2M-weekly-download installs via DNS tunneling and HTTPS C2. Technical breakdown and hardening guide.
RSAC 2026's dominant theme was agentic AI security — AI agents are now the target. Cisco's DefenseClaw, the MCP server problem, and a five-step playbook for securing autonomous agents.
One week in April 2026 delivered a CVSS 9.8 AI-agent flaw, an unauthenticated SGLang RCE, MCP memory poisoning, and a 766-host credential harvest. Here's the full analysis and your patching order.
This week: npm 2FA-gated publishing, LiteSpeed CVE-2026-48172 exploited for root on shared hosting, Drupal SQLi added to CISA KEV, 8 Packagist packages shipping Linux malware, a CVSS 10.0 Cisco flaw, and the first VPN takedown over ransomware facilitation.
April 2026 was one of the most volatile months in cybersecurity history: Microsoft's 167-flaw Patch Tuesday, exploited SharePoint and IKE zero-days, ransomware at Rockstar and McGraw-Hill, and two CISA emergency directives — everything defenders need to know.
AI agents are the new attack surface: goal hijacking, tool abuse, memory poisoning, and delegation escalation — plus the five-layer defense framework that catches what WAFs and code review can't.
Microsoft's April 2026 Patch Tuesday fixed 168 vulnerabilities — an exploited SharePoint zero-day (CVE-2026-32201), the BlueHammer Defender EoP, and a CVSS 9.8 IKE RCE. Complete breakdown and patching order inside.
What should a penetration test cost in 2026? Real price ranges by test type, the five factors that move quotes, a build-your-own estimate formula, and the red flags of scanner resale dressed up as pentesting.
New threat analyses, tool guides and hardening playbooks — delivered straight to your inbox, the moment they go live.